Arrow Static by design
- Static site on Vercel's global edge — no server, no database of visitor data
- No accounts, no passwords stored — the site holds no user credentials
- Free GEO scan runs in your browser; results stay on your device
Trust Center
Security & privacy, in plain language
How this site is built, what data it touches, and the choices we make to keep both minimal. Consent first. Static by design. No data sold, ever.
Security posture
Small attack surface, strict headers
Hardened delivery
- TLS everywhere with HSTS preload; HTTP permanently redirected
- Content-Security-Policy, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy
- CAA records restrict which authorities may issue our certificates
Domain protection
- SPF and DMARC published for arrow-ai.us
- Mail hosted on Google Workspace
- Report abuse or spoofing via the contact form
Privacy & GDPR
Consent-first, data-minimal
Analytics only if you accept
- Cookie banner with a real Reject button — equal weight to Accept
- Google Analytics loads only after explicit consent
- Essential features work with zero analytics
We collect what you send us
- Booking a call shares your name/email with Cal.com to schedule it
- Contact and audit requests go to our CRM to answer you — nothing more
- No advertising pixels, no data resale, no profiling
Access, correction, deletion
- Request access or deletion via the contact form
- Requests honored within 30 days
- Details in the privacy policy and data processing pages
Subprocessors
Who touches data, and why
| Service | Purpose | Data involved |
|---|---|---|
| Vercel | Hosting and edge delivery, anonymous performance insights | Standard server logs |
| Cal.com | Call scheduling | Name, email, chosen slot — only when you book |
| Google Analytics | Aggregate usage statistics | Only after explicit consent |
| HubSpot | CRM for contact and audit requests | What you submit in forms |
| Google Workspace | Email correspondence |
Questions?
Security or privacy question we didn't answer?
Client engagements come with the same discipline: approved sources, human review, audit trails, and least-privilege access.
Company · Terms · Privacy · Cookies · Data processing · Legal notice