Privacy Policy

Who is responsible for your data

Ark Agency is run by Bonce Filip P.F.A., CUI 54376757, Oradea, Bihor County, Romania. For questions about privacy, or to use any of your rights, email support@ark-agency.app.

We handle personal data in two different roles:

• As controller for account details, billing records, messages you send us, and technical data about how the Service is used. This policy explains that processing.
• As processor for the content an agency puts into its workspace, such as client contacts, scripts, videos, comments and stored client credentials. The agency is the controller of that data and decides what goes in. Our Data Processing Agreement governs how we handle it.

If an agency invited you as one of its clients and you have a question about your data in their workspace, contact the agency first. If you write to us, we'll pass your request on.

What we collect

Account information. Your name, email address and password (stored only as a hash by our authentication provider), plus anything you add to your profile, like a photo or job title.

Workspace content. What you and your team enter while using the Service: clients, scripts, briefs, videos and other files (including files you add from Google Drive and designs you add from Canva), tasks, shoot and meeting schedules, comments, contracts and signatures, time entries, stored client credentials and notifications.

Billing information. When paid plans start: company name, billing address, VAT number and payment history. Card details go directly to our payment processor. We don't see or store full card numbers.

Technical data. IP address, browser and device type, log entries and error reports, which we need to keep the Service working and secure. If you turn on notifications, we store a push token for your device.

Messages to us. What you send when you email us for support or feedback.

Google user data (optional). If you connect Google, we access the Google data described in the next section. Connecting Google is optional. The Service works without it.

Canva data (optional). If you connect Canva, we access the Canva data described in the Canva section below. Connecting Canva is optional too.

Google user data

Ark Agency is an operations platform for video production and content agencies. It offers two optional Google integrations: Google Calendar and Google Drive. Each is connected separately, and the Service works without either.

Google Calendar

When a user connects Google Calendar, Ark Agency uses the Google Calendar API to create and update calendar events for meetings and filming days scheduled in the app, and to invite the attendees or crew assigned to them. It also reads the user's own upcoming events so their existing commitments appear alongside production schedules and shoots aren't booked over them. Calendar data is only ever read for the signed-in user's own account, is never sold or shared with third parties, and is not used for advertising. Users can disconnect at any time from Settings.

If you connect Google Calendar, we request the following OAuth scopes:

• Basic profile and email (userinfo.email, userinfo.profile), used to identify which Google account is connected to your Ark Agency profile.
• Read your calendars (calendar.readonly), used to display events from your primary Google Calendar alongside your Ark Agency schedule so nothing gets booked twice.
• Manage events (calendar.events), used to create and update events on your primary Google Calendar for shoots and meetings you schedule in Ark Agency, and to keep those events in sync when they change.

Google Drive

Google Drive lets a team member add photos and videos from their Drive to a social media post in Ark Agency. They choose the files themselves in Google's own file picker, which shows their Drive. Ark Agency can only open the files they pick. It can't see, list or change anything else in their Drive. The picked files are downloaded in the user's browser and saved to their agency's workspace as the post's media, like a file uploaded from their computer.

A team member can also link a Drive video or photo to a post's Review tab instead of uploading it. The file stays in their Drive: Ark Agency streams it from Drive to the people reviewing it (their team and their client) and, if they publish that cut, to the social network. Ark Agency stores the file's ID, name, type, size and a fingerprint used to tell when the file changed, not the file itself.

If you use Google Drive in Ark Agency, we request the following OAuth scopes:

• Files you pick (drive.file), used to download the files you choose in the Google Drive picker, so they can be added to a post, and to stream the files you link for review.
• Email address (email), used to show which Google account is connected in Settings and to skip the account chooser next time.

Adding files to a post only needs an access token kept in the open browser tab. Linking files for review needs Ark Agency to open them later, when someone reviews them, so when you connect Google Drive for that, we store the Google Drive tokens encrypted on our servers, with the connected account's email address, and use them only to open the files you picked. Your browser also remembers that email address. Disconnecting Google Drive in Settings → Integrations revokes the tokens and deletes them; files you linked then stop playing until they're linked again.

How we handle Google user data

We only use Google user data to provide the calendar and file features described above. We do not use Google user data for advertising, we do not sell it, and we do not allow humans to read it except with your explicit consent, where necessary for security purposes, to comply with applicable law, or where access is limited to aggregated, anonymized data for internal operations as permitted by Google's policies.

Google Calendar and Google Drive tokens are stored encrypted and are used solely to make the requests described above on your behalf. You can disconnect Google Calendar or Google Drive at any time from Settings → Integrations in the app, or revoke Ark Agency's access from your Google Account permissions page.

Ark Agency's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Canva data

Connecting Canva is optional. Each team member connects their own Canva account, so they can add their Canva designs to a social media post in Ark Agency. They pick a design, and Ark Agency exports it through Canva and saves it to their agency's workspace as the post's media: each page as an image, or the design as a video. Ark Agency can only read designs. It can't create, change or delete anything in Canva.

When you connect Canva, we ask for:

• design:meta:read, to list your designs and their titles and thumbnails, and to search them, so you can choose one.
• design:content:read, to export the design you choose as images or a video.
• profile:read, to show the name of the connected Canva account in Settings.

Canva access tokens are stored encrypted, are only used to make these requests, and are never shown in the app or shared with anyone. We don't use Canva data for advertising and we don't sell it. You can disconnect Canva at any time from Settings → Integrations, which withdraws Ark Agency's access in Canva and deletes the stored tokens. Designs already added to posts stay in the workspace as part of its content.

Instagram, Facebook and TikTok data

Connecting a client's Instagram professional account, Facebook Page or TikTok account is optional. An agency admin connects it so that Ark Agency can publish the posts the agency and its client have approved, at the time they were scheduled for, and show the account's follower count and the performance of its posts. Ark Agency does not read private messages, does not collect followers' personal data and does not use any of this data for advertising.

When an account is connected through Meta (Facebook Login for Business), we ask for:

• pages_show_list, pages_read_engagement, business_management, to list the Pages and linked Instagram accounts the person manages, so they can choose which ones belong to the client.
• pages_manage_posts, to publish posts, photos, videos, reels and stories on the chosen Facebook Pages.
• instagram_basic, instagram_content_publish, to show the account's name and picture in the post preview and to publish reels, posts, carousels and stories.
• instagram_manage_comments, only to add the first comment the agency wrote for a post.
• instagram_manage_insights, read_insights, to show the agency the account's follower count and each post's views, reach, likes, comments, shares and saves, so they can report to the client and plan what to post next.

When a TikTok account is connected (TikTok Login Kit and Content Posting API), we ask for:

• user.info.basic, user.info.profile, to show the account's name, username and picture in the app and the post preview.
• user.info.stats, video.list, to show the agency the account's follower count and each video's views, likes, comments and shares.
• video.publish, to publish the videos and photo posts the agency scheduled, with the privacy, interaction and disclosure settings chosen for each post.
• video.upload, to send a post to the account's TikTok drafts when the agency chooses that, so the creator can finish and post it in the TikTok app.

Access tokens are stored encrypted, are only used to make these requests, and are never shown in the app. Each post's media is shared with the platform through a link that expires after a few hours. We keep the post's ID and link on the platform so the agency can open it later.

An admin can disconnect an account at any time from the client's Channels tab in the app, which deletes its tokens. You can also remove Ark Agency from your Facebook business integrations or your TikTok app permissions. When Meta tells us access was removed, we delete the tokens automatically. To have any other data deleted, write to support@ark-agency.app.

Why we use it, and on what legal basis

We don't sell personal data, we don't use it for advertising, and we don't make decisions about you by purely automated means that have legal or similarly significant effects.

Who we share it with

Workspace content is visible to the members of that workspace according to the roles the agency gives them. Beyond that, we share data only with the service providers that help us run Ark Agency (hosting, database and file storage, sign-in, notifications, AI drafting and, once paid plans start, payments). Each is bound by a data processing agreement and may only use the data to provide their service to us. The current list is in the list of subprocessors.

We may also disclose data when the law requires it, or when it's needed to protect the rights and safety of our users or the Service.

Transfers outside the EU

Some of our providers may process data outside the European Economic Area. When that happens, we rely on an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses, so your data stays protected to the GDPR standard.

How long we keep it

• Account and workspace data: while the account is active.
• After a workspace is deleted: content is removed within 30 days, and backup copies are overwritten within a further 90 days.
• Invoices and accounting records: as long as Romanian law requires, currently up to 10 years.
• Technical logs: usually no longer than 90 days.
• Google Calendar tokens: until you disconnect Google Calendar or delete your account.
• Google Drive tokens (only if you link Drive files for review): until you disconnect Google Drive or delete your account. Your browser keeps the connected account's email address until you disconnect it or clear the site's data.
• Dropbox links you add for review: as long as the version they belong to. Ark Agency stores the shared link, not the file, and needs no Dropbox account access.
• Canva tokens: until you disconnect Canva or delete your account.

Your rights

Under the GDPR you have the right to:

• get a copy of your personal data;
• correct data that's wrong or incomplete;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format;
• withdraw consent, where we rely on consent.

Email support@ark-agency.app to use any of these. We'll answer within one month. We may ask you to confirm your identity first.

You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority in the EU country where you live or work. We'd appreciate the chance to fix things first.

Security

All traffic is encrypted in transit (HTTPS). Workspaces are separated by database access rules, so one agency can't reach another's data, and clients only see their own company's content. Third-party access tokens and stored client credentials are encrypted before they're saved. Read more on our security page.

Cookies

We only use the browser storage the Service needs to work, such as keeping you signed in. We don't use analytics or advertising cookies. Details are in the Cookie Policy.

Children

Ark Agency is for businesses and isn't directed at children under 16. We don't knowingly collect their personal data.

Changes to this policy

When we change this policy we'll update the date at the top. If the change is significant, we'll email account owners before it takes effect.