Privacy policy

This covers two things: this website, getarti.com, and the Arti platform at app.getarti.com. The short version — the website keeps server logs, loads fonts from Google, and uses Google Analytics only if you accept it. The platform holds the marketing records of the businesses we work with, and reads the Google and other accounts we are given access to so that we can report on and manage what is there. We don't sell any of it, we don't use it for advertising, and we don't use it to train AI models. The detail is below.

1. Who we are, and who uses Arti

Arti is built and operated by Results Repeat, LLC (“we”, “us”, “our”), 24 Veterans Square, Media, PA 19063. For anything in this policy, reach us at info@resultsrepeat.com.

Arti is a marketing platform for businesses with physical locations. It is currently used by our own team, on behalf of our own clients — we are finishing the parts we use every day before opening it to other agencies. There is no public sign-up: staff accounts sign in with Google, client accounts sign in with a code emailed to an address we have invited, and every account is created by us.

So the data in Arti is our clients' business and marketing information, held and used by us to do the work they engage us for. Where it includes information about identifiable people, this policy explains what we hold and what you can ask us to do about it.

2. What the platform holds

Most of what Arti stores is business information rather than personal information: client and location records, addresses, opening hours, categories, brand guidelines, page copy, images and performance figures. The parts that can concern an identifiable person are:

Team accounts — the name, email address and role of each person who signs in, and a record of sign-ins and of actions taken in the app, so a change can be traced to the person who made it.
Client contacts — names, email addresses, phone numbers and roles for the people we deal with at each client.
Leads and enquiries — where a client's website or chatbot collects an enquiry, the contact details and the message the person submitted.
Reviews — review text and the reviewer name as Google publishes them, so they can be read and replied to in one place.
Performance data — the aggregated, non-identifying metrics described in section 3.

Enquiries from a client's website — where a client's site uses a form we host, we store every value submitted, the submitter's name, email address and phone number where given, the page and referring page, any campaign parameters, and — for these submissions only — the submitter's IP address and browser user-agent, which we keep to detect spam. Those two are visible only to our own staff, never to a client.
Chat conversations — where a client's site uses our chat widget, the full message transcript, the referring page, any campaign parameters, and a short fingerprint derived in the visitor's browser from their user-agent, screen size and time zone, used to recognise a returning visitor. We do not record a chat visitor's IP address, city, country or internet provider.
Bookings — name, email address, phone number, the date and time chosen, and any notes given.
Repeat-visit counts — for visitors to a client's site: the browser fingerprint above, user-agent, referring page, visit count and time on site.

3. Google user data

Arti connects to Google services using accounts that belong to us or to our clients, with their authorization, so that a location's marketing performance can be reported and its Google Business Profile managed from one place. This section is deliberately specific about what we access, why, and what we will never do with it.

What we request

When a Google account is connected to Arti, we request these permissions and no others:

Google Analytics, read-only (analytics.readonly). We read traffic and conversion metrics for the GA4 properties selected: sessions, users, new users, conversions and page views, broken down by date, channel, device, city, region, landing page, new-versus-returning and traffic source. We also read the list of properties the account can see, so the right property can be matched to the right location. We never create, change or delete anything in Google Analytics.
Google Search Console, read-only (webmasters.readonly). We read search performance for the properties selected: clicks, impressions, click-through rate and average position, as period totals and broken down by search query and by page. We also read the list of properties the account can see, for the same matching purpose. We never submit sitemaps, request indexing, or change anything in Search Console.
Google Business Profile (business.manage). We read the business accounts the connected user can access, the locations within them, each location's details, its reviews and its posts. When someone takes an action in Arti that calls for it, we also write: updating a location's name, phone number, website URL and regular opening hours; creating posts; and publishing, editing or deleting a reply to a review. Google does not publish a read-only permission for Business Profile data, so this single permission is the narrowest one that allows reading reviews and listing details at all.

We do not request access to Gmail, Google Drive, Google Ads, Calendar, Contacts or any other Google service. Staff sign-in uses Google only to confirm an email address and name; it reads nothing else.

How we use it

Google user data is used only to provide features visible in Arti: performance reporting and dashboards, SEO and content analysis, review monitoring and replies, and keeping a Business Profile listing accurate. It is used for the location it was connected for, and for nothing else.

Artificial intelligence

Several Arti features send Google data to a third-party AI provider (Anthropic) to produce written analysis. Being specific, because a general statement here would not tell you much:

Review replies and review summaries send the review text, the star rating and the reviewer's display name as Google publishes it, so a reply can be drafted in the business's voice.
Report analysis sends Analytics figures (including the top cities and landing pages) and Search Console figures (including the top search queries), so the report can be explained in words.
Scheduled report narratives send the content of each report section, which can include audience demographics where the Analytics property reports them.
The in-app assistant sends the Analytics and Search Console figures it is asked about, including top search queries.
Where a feature uses web search to check a fact, the business's city and state are sent so the results are local to it.

In each case the data is sent only to generate that output, and under terms that prohibit the provider from using it to train their models. No data read from your Google accounts is sent to any other AI provider — the research feature uses Google Gemini and the AI-visibility tests reach several AI services through DataForSEO, but neither receives anything read from a connected Google account.

We do not use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models, whether ours or anyone else's.

What we never do

We never sell Google user data.
We never use it for advertising, ad targeting, or to build advertising profiles.
We never transfer it to data brokers, information resellers, or any party for their own purposes.
We never let a person read it, except where the account holder has given permission, for security purposes such as investigating abuse, where the law requires it, or where one of our own team works inside a client's view of the app in order to support them — which is recorded against the real person who did it.

How it is held, and how to remove it

The access and refresh tokens Google issues are held on our servers and are never sent to a browser or exposed to any device. Data retrieved from Google is stored in our database, described in section 5, and travels only over encrypted connections. Inside Arti, access is governed by role: a client account can only see data for its own locations.

Removing a Google account in Arti revokes our access at Google and deletes the stored credentials. Disconnecting a single location from a service is a narrower action: it clears the credentials held for that location, but does not by itself withdraw the permission at Google. You can always withdraw it yourself, for either case, at myaccount.google.com/permissions, and we would rather say so than imply that only we can.

Figures already retrieved are kept while the account is open, because reporting is historical and deleting them would erase past reports; cached copies expire within 72 hours either way. To have retrieved data deleted, email info@resultsrepeat.com and we will do so within 30 days.

Limited Use

Arti's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Other accounts we connect

Arti connects to services other than Google, each only when we connect it and each only for the feature it serves:

BrightLocal — directory listings. Receives a location's business name, address, phone number, website, category, opening hours and description.
Facebook and Instagram, LinkedIn, YouTube — social publishing. Receive the post text and any images or video published, and replies to comments. Connecting LinkedIn also tells us the connecting person's name.
WordPress — where a client's site runs on WordPress and they have given us an application password, we publish posts and images to it.
Respage — for property clients, a read-only availability and floor-plan feed. We send only an identifier; no personal data goes to it.
Google Calendar — where a booking calendar is connected, to read availability and create appointments.
Slack — where our team uses Slack notifications, we send a team member's email address to find their Slack account, and then the notification itself.

Where one of these holds credentials, they are stored on our servers in the same way as Google's and are never exposed to a browser. Disconnecting a service in Arti deletes its stored credentials.

5. Who else processes it

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We don't rent, trade or transfer it for anyone else's marketing.

The third parties involved in running Arti are:

Convex, which hosts our database and backend;
Anthropic, for the AI features described in section 3;
Amazon S3, which stores the images used on client websites. This storage is public to anyone with the file's address, as website images must be, and the addresses contain the client and location names — so do not put anything confidential in it;
GitHub, which holds the source of the client websites we build. Each saved change is recorded with the name and email address of the person who made it;
the hosting providers that serve the client websites we build — Cloudways for current sites, Netlify for older ones — and the deployment service that moves a published site onto them, which receives the address of the code repository and the site's domain name but none of the site's content and no personal data;
Mailgun, which delivers sign-in codes, our own notification emails, and the notification a client receives when someone submits a form on their site — that one contains the submitted details;
Slack, where our team receives notifications;
Google Gemini, used for one feature only: researching a location and its industry. It receives the business name, address and industry. No data read from your Google accounts is sent to Gemini;
DataForSEO, for keyword and search-result data and for the AI-visibility tests. It receives keywords, prompt text and a domain, and relays the prompt text to ChatGPT, Claude, Gemini and Perplexity on our behalf. No personal data and no data read from your Google accounts is sent to it;
Cloudflare Turnstile, which checks that a form or chat submission is not automated;
OpenStreetMap and community-run services built on it, which receive a property's address and coordinates to build neighbourhood maps, and Google Maps Places, which receives a competitor's business name and a city;
the services named in sections 3 and 4, which we connect at our own direction.

We may also disclose information if the law requires it, to respond to a valid legal request, or to protect our rights, safety or property — and if our business is ever sold or merged, information may transfer as part of that, subject to this policy.

6. This website

getarti.com itself is a static site. It has no sign-up form, no contact form, no waitlist and no accounts, so there is nothing on it through which we could collect your name, email address or company — and we don't.

Our host records standard request logs when a page is served: your IP address, the time, the page requested and the response code, your browser and operating system, and the referring page if your browser sent one. We use these only to keep the site running, understand rough traffic volume, and investigate errors or abuse. We don't build a profile from them and we don't try to identify you.

The site loads its typefaces from Google Fonts, so Google receives your IP address and user-agent and handles that under Google's privacy policy. We receive nothing in return, and Google Fonts sets no cookies for this purpose. Blocking fonts.googleapis.com and fonts.gstatic.com leaves the site fully readable in a system typeface.

The Arti app itself sets no cookies either. It keeps your sign-in token in your browser's local storage so you stay signed in, along with small preferences such as your theme and which navigation groups are open; signing out clears the token. It loads no analytics, advertising or session-recording code of any kind.

This site can use Google Analytics to count visits and see which pages are read — but only if you say yes. On your first visit a banner asks. Until you choose, no analytics code loads and no analytics cookie is set. Decline and none ever loads.

If you accept, Google Analytics sets cookies to recognise a returning visit and sends Google your IP address, the pages you view and general information about your device and browser, which Google processes under its own privacy policy. We use it only to understand how the site is being read. We have not enabled advertising or remarketing features, we do not use it for advertising, and we do not combine it with anything else we hold.

Your answer is remembered in your browser's local storage, under the name modo-consent, so you are not asked again. That one item is stored whichever way you answer — it is how we know not to ask, and it is not used to identify or track you. To change your mind, clear this site's stored data in your browser and the banner will ask again. You can also block googletagmanager.com, use any tracker-blocking extension, or install Google's opt-out add-on; nothing on the site stops working if you do.

Beyond Google Analytics there is no advertising pixel, session recording or chat widget on this site, and we do not track you across other sites. Because we don't, there is nothing for a “Do Not Track” or Global Privacy Control signal to switch off — but we honor those signals if we ever add anything that would need them.

If you're in the UK, EU or somewhere with similar law: we process server-log data and make the font request on the basis of our legitimate interest in operating and securing our own website (Article 6(1)(f) UK/EU GDPR). Analytics cookies are a different matter: they are not essential to the site working, so we set them only with your consent, asked before anything analytics-related loads and recorded either way (Article 6(1)(a)). Declining costs you nothing on this site.

7. Where it is held

Our hosting is in the United States, and the providers named in section 5 may process data in other countries. Where data leaves the UK or EEA, transfers rely on the providers' standard contractual clauses or an equivalent approved mechanism.

8. How long it is kept

Data in Arti is kept while the client relationship is open, because the platform's purpose is to be the record of that work. Deleting a client, a location or a connection in Arti removes it from the app at once, and backups may hold a copy for a short period before rotating out.

Deleting a location or a client in Arti is immediate and removes the records that hang off it — its pages, research, reports, media records, enquiries, chat conversations, bookings and visitor counts among them.

Some things are removed automatically on a schedule:

cached copies of data fetched from Google and other reporting sources, after 72 hours;
chat conversations, after 365 days;
visitor records, after 180 days of no activity — except those marked as having become an enquiry, which are kept;
records of notification and webhook deliveries, after 30 and 90 days;
generated reports, after around 400 days, keeping the most recent for each template.

Other records have no automatic expiry and are kept until deleted: form submissions, enquiries, bookings, and our internal log of who changed what. If you want any of them removed, ask us and we will do it.

Server logs for this website are retained by our host under its own retention schedule and we keep no separate copy of them.

9. Keeping it safe

Reaching Arti requires an account, and what each person can see is governed by their role; there is no public sign-up. Credentials for connected services stay server-side and are never returned to a browser — verified in the code rather than assumed. Everything travels over HTTPS.

To be precise rather than reassuring about one point: the access tokens for connected services are stored as ordinary fields in our database, protected by our database provider's own encryption of its storage and by the access controls above. Arti does not apply a second layer of its own encryption to them. They are never returned to a browser, never written into the client websites we publish, and never included in anything we send to a third party.

No method of transmission or storage is perfectly secure, and we can't guarantee absolute security.

10. Your rights

Depending on where you live, you may have the right to know what personal information we hold about you and to get a copy; to have inaccurate information corrected; to have information deleted; to object to or restrict our processing; to receive your information in a portable format; to opt out of the sale or sharing of personal information — we do neither; and not to be treated differently for exercising any of these rights.

Email info@resultsrepeat.com. We'll respond within the time the applicable law allows — 45 days under the CCPA/CPRA, one month under the UK and EU GDPR. We may need information from you to verify the request, and you can use an authorised agent where the law provides for one.

If you are a customer of one of our clients and your details reached Arti through that client's website, enquiry form or Google listing, we hold them on that client's behalf. Tell us and we will act on it, and raise it with the client where that is the right route, rather than leaving you without an answer.

Our only record of a visit to this website is a server log tied to an IP address, which we usually cannot connect to a specific person. Where we can't identify you in our records, we'll tell you so rather than guess.

If you're in the UK or EEA and you're unhappy with how we've handled your data, you can complain to your data protection authority — in the UK, the Information Commissioner's Office at ico.org.uk.

11. Children

Arti and this site are for people running marketing for businesses, not for children. We don't knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we'll delete it.

12. Changes to this policy

We'll update this page before a change goes live, and the “last updated” date at the top will move. If a change materially affects how we handle your information — in particular, if the Google permissions Arti requests ever change — we'll say so plainly at the top of this page.

13. Contact

info@resultsrepeat.com · 24 Veterans Square, Media, PA 19063