Privacy Policy
Last updated: October 20, 2026
This policy applies to the Arsenal Connect web application at arsenalconnects.com, operated by Arsenal Marketing and Sales Collective.
This policy explains how Arsenal Connect handles information about you, what we collect, why we collect it, who sees it, and the choices you have.
1. Who we are
Arsenal Connect is a platform for affiliate tracking and creator partnerships in the firearms, hunting, tactical and outdoor industry. It is developed and operated by Arsenal Marketing and Sales Collective ("Arsenal Connect", "we", "us"). This policy explains what information we collect, how we use it, and the choices you have.
2. Information we collect
Account information: your name, email address, password, company or brand name, and account type (brand, retailer, or creator).
Profile information: what you choose to add to your profile, including photos, bio, media kit details, rate card details, audience and engagement statistics, specializations, social links, location (if you choose to make it visible), and availability status.
Campaign and work information: campaigns you post or apply to, proposals, contracts, deliverables, posts you log, and messages you send through the platform.
Tracking and performance data: clicks on tracking links, uses of discount codes, and order or revenue data reported by connected shops or integrations, attributed to creators and campaigns.
Payment information: we use Stripe to process subscriptions, commissions, stipends and payouts. We do not store your full card or bank details on our servers; Stripe handles them under its own privacy policy.
Agreement and records: the Platform Usage Agreement you sign, the version and text you signed, and related records such as reports submitted through the platform.
Technical information: standard logs such as IP address, browser type, and pages visited, used to keep the platform secure and working.
3. How we use information
We use the information we collect to operate the platform: to create and maintain your account, show your profile to other users, run campaigns and applications, attribute clicks, codes and sales, calculate commissions and stipends, process payments, provide support, send you service and billing messages, and protect the integrity of the community.
We do not sell your personal information.
4. How information is shared
Other users see what you choose to share. Public profile information, campaigns, applications, posts, and messages are visible to the brands, retailers and creators they are addressed to. Your location is private by default and only becomes visible if you turn it on. Media kits and rate cards are visible to Pro plans and to Arsenal Connect staff.
Service providers: we rely on companies such as Stripe (payments), our hosting and email providers, and map and analytics services to run the platform. They process information on our behalf.
Legal reasons: we may disclose information if required by law, or to investigate reports, enforce our agreements, or protect the rights and safety of users and the public.
5. Google user data
Data Accessed
When you choose to connect Google Calendar, Arsenal Connect requests two Google permissions: (1) userinfo.email, your Google account email address; and (2) calendar.events, permission to view and edit events on your Google calendars.
Arsenal Connect does not offer "Sign in with Google", you sign in with your email and password, and we do not access your Google name, profile photo or contacts. Arsenal Connect does not read, scan or change your existing calendar events, meeting invitations or availability. It only works with the events it created for you.
Data Usage
userinfo.email is used only to show which Google account is connected. calendar.events is used only to create, update and delete the content and reminder events you schedule in the Arsenal Connect Content Planner, on your primary Google calendar.
Google user data is used only to provide the Content Planner calendar sync you turn on. No person at Arsenal Connect reads your Google data unless you ask us to (for support), it is needed for security, or the law requires it.
Sharing, transfer, and disclosure of Google user data
Service providers involved in calendar sync. When you connect Google Calendar, we transfer and process information only as needed to provide the Content Planner calendar sync you authorize, subject to the limited disclosures below. The verified providers involved are:
Google: Google processes your Google account identity and OAuth authorization and receives the requests needed to create, update, or delete Arsenal Connect’s events on your primary Google calendar. Event requests include titles, descriptions and notes you choose to sync, scheduled dates and times, time zones where applicable, and event identifiers. Google returns calendar identification information and event details, including event identifiers and links, so the connection can be labeled and your synced events can be managed.
Lovable, including its connector gateway: Lovable’s connector gateway handles the Google OAuth connection, including Google access and refresh tokens, and forwards Calendar requests and responses between Arsenal Connect and Google. It therefore processes Google authorization information and the Calendar information passing through those requests and responses, including account/calendar identifiers that may contain your Google email address, event titles and descriptions, dates and times, time zones, event identifiers, and event links. Its purpose is to authenticate the connection and carry out the calendar sync you authorize. Arsenal Connect receives a separate gateway connection key, not your raw Google access or refresh tokens.
Lovable Cloud and Lovable-managed application hosting: These services run Arsenal Connect’s servers and database. They process calendar-sync requests and responses and store the connected account/calendar label, which may contain your Google email address, the encrypted gateway connection key, sync records, and identifiers of events created through Arsenal Connect. Operational logs may also contain event identifiers, event links, and portions of Google error responses. Their purpose is to operate, maintain, troubleshoot, and secure the calendar connection, not to advertise to you or analyze your calendar for unrelated purposes.
No advertising or unrelated sharing. We do not sell Google user data or transfer it to advertisers, advertising networks, data brokers, or unrelated third parties. We do not send it to product or marketing analytics providers for tracking, profiling, or advertising, or use it to train artificial intelligence or machine-learning models. Necessary operational logging and monitoring are limited to running, troubleshooting, and securing the service. Arsenal Connect does not make your Google connection information or Calendar responses available to other brands, creators, retailers, or ordinary users. Visibility of events inside Google Calendar remains subject to the sharing settings you control in Google.
Limited additional disclosure and access. We may disclose the minimum Google user data necessary with your specific authorization for a clearly identified purpose; to investigate abuse or security incidents and protect the service as permitted by Google’s policy; or to comply with applicable law, a binding legal obligation, or valid legal process. Human access is limited to your affirmative agreement for specific data, such as support; necessary security or abuse investigations; or legal requirements, as permitted by Google’s Limited Use requirements. Connecting Calendar does not authorize unrelated sharing.
Google policy commitment. Arsenal Connect’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Transfers to service providers are limited to what is necessary to provide or improve the user-facing calendar-sync features you authorize, or to the limited security and legal circumstances permitted by that policy.
Data Storage & Protection
We store an encrypted connection key that lets our servers reach your calendar, the connected Google account email, your chosen time zone, sync times, and the IDs of calendar events Arsenal Connect created. The connection key is encrypted at rest with AES-256-GCM, is usable only by our servers and is never sent to your browser. All Google data is sent over encrypted connections (HTTPS/TLS), and database access controls limit stored records to you and the staff who need them to operate the platform.
Data Retention & Deletion
When you disconnect Google Calendar in the Content Planner, we first pause syncing and ask Lovable's connector gateway to delete the connection and the Google tokens it stores. Once the gateway confirms the connection is deleted (or reports it no longer exists), we delete our encrypted connection key, the identifiers of events and tasks Arsenal Connect created, and the connection record. If the gateway does not confirm, we keep the encrypted key only so you can try again, nothing else is removed, and we show you an error.
Disconnecting does not delete events already in your Google Calendar; they stay there until you remove them. Because we delete the stored event identifiers, reconnecting and syncing again may create new copies of those events.
Deleting the gateway connection is not the same as revoking Arsenal Connect's authorization in your Google Account. We have not confirmed that deleting the gateway connection also revokes the authorization on Google's side, so to be sure access has ended, also revoke Arsenal Connect at myaccount.google.com/permissions.
When your Arsenal Connect account is deleted, we attempt to delete each of its gateway connections and always delete its stored encrypted connection keys, calendar connection records, and stored event identifiers. If a gateway deletion cannot be confirmed, we keep a limited support record so we can follow up: your account ID, the provider, the time, the error status, a gateway request reference if one was returned, and a short one-way fingerprint that cannot be turned back into a credential. This record never contains access tokens, refresh tokens, or connection keys. To be sure Google access has ended, revoke Arsenal Connect in your Google Account before or after deletion.
You can ask us to delete your Google data at any time by emailing privacy@arsenalconnects.com.
Revoking Access
You can disconnect Google Calendar in the Content Planner at any time, and revoke Arsenal Connect's access to your Google account at myaccount.google.com/permissions.
Limited Use Disclosure
Arsenal Connect's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Tracking links and performance data
When a creator shares a tracking link or discount code, click and order data is recorded to attribute sales to the right creator and campaign. This data may include the visitor's IP address, the link clicked, the campaign involved, and order details shared by the connected shop. Brands and creators can see the performance data relevant to their own campaigns.
7. Payments
Subscriptions, campaign payments, commission payouts and referral payouts are processed through Stripe. Stripe receives the information necessary to process each payment and to meet its own legal requirements, such as identity verification for payouts. Stripe's handling of your information is governed by Stripe's privacy policy.
8. Data retention and deletion
You can ask us to delete your account at any time. When an account is deleted, the login, profile, calendar connections, stored connection keys, and planner content are removed.
Some records that other users depend on, such as payments, campaigns, and signed documents, may be kept after an account is deleted for accounting, contractual, and legal reasons.
Our hosting and infrastructure providers keep backups and operational logs for limited periods under their own retention practices, and deleted data may remain in those copies until they expire. We have not confirmed specific retention periods for these copies, so we do not state one here.
9. Your choices
Profile visibility: you control what appears on your public profile, including whether your location is visible.
Communications: you can change notification preferences in your account settings. Service and billing messages are required for the platform to function.
Access and correction: you can review and edit most of your information directly on your profile and account pages. You can contact us to access, correct or delete information you cannot edit yourself.
10. Cookies and local storage
We use cookies and browser local storage to keep you signed in, remember your preferences such as theme, remember when you arrived through a referral or invite link, and understand how the platform is used. You can clear or block these in your browser settings, though parts of the platform may stop working.
11. Security
We protect information with encrypted connections (HTTPS/TLS), encryption at rest, per-account database access rules, server-only storage of access keys for connected services such as Google Calendar, and staff access limited to those who need it. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.
12. Age and eligibility
Arsenal Connect is for adults. You must be at least 18 years old, or the age of legal majority in your jurisdiction, to create an account. If we learn an account belongs to someone under that age, we will remove it.
13. Changes to this policy
We may update this policy as the platform changes. When we make a material change, including any change to how we access, use, store or share Google user data, we will notify you through the platform or by email before the change takes effect. The date below shows the current version.
14. Contact us
Questions about this policy or your information can be sent to us through the support page in the platform or by emailing Arsenal Marketing and Sales Collective at privacy@arsenalconnects.com.
Version 1.5, Effective October 20, 2026 · Arsenal Connect, developed by Arsenal Marketing and Sales Collective.