Privacy Policy
This policy explains what ArkSlate collects, why, who else sees it, how long we keep it, and what you can require of us. It covers two different relationships, and the difference matters — so it is the first thing below.
Last updated September 14, 2026. Effective immediately for new accounts.
1. Who we are
ArkSlate is operated by ArkSlate, LLC, an Oklahoma limited liability company ("ArkSlate", "we", "us"). It was previously operated by Frontier Consulting Group LLC; the change is one of company name, not of what we hold, why we hold it, or who else sees it. You can reach our privacy contact at privacy@arkslate.com.
2. Two relationships, two roles
When you sign up for ArkSlate — you, the business owner or member of staff — we decide how your account information is handled. For that data we are the controller, and this policy is the whole story.
When a business uses ArkSlate to run its operation, everything it puts in about its own customers, staff and suppliers belongs to that business. We process it on their instructions, as their service provider. We do not decide what that business collects, we do not use it for our own purposes, and we do not sell it. If you are a customer of a business that uses ArkSlate and you want your record changed or deleted, ask that business — they control it. If you cannot reach them, write to us and we will help you find the right contact.
3. What we collect
Account and billing information
Your name, email address, password (stored only as a salted hash), business name, business address, industry, phone number, the plan you are on, and your billing history. Card details are collected and stored by Stripe, not by us.
Business data you enter
Everything you record in the product: sales and refunds, products and stock, customers and their contact details, appointments and jobs, staff and their hours, suppliers, invoices, documents you upload, notes you write, photographs you attach to a job, and — in the insurance vertical — policies, claims and the records attached to them.
Regulated records
In medical settings, whatever the practice chooses to record. See section 9 for an important limitation on health information.
Usage and device information
Pages viewed, features used, approximate location derived from IP address, browser and device type, and timestamps. Errors are captured with the technical context needed to fix them. If a member of staff uses the dispatch map, their device reports its location while they are on shift, so their employer can see where the job is.
The mobile apps
The ArkSlate apps for iOS and Android are staff tools: they are signed in to a business you already work for, and they hold no personal account of their own. Three things they ask the device for, and nothing else:
- The camera, only when someone attaches a photo to a job or a service call. Photos are uploaded to that business's account. Nothing is read from your photo library unless you pick it.
- Location, only on Android and only when a card sale is started with a Stripe card reader. Stripe requires it to discover a reader and to attribute the payment to the right terminal location. ArkSlate does not store it, and it is not used to track anyone. If a business uses the dispatch map, that is a separate feature and is described above.
- Face ID, Touch ID or the Android biometric prompt, if the business turns on the device lock. The biometric never leaves the device and we never see it — the operating system only tells the app whether it matched.
The apps carry no advertising, no third-party analytics and no crash-reporting SDK. They do not build an advertising profile and there is nothing in them that follows you between apps.
Communications
Messages you send us, support requests, and — where a business has connected a messaging provider — the messages that business sends and receives through ArkSlate.
4. Why we use it
- To provide the product, which is most of it.
- To take payment for the subscription, and to move money on your behalf via Stripe.
- To send transactional messages: receipts, invoices, reminders, password resets.
- To keep the platform secure, prevent fraud and abuse, and investigate when something goes wrong.
- To generate the AI features you use — daily snapshots, insights, fraud signals — which means sending the relevant business data to our AI provider at the moment you ask for them.
- To understand which features are used, so we build the right things next.
- To meet legal, tax and regulatory obligations.
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use the data our customers put into ArkSlate to train AI models. We do not train models on your data, and our providers' API terms do not either.
5. Who else sees it
We use a small number of subprocessors to run the service. Each receives only what it needs, and each is bound by contract to protect it.
| Provider | What it does | Where |
|---|---|---|
| Supabase (on AWS) | Database, authentication, file storage | United States |
| Vercel | Application hosting and delivery | United States |
| Stripe | Card payments, terminals, payouts, subscription billing | United States |
| Resend | Transactional email delivery | United States |
| Groq | AI inference for insights and snapshots | United States |
| OpenRouter | Backup AI inference when the primary provider is unavailable | United States |
| ImprovMX | Forwarding email sent to our own addresses | United States |
| Trello (Atlassian) | Internal issue tracking, where a support case may quote your details | United States |
| PostHog | Product analytics and error monitoring | United States |
Only if a business turns them on: messaging providers (Telnyx, RingCentral, Quo) for SMS and voice; Intuit for QuickBooks accounting sync; Google for review collection. A business that does not connect these sends them nothing.
We also disclose information when the law requires it — a valid subpoena, court order or lawful request — and in connection with a merger, acquisition or sale of assets, in which case we will say so before your information becomes subject to a different policy. Where we are permitted to, we will tell a customer about a legal demand for their data before we respond to it.
6. Data isolation
ArkSlate is multi-tenant: many businesses share one platform. Every tenant-scoped record carries the business it belongs to, and the database itself refuses to return rows belonging to anyone else, independently of the application. Our security page explains how that is enforced.
7. How long we keep it
| What | Kept for |
|---|---|
| Business data in an active account | As long as the account is open |
| Business data after cancellation | 30 days, then deleted — export before then |
| Financial and tax records | Seven years, as required by law |
| Audit logs | Two years |
| Error reports and analytics | Up to 12 months |
| Backups | Rolling, and overwritten in the ordinary course |
Deleting something in the product removes it from the product immediately; it leaves backups as those backups age out.
8. Your rights
Wherever you live, you can ask us to:
- tell you what personal information we hold about you and why;
- correct it if it is wrong;
- delete it, subject to records we are legally required to keep;
- give you a copy in a portable format;
- stop using it for a particular purpose;
- stop sending you marketing, which you can also do from any marketing email.
Email privacy@arkslate.com. We will verify that the request comes from you — usually by replying to the address on the account — and respond within 30 days, or tell you why we need longer. Exercising these rights costs nothing and we will not treat you differently for it.
California. We do not sell or share personal information as those terms are defined by the CCPA, and we have not in the preceding twelve months. We collect the categories described in section 3 for the purposes in section 4.
Europe and the United Kingdom. Where the GDPR applies, our lawful bases are performance of a contract (running the service you signed up for), legitimate interests (securing the platform, understanding how it is used), consent (where we ask for it), and legal obligation (tax and regulatory records). Data is processed in the United States; where a transfer mechanism is required, we rely on the European Commission's Standard Contractual Clauses.
To ask for your account and personal data to be deleted, see deleting your account, which sets out what is removed, what we are required to keep, and how long it takes.
9. Health information
ArkSlate includes tooling intended for medical settings, but we are not a HIPAA business associate and we do not currently sign Business Associate Agreements. If you are a covered entity, do not place protected health information in ArkSlate on the assumption that it is covered by one, because it is not. If that changes, this page will say so.
10. Cookies
We use cookies that are strictly necessary — the ones that keep you signed in, remember your tenant, and protect against cross-site request forgery — and analytics cookies that tell us which features are used. We do not use advertising cookies and we do not allow third-party ad networks on the product. Blocking strictly necessary cookies will stop you being able to sign in.
11. Security
Encryption in transit and at rest, database-enforced tenant isolation, role-based access control, and audit logging. The detail — including what we have not done — is on our security page. If we discover a breach affecting your personal information, we will notify you and any regulator that must be told, without undue delay.
12. Children
ArkSlate is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child's information has reached us, write to privacy@arkslate.com and we will delete it.
13. Changes to this policy
When we change this policy we will update the date at the top, and for changes that meaningfully affect your rights we will email account owners at least 14 days before they take effect. Continuing to use ArkSlate after that means the new version applies.
14. Contact
ArkSlate, LLC — Oklahoma, United States.
3156 Old Broken Bow Hwy, Broken Bow, OK 74728
Privacy: privacy@arkslate.com
Security: security@arkslate.com
Everything else: support@arkslate.com