Privacy

Scope and operator

A.R.C. is a private employee platform operated by Spotlight Branding. It helps authorized team members coordinate client work, review marketing performance, manage integrations, and create campaign materials.

This notice describes information handled by A.R.C. It does not replace the privacy notices of Google or any other service that an authorized user chooses to connect.

Information handled by A.R.C.

Employee account information

When an approved employee signs in with Google Workspace, A.R.C. receives basic account information such as name, work email address, profile image, and authentication status. The platform also stores access role, interface preferences, and recent activity needed to operate the workspace.

Client and campaign information

A.R.C. may store client names, websites, brand profiles, logos, colors, fonts, service selections, reporting configurations, campaign metrics, alerts, creative materials, and workflow notes entered or generated by authorized team members.

Integration information

When a team member connects an approved service, A.R.C. may store account identifiers, selected properties or lists, authorization tokens, and synchronized reporting data needed for the selected feature.

Operational information

The platform records limited technical diagnostics such as request identifiers, affected feature, response status, timestamps, and error summaries. Diagnostic alerts are designed not to store credentials or request bodies.

How information is used

• Authenticate approved Spotlight Branding employees and manage access roles.
• Display client dashboards, campaign reporting, alerts, and workflow materials.
• Connect and synchronize services selected by authorized team members.
• Save shared client configuration and individual interface preferences.
• Maintain reliability, investigate failures, recover stored information, and protect the platform.

A.R.C. does not sell employee or client information and does not use connected-service data for personalized advertising.

Google and connected services

Authentication takes place on accounts.google.com. A.R.C. never asks for, receives, or stores an employee's Google password. Google provides A.R.C. with authorization tokens for the permissions an employee approves.

Depending on the features selected, A.R.C. may communicate with services such as Google Workspace, Google Analytics, Google Business Profile, Meta, LinkedIn, Zoho, HighLevel, Mailchimp, Brevo, MailerLite, Lawmatics, Slack, or approved AI providers. Information is sent to a provider only when needed to perform the requested connection or feature.

Information received from Google APIs is used to provide and improve the internal, user-facing functionality requested by authorized employees. It is not sold, transferred for personalized advertising, or used to create advertising profiles.

Storage, protection, and retention

Application information is stored in a private Supabase database with server-managed JSON rollback snapshots retained during migration. Connection credentials and tokens are encrypted before being written to persistent application storage and are not returned to browser code. Data is transmitted over HTTPS in production.

Information is retained while it is needed for Spotlight Branding's internal operations, client services, security, or recovery. Removing a connection deletes A.R.C.'s active stored connection record; rotating backups and recovery copies may continue to contain an earlier record until they are replaced through normal system operation.

No method of storage or transmission can be guaranteed completely secure. Spotlight Branding maintains technical and organizational controls appropriate to this internal platform and reviews access when circumstances change.

Choices and contact

Authorized employees can disconnect supported integrations inside A.R.C. An employee who needs account information corrected or removed should contact the platform owner. Client-related requests should be directed through the client's Spotlight Branding contact.