Privacy Policy

1. Who is responsible

We are the controller for the processing described on this page. We are not required to appoint a data protection officer. Questions about this policy go to the email address above.

2. The short version

• arcos.cloud sets no cookies of its own and runs no analytics, advertising or tracking scripts. The one exception is our ads landing page, arcos.cloud/video: there Meta's pixel runs only if you tap OK (section 6).
• Fonts, images and scripts are served from our own domain. Opening a page sends no request to Google, Meta or any other third party, unless you tap OK on arcos.cloud/video.
• When you use the booking form, your answers go to our form service, and the calendar is then loaded from HighLevel.
• Our hosting provider keeps short-lived server logs, which is technically necessary to deliver the page and to defend against abuse.
• If you email us, fill in the booking form or book a call, we process what you send us in order to reply and, if you become a client, to work with you.
• If you call the number on this website, our telephone provider passes us the call and the number it came from, so that we can answer or return it.
• We do not sell personal data. We share it with Meta to measure our ads only if you tap OK on arcos.cloud/video, and you can take that back at any time.

3. Hosting and server logs

arcos.cloud is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered through Vercel's content delivery network, including servers in the European Union. When you open a page, your browser transmits data that the server needs to answer the request and that is written to a server log: your IP address, the date and time, the page requested, the referring page, the browser and operating system you use, and the transferred data volume.

Purpose and legal basis: delivering the website, keeping it stable and secure, and detecting abuse. The legal basis is our legitimate interest in operating a secure and reliable website (Article 6 (1) (f) GDPR).

Retention: Vercel keeps request logs for a limited period and deletes them afterwards. We do not download them, keep our own copy, or analyze log data to build profiles of visitors. If you want the current retention period in writing, ask us and we will get it from Vercel.

Processor: Vercel processes this data on our behalf under a data processing agreement that includes the European Commission's standard contractual clauses. See section 8 on international transfers.

4. When you email us

When you write to arno@arcos.cloud, we process your email address, your name if you give it, and the content of your message so that we can answer you. Email for arcos.cloud is delivered through Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

Legal basis: Article 6 (1) (b) GDPR where your message concerns a contract or a request to enter into one, otherwise our legitimate interest in answering inquiries from businesses (Article 6 (1) (f) GDPR).

Retention: we keep correspondence for as long as the conversation is open and, where it leads to a client relationship, for the duration of that relationship plus the retention periods German commercial and tax law require for business correspondence (six or ten years). If an inquiry does not lead anywhere, you can ask us at any time to delete it.

5. The booking form, the calendar and calls

The "See if it fits your business" buttons on this website open a short form on arcos.cloud itself. Nothing is sent until you press "See the next step" on its last step. The form then sends:

• your answers: your trade, roughly how many jobs a month you do, whether you can log into a Google Business Profile, what you already have running, roughly what the business turns over a month, and the one thing you would want fixed first if you write one;
• your name, your business name if you give it, your cell number and your email address;
• where the inquiry came from: the page and the button you used, the campaign parameters in the link you arrived by (utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, gbraid, wbraid, msclkid, fbclid), the page that referred you, the page you first landed on, when you arrived, when you sent the form and how long it took;
• what every request carries: your IP address and the browser you use.

These details are kept in the open page only while you use it. The form writes nothing to your device: no cookie, no local storage.

Where it goes: the form posts to our own form service, a function we operate at arcos-lp.vercel.app, hosted by Vercel Inc. (section 3). The service stores the inquiry in private Vercel Blob storage. Vercel's function logs keep a short record of each request as well. Vercel acts as our processor.

The calendar: once you send the form, and only if our call is likely to be worth your time, the page shows HighLevel's booking calendar in a frame loaded from leadconnectorhq.com. Its address carries your first and last name, email address, cell number, time zone and the campaign parameters above, so that the calendar is filled in for you. From that moment your browser talks to HighLevel directly, and HighLevel receives your IP address and browser details. If you book, the calendar collects the time slot and anything you add, and passes the booking to us so that we can hold the call. For the booking, HighLevel LLC, a company established in the United States, acts as our processor. HighLevel's own privacy notice covers its platform: gohighlevel.com/privacy-policy. The call itself is held on Google Meet under our Google Workspace account.

Legal basis: Article 6 (1) (b) GDPR, because the inquiry and the call are steps towards a contract you have asked for. For the questions about your business and the record of where the inquiry came from, also our legitimate interest in knowing whether the call is worth your time and which pages bring inquiries (Article 6 (1) (f) GDPR).

Retention: inquiry and booking data are kept for as long as the conversation is open and, where it leads to a client relationship, as long as section 4 describes for correspondence. You can ask us at any time to delete an inquiry, and we will delete it from the form storage and from HighLevel.

If you telephone us instead: the number shown on this website is a business line provided to us through the same platform, by LeadConnector LLC, an affiliate of HighLevel LLC established in the United States. Dialing it means that provider connects the call and processes the number you called from, the number you dialed, and the time and length of the call, so that we can answer it or call you back. If you leave a message, the message itself and any transcript or notification the provider makes of it are processed for the same purpose. We do not run any campaign, advertising or profiling on numbers that call us.

Legal basis: Article 6 (1) (b) GDPR where your call concerns a contract or a request to enter into one, otherwise our legitimate interest in being reachable and in answering inquiries from businesses (Article 6 (1) (f) GDPR).

Retention: call records and any message are kept for as long as the conversation is open and are then treated like email correspondence under section 4.

Texts and calls about your inquiry

By sending the booking form you agree that Arcos may contact you about your inquiry by phone, email and text, including automated texts and calls with an AI-generated voice that says it is automated. We only contact you about the inquiry you made. How many messages you get varies with the conversation. Message and data rates may apply. Reply STOP to any text to stop them, or HELP for help; you can also email arno@arcos.cloud or call (469) 638-8130. The texts and calls are sent through HighLevel and LeadConnector as described above.

We do not share your mobile number or SMS consent with third parties or affiliates for their marketing.

6. Cookies, fonts and tracking

arcos.cloud sets no cookies of its own. Apart from Meta's pixel on arcos.cloud/video, which only runs after you tap OK (described below), it uses no analytics, advertising pixels, session recording or fingerprinting. Fonts (Archivo and Inter) are served from our own domain, so no request is made to a font provider. The brand marks of Google and Meta on the page are static images stored on our domain. On every other page nothing beyond what is technically necessary is stored on your device, so no consent banner is needed there and none is shown.

Apart from that pixel, the one piece of third-party content is the booking calendar in section 5. It is loaded only after you send the booking form, because you asked for it. It is HighLevel's page, and inside its frame HighLevel may use the cookies and similar storage its page needs to run, for example a security cookie from its network provider, Cloudflare. When we checked on September 26, 2026, the calendar page also loaded fonts and files from Google (fonts.googleapis.com, storage.googleapis.com) and Meta Platforms' tracking script (connect.facebook.net) inside its frame. Those requests and cookies come from HighLevel's page on leadconnectorhq.com, not from arcos.cloud, and they only happen once the calendar opens.

If we ever add analytics or other embedded third-party content, this policy will be updated first and, where the law requires it, you will be asked for consent before anything is loaded.

Meta's pixel on arcos.cloud/video

arcos.cloud/video is the page our Facebook and Instagram ads link to. When you open it, a bar asks whether we may use Meta's pixel. Until you tap OK, nothing is loaded from Meta and nothing is sent to Meta. If you tap "No" or ignore the bar, the page works the same.

What happens if you tap OK: your browser loads the pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). The pixel sets two cookies on arcos.cloud: _fbp and, if you arrived from one of our ads, _fbc, each kept for up to 90 days. It tells Meta that you opened the page, how far you watched the video, when you start and send the questions, and whether you booked a call. With the sent questions it passes on your trade, roughly how many jobs you do a month, and whether your answers fit our offer. It also reads your name, email address and cell number from the form and passes them to Meta in hashed form, a one-way code that lets Meta recognize a matching Meta account. Our form service may send Meta the same events directly, with the same hashed details, your IP address and your browser details (Meta's Conversions API). Your turnover band, what you already have running and the one thing you would want fixed are not sent to Meta.

Purpose: to measure which of our ads lead to inquiries and booked calls, and to let Meta show our ads to businesses that are more likely to be interested. For collecting the data on this page and passing it to Meta, we and Meta are joint controllers (Article 26 GDPR) under Meta's Controller Addendum (facebook.com/legal/controller_addendum). What Meta does with the data once it has received it is Meta's own responsibility, described in its privacy policy (facebook.com/privacy/policy), where you can also exercise your rights against Meta. Meta may process the data in the United States; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

Legal basis, and how to take it back: your consent (Article 6 (1) (a) GDPR and section 25 (1) of the German Telecommunications Digital Services Data Protection Act, TDDDG). You can withdraw it at any time with the "Ad tracking" link at the bottom of arcos.cloud/video, which also deletes the two cookies. Withdrawing does not affect what was sent before. Your browser's local storage keeps your choice (arcos_px), which is necessary to remember it.

Your device on that page: whatever you choose, arcos.cloud/video keeps a copy of the form you sent and a note of which parts of the video you have seen in your browser's local storage, so that a reload does not lose them. Neither leaves your device.

7. Data we process for clients

For our clients, Arcos builds and runs websites, Google Business Profiles, advertising, automated follow-up and review requests. In that work we process personal data of our clients' customers (names, telephone numbers, email addresses, message content) on our clients' instructions. For that data the client is the controller and Arcos is the processor under Article 28 GDPR. The terms of that processing are set out in section 13 of our Terms of Service; a separate data processing agreement is available on request. If you are a customer of one of our clients and have a question about your data, please contact that business directly, or write to us and we will forward your request.

8. Transfers outside the European Union

Our hosting provider and form service (Vercel, including Vercel Blob storage) and our customer relationship, booking, text message and telephone provider (HighLevel LLC and LeadConnector LLC) are established in the United States, and our clients are US businesses. If you tap OK on arcos.cloud/video, Meta may also process data in the United States (section 6). Where personal data leaves the European Union, we rely on the safeguards of Chapter V GDPR: data processing agreements that include the European Commission's standard contractual clauses (Article 46 (2) (c) GDPR) and, for providers that are certified, the EU-US Data Privacy Framework (Article 45 GDPR), under which HighLevel LLC, LeadConnector LLC and Meta Platforms, Inc. state that they comply. Copies of the relevant clauses can be requested at the email address above.

9. Your rights

Under the GDPR you have the right to access the personal data we hold about you (Article 15), to have it corrected (Article 16) or erased (Article 17), to restrict its processing (Article 18), to receive it in a portable format (Article 20) and to object to processing based on legitimate interests (Article 21). Where processing is based on consent, you may withdraw that consent at any time with effect for the future. To exercise any of these rights, email arno@arcos.cloud.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, ldi.nrw.de. You may also complain to the authority where you live or work.

We do not use automated decision-making or profiling within the meaning of Article 22 GDPR. Providing personal data to us is voluntary; without an email address we cannot answer you, without a name, cell number and email address the booking form cannot be sent, and without booking details we cannot hold a call. Two of the answers, jobs a month and turnover, decide whether the form shows the calendar or our three free suggestions. That has no legal or similarly significant effect on you, and you can always call or email us instead.

10. Visitors in the United States

Most of our clients and visitors are in the United States. Arcos is a small business established in Germany. It does not meet the thresholds of the California Consumer Privacy Act or of comparable state privacy laws (for example annual revenue above $26,625,000, the figure since January 1, 2025, or buying, selling or sharing the personal information of 100,000 or more California consumers or households), so those laws do not apply to it. Regardless of that, we apply the same standard to everyone: we do not sell personal information, we do not show advertising on this website, we pass information to Meta only from arcos.cloud/video and only after you tap OK there (section 6), and any visitor may ask us what we hold about them, ask us to correct or delete it, or object to its use, by emailing arno@arcos.cloud. We will respond within 30 days.

Where Arcos sends text messages on behalf of a client to that client's customers in the United States, those messages are sent in the client's name and under the client's consent obligations, as described in section 10 of our Terms of Service. Recipients can opt out at any time by replying STOP.

11. Changes to this policy

We will update this page when the website or our processing changes. The date at the top shows the current version. Earlier versions are available on request.