Privacy Policy | Arkon Strategy

1. Who Is Responsible

Arkon Strategy is a division of Haxlab Digital Inc., registered in Vancouver, British Columbia, Canada. Haxlab Digital Inc., operating through its Arkon Strategy division (“Arkon”, “we”, “us” or “our”), is responsible for personal information under its control. Our designated privacy contact is York Wang, reachable at hello@arkonstrategy.com. Use “Privacy request” in the subject. Our business mailing address is Haxlab Digital Inc., #3506 - 2008 Rosser Ave, Burnaby, BC, Canada, V5C 0H8.

This policy covers personal information we handle for our website, enquiries, free website audits and our own client relationship management. It also explains our role when providing agreed tracking and dashboard services for clients. Personal information means information about an identifiable individual, as defined by applicable law.

When a client decides why and how its customers’ information is used and we process that information on its behalf, the client’s privacy notice and our service and data-processing agreements also apply. This policy does not replace the client’s notice or give either party permission to collect information without a lawful basis. Our services are intended for an international business audience. Our dashboard technology is initially an internal tool for delivering Arkon’s services. If a standalone subscription product is offered later, it will have an appropriate notice and terms before launch; this website policy does not establish that product’s data practices.

2. Information We Collect and Why

Enquiries and bookings: name, email address, optional phone number, website address, chosen topic, message and related correspondence. We use this information to respond, arrange calls or demonstrations, understand requested work and maintain the business relationship.
Audit requests: first and last name, email, optional phone number, submitted website, selected search market, request identifiers and consent information. We use these to deliver and support the audit, manage access and request limits, and handle the communications requested in the form. Providing a phone number does not by itself authorize SMS marketing.
Website and audit evidence: public page content, URLs, technical observations, search and business-profile data, relevant public reviews, and the resulting findings and reports. Public material can still contain personal information. We use relevant evidence to assess the submitted website, explain findings and support the report.
Technical and security information: IP address, approximate country, browser or device information, request timing and metadata, spam-prevention responses, and service or error logs. We use these to serve the website, prevent abuse, troubleshoot failures and enforce request limits. The analyzer can use your IP-derived country to preselect a search market, which you may change; this is not precise device location.
Client administration: business contacts, agreements, instructions, approvals, service correspondence and billing records relevant to our relationship. We use these to deliver agreed services, administer accounts, resolve disputes and meet legal obligations.

Optional fields are identified in the forms. If information needed to answer a request or deliver an audit is withheld, we may be unable to provide that service. Please do not submit passwords, full payment-card details, government identifiers, health records or unnecessary sensitive information through the public website.

3. Client Tracking and Dashboard Services

When a client engages us to set up measurement or reporting, the agreed configuration may process campaign and tracked-link identifiers, QR-code visits, page views and interactions, referrers, device information, enquiry details, form submissions, call events, and customer or purchase outcomes supplied by the client or an authorized integration. Reports may combine those records to show campaign performance and observed customer activity.

Only the features and connections the client actually enables apply. The public website and a free audit do not automatically connect visitors to these services. A client must authorize access to its accounts, provide appropriate notices and obtain any consent required for tracking or customer communications. We process client-controlled information according to the agreed instructions, subject to our own legal obligations.

No call recording or transcription is implemented or approved for Arkon’s website or analyzer. Call-event measurement does not necessarily include call recording. Recording, transcription, session replay, sensitive information processing and new advertising uses require a specific assessment, appropriate notice and any required consent before activation. They are not authorized merely by accepting this policy.

If you are a customer of an Arkon client and your request concerns that client’s website or records, contact the client first. We will assist the client as required by our agreement and applicable law; you may also contact us for help identifying the appropriate route.

A new website audit request includes one transactional PDF email to the address you submit when the report is ready. This is not a marketing subscription.

4. Cookies and Browser Storage

The website stores your cookie preference in your browser’s local storage under arkon:consent, including whether you accepted or declined and when. Both choices are saved. The preference has no automatic expiry in the current implementation and remains until you clear browser storage or it is replaced. If browser storage is unavailable, the choice may last only for the current page.

You can reopen the notice using “Cookie choices” in the footer and change your selection. After you accept, Google Analytics 4 measures page visits and successful enquiry and audit submissions. It uses browser identifiers and device and usage information to help us understand how the site is used. Our analytics cookies last up to 90 days. We exclude form contents, contact details, submitted website addresses and private report tokens from the events we send. Advertising features and automatic form tracking are disabled. Declining prevents Google Analytics from loading; withdrawing consent removes its cookies and reloads the page to stop it. Browser settings can also remove stored information. See Google’s privacy policy.

Hosting and security services still process technical information needed to deliver and protect the site. Where enabled, Cloudflare Turnstile processes browser and device signals to distinguish legitimate requests from automated abuse; it is separate from optional marketing measurement.

Before optional analytics, advertising pixels or additional tracking are activated, we will describe their providers, purposes and controls and obtain consent where required. A stored choice is not blanket consent to materially different tracking. Declining optional tracking does not prevent you from reading the website or requesting services.

We use your contact details to respond to your enquiry and send information needed for a request or an agreed service. The audit form requests an audit and asks you to agree to the website terms, with this policy linked. The completed report appears on the website. We may reply to you about your request. These requests are not promotional subscriptions or permission for campaigns, sharing marketing lists or marketing on behalf of third parties. Agreement to website terms or acknowledgement of this policy is not, by itself, marketing consent. Audit requests made under an earlier version of the form keep the meaning of the wording shown at the time.

No automated promotional follow-up is operating. If a promotional programme is introduced later, it will need its own consent wording, unsubscribe process and mailing-list retention, none of which has been finalized. No SMS marketing system is configured. Before any promotional programme is activated, we will establish the required notices, consent and withdrawal process. We send promotional emails only where permitted by applicable law and on the basis of valid consent or another applicable permission. You may withdraw marketing consent using an unsubscribe option in the message or by contacting us. We will process unsubscribe requests without delay and, where Canada’s anti-spam law applies, no later than 10 business days. Necessary service communications may continue where permitted by law. We may retain a minimal suppression record to respect your choice.

You may also ask to withdraw consent for other uses of personal information, subject to legal or contractual restrictions. We will explain any effect on the service. Withdrawal does not undo processing that was lawfully completed beforehand. We will seek further consent before a materially different use where required; posting a revised policy alone does not provide that consent.

6. Service Providers, AI and Other Disclosures

We use providers for hosting and security, email delivery, audit processing, data storage, report rendering, website and search analysis, and AI-assisted review. Access is limited to the purpose of providing the relevant service, subject to appropriate contractual and security arrangements.

Our selected providers and their roles are:

Cloudflare: website hosting, private R2 storage for reports and evidence, and Turnstile spam protection.
Sentry: browser and server error monitoring to detect failed requests and troubleshoot the website. Our diagnostic events exclude form contents, contact details, private report tokens, URL queries, cookies and IP addresses. Session replay and performance tracking are disabled. Error monitoring runs separately from optional analytics.
Convex: dedicated audit job, submission and contact records.
Resend: enquiry and audit email sending. Audit submissions are included in our daily internal digest. New requests include a PDF email when ready; earlier requests remain on-demand. Copies go only to the submitted address.
Google Workspace: our business inbox, including enquiry messages and audit notifications. Our enquiry and audit contact address is listed in section 1.
DataForSEO and Google PageSpeed Insights/CrUX: website, search and performance measurements for submitted websites.
OpenAI: evidence-based report analysis and writing.
Our private shared PDF renderer on Hermes VPS: generation of report documents from report data.

The homepage also currently loads testimonial images from Unsplash. Loading those external images sends technical request information, such as your IP address and browser information, to that image host.

Not every provider receives every category of information. No Arkon CRM has been selected; enquiries and audit notifications go to our inbox. Processing locations, subprocessors and retention settings vary by provider and service; we have not yet completed verification of every provider setting.

An audit may send the submitted URL, public page content and relevant evidence to analysis providers. Submitted contact fields are excluded from GPT report input; they are used for intake and delivery. Public pages may themselves contain names or other personal information. AI-generated findings can be inaccurate and should be checked before material decisions. This policy does not authorize training general-purpose AI models on confidential client information. Provider retention and training settings must be verified for the services actually used.

We do not sell personal information or provide client customer lists to other businesses for their own marketing. Any future use that constitutes a sale, sharing for cross-context advertising or targeted advertising under applicable law will require an updated notice and the applicable choices before it begins.

We may disclose information to professional advisers under confidentiality obligations, where required or permitted by law, to protect legal rights or investigate abuse, or in connection with a business transaction subject to applicable privacy restrictions and safeguards. We may also disclose information at your direction. A provider or recipient acting for its own purposes is responsible for its own privacy practices.

7. Processing Outside Your Country

Arkon and its service providers may process or access information in Canada, the United States and other countries where the relevant personnel or providers operate. Information processed abroad may be accessible to courts, law enforcement or other authorities under local law, and protections may differ from those in your country.

We remain responsible for personal information under our control and use appropriate contractual and organizational safeguards for service providers. Where a specific transfer mechanism is legally required, it must be in place before that transfer. Our complete inventory of storage, support and remote-access countries is still being verified. Contact us for information about the providers and safeguards relevant to your request.

8. Retention and Security

We retain personal information for the purposes described in this policy and for applicable legal, accounting, security and dispute-resolution needs. Retention depends on the type of record, the service relationship, legal requirements and whether a request or dispute remains open. Once retention is no longer reasonably needed, information should be securely deleted or de-identified through the applicable retention process.

The following distinctions apply:

Public report links: access expires after seven days. This ends link access, not storage of the underlying records.
Audit reports, collected evidence and submitted audit contact details: a 90-day retention period applies and automated cleanup is configured. Stored report and evidence files are deleted by a storage lifecycle rule once they are 90 days old. Audit job records, including the submitted contact details and delivery entries, are removed by a daily batch once the request is more than 90 days old; a record still in use by an active delivery or an unexpired report link is skipped until the next run. Both steps run on a schedule, so deletion follows the 90-day mark rather than happening at an exact moment. This describes routine cleanup; legally required retention must be handled separately.
Email copies and ordinary enquiries: no deletion period has been set. The audit’s 90-day cleanup does not delete copies in our inbox, in recipients’ mailboxes or held by service providers.
Former-client records: an overall retention schedule has not yet been finalized; the audit period does not apply to all client records.
Operational logs, backups and provider-held copies: retention periods and deletion behaviour are not yet fully defined or verified.

For records without a fixed deletion period, we consider the purpose of the record, whether the relationship or request remains active, and applicable legal, accounting, security and dispute-resolution needs. You may request deletion; we will explain any legal reason we must retain particular records.

We use safeguards appropriate to the information and risk, including access controls, private report storage and protected service connections. No system or email transmission is completely secure. Keep private report links confidential, and tell us promptly if you suspect unauthorized access. We will assess incidents and notify affected individuals and authorities when required by applicable law.

9. Your Rights and Complaints

Depending on the law that applies, you may request access to your personal information, information about its use and disclosure, correction of inaccuracies, withdrawal of consent or deletion where available. Where applicable, additional rights can include data portability, restriction of processing, objection to processing, choices about targeted advertising or sale/sharing, and review or appeal of a refused request. We will not discriminate against you for exercising a protected privacy right. We will handle requests under the applicable law and will not require you to waive statutory rights.

Email us at the address in section 1 with enough detail to identify the request. We may take proportionate steps to verify your identity or an authorized representative’s authority. Do not send identity documents unless we request them through an appropriate channel. We will respond within the applicable statutory period; under British Columbia’s Personal Information Protection Act, access and correction requests generally require a response within 30 days, subject to lawful extensions. If access is limited or a lawful fee or extension applies, we will explain it and the available review process.

You may raise a concern with us or complain directly to the relevant regulator. In British Columbia, this is the Office of the Information and Privacy Commissioner for BC. For matters under federal Canadian private-sector privacy law, contact the Office of the Privacy Commissioner of Canada. You do not have to contact us before approaching a regulator.

10. Children, Other Websites and Updates

Our website and business services are intended for adults acting in a business capacity, not for children. We do not knowingly collect children’s personal information through the public forms. Contact us if you believe a child has supplied personal information so we can address it appropriately.

External websites and services linked from this site have their own privacy practices. This policy does not cover information you give directly to them.

We will update this policy when our practices change and identify the effective date. Material changes will receive appropriate notice, and we will obtain new consent where required. Features described as future or conditional do not become active simply because they appear in this policy.