Arkimoz attaches great importance to the protection of your personal data. Here you will find, processing by processing, what we gather about you, what we do with it, who can see it, for how long, and the means you have to stay in charge.
1. Data controller
Processing carried out on engine.arkimoz.com (GTM Engine) is the responsibility of ALTO SERVI (SAS, share capital EUR 1,000, Rennes Trade and Companies Register no. 898 883 079, 28 rue Christian Bernon, 35000 Rennes, France), which operates the Arkimoz trade name. No DPO has been appointed: the size of the company does not require one. For any question about your data: contact@arkimoz.com.
2. Data collected, purposes and legal bases
| Context | Data | Purpose | Legal basis |
|---|---|---|---|
| User account | Name, business email, role, accounts you were invited to | Give you access to GTM Engine and to the accounts you were invited to | Performance of the contract (Art. 6.1.b GDPR) |
| Workspace | Your company's context (strategy, offer, positioning), uploaded documents, prompts, settings | Build your pre-audit and your Go-To-Market workspace | Performance of the contract (Art. 6.1.b GDPR) |
| Connectors | API keys and OAuth tokens of the tools you connect, encrypted at rest | Read the data you asked us to read in those tools | Performance of the contract (Art. 6.1.b GDPR) |
| Google account | See section 3 | See section 3 | Performance of the contract (Art. 6.1.b GDPR) |
| LinkedIn Ads account | See section 3 | See section 3 | Performance of the contract (Art. 6.1.b GDPR) |
| Meta Ads account | See section 3 | See section 3 | Performance of the contract (Art. 6.1.b GDPR) |
| Use of the service | Pages opened, actions taken, tokens consumed | Security, billing and improvement of the service | Legitimate interest (Art. 6.1.f GDPR) |
| Browsing, public pages | Pages viewed, journeys, interactions, device type | Understand how the public pages are used (our own browsing-recording tool hosted with OVHcloud) | Your consent (Art. 6.1.a GDPR and Art. 82 of the French Data Protection Act) |
| Site operation | IP address, date, requested page, browser (server logs) | Security and proper operation of the site | Legitimate interest (Art. 6.1.f GDPR) |
Nothing we gather falls within the special categories of Article 9 GDPR (health, opinions, origin, etc.). None of this information is passed on to third parties, free or paid. Arkimoz works with businesses: the site is not aimed at anyone under 18.
3. Data from your Google, LinkedIn and Meta accounts
When you connect a Google service, GTM Engine asks for access only to the services you choose, and only ever reads: it never writes to your Google account.
- Google Search Console (webmasters.readonly): the list of your properties, and queries, pages, clicks, impressions, click-through rate and average position.
- Google Analytics 4 (analytics.readonly): the list of your properties, and sessions, users and key events by acquisition channel.
- Google Tag Manager (tagmanager.readonly): the list of your containers.
- Google Ads (adwords): the list of the ad accounts you can access, and for the one you choose, spend, impressions, clicks, conversions and their value, in total and per campaign. Google offers no read-only access for Ads, but GTM Engine only reads: it never creates, edits or pauses a campaign.
How we use it. Only to show you these figures in GTM Engine, and to answer the questions you ask your own Claude assistant through the GTM Engine connector. Reports are read live from Google when you open a page or ask a question; they are not stored. The same figures also feed the weekly indicators of your account in the Arkimoz cockpit: they are kept in the server's memory for 15 minutes at most, never written to disk. We only keep the names of the properties you can access and the one you chose as default.
Who sees it. The members of the GTM Engine account you connected, and the Arkimoz consultants who support that account, and nobody else. Google user data is never sold, never used for advertising, never shared with third parties except to provide the feature you asked for (see section 4), and never used to develop, improve or train generalised AI or machine learning models.
Limited Use. GTM Engine's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Your control. You can disconnect a Google service at any time from its page in GTM Engine (“Delete credentials”). A single Google authorisation serves all your Google connectors: its tokens are deleted when you disconnect the last of them. To withdraw access at once and for good, revoke it from your Google account at myaccount.google.com/permissions.
When you connect LinkedIn Ads, GTM Engine asks LinkedIn for two permissions only, and only ever reads: it never writes to your LinkedIn account and never posts anything on your behalf.
- LinkedIn Ads (r_ads): the list of the Campaign Manager ad accounts on which your LinkedIn profile has a role, with their name, currency and status, and the names and statuses of their campaigns.
- LinkedIn Ads reporting (r_ads_reporting): for the ad account you choose, spend, impressions, clicks, leads from Lead Gen Forms and website conversions, in total and per campaign, over the period you ask for. Click-through rate, cost per click and cost per lead are calculated from these figures.
GTM Engine reads neither your profile, nor your connections, nor your messages, nor your posts, nor the content of the leads (names, emails) collected by your forms: only their number. It never creates, edits or pauses a campaign.
How we use it. Only to show you these figures in GTM Engine, and to answer the questions you ask your own Claude assistant through the GTM Engine connector. Reports are read live from LinkedIn when you open a page or ask a question; they are not stored. The same figures also feed the weekly indicators of your account in the Arkimoz cockpit: they are kept in the server's memory for 15 minutes at most, never written to disk. We only keep the name and identifier of the ad account you chose as default.
Who sees it. The members of the GTM Engine account you connected, and the Arkimoz consultants who support that account, and nobody else. LinkedIn data is never sold, never used for advertising, never shared with third parties except to provide the feature you asked for (see section 4), and never used to develop, improve or train generalised AI or machine learning models.
How long. The access LinkedIn grants lasts 60 days and is not renewed automatically: GTM Engine receives no refresh token. The access token is encrypted at rest (AES-256-GCM); after 60 days it no longer allows any reading, and you have to connect LinkedIn Ads again to resume.
Your control. You can disconnect LinkedIn Ads at any time from its page in GTM Engine (“Delete credentials”): the LinkedIn token is deleted at once. To withdraw access on LinkedIn's side as well, remove GTM Engine from the services you have authorised at linkedin.com/psettings/permitted-services.
When you connect Meta Ads (Facebook and Instagram), GTM Engine asks Meta for one permission only, and only ever reads: it never writes to your Meta accounts and never posts anything on your behalf.
- Meta Ads (ads_read): the list of the ad accounts your Facebook profile can access, with their name, identifier, currency and status; and, for the ad account you choose, spend, impressions, link clicks and leads (instant forms and tracked leads), per campaign and per day, over the period you ask for. Click-through rate, cost per click and cost per lead are calculated from these figures.
GTM Engine reads neither your profile, nor your friends, nor your messages, nor your Pages' posts, nor the content of the leads (names, emails) collected by your forms: only their number. It never creates, edits or pauses a campaign, an ad set or an ad.
How we use it. Only to show you these figures in GTM Engine, and to answer the questions you ask your own Claude assistant through the GTM Engine connector. Reports are read live from Meta when you open a page or ask a question; they are not stored. The same figures also feed the weekly indicators of your account in the Arkimoz cockpit: they are kept in the server's memory for 15 minutes at most, never written to disk. We only keep the name and identifier of the ad account you chose as default.
Who sees it. The members of the GTM Engine account you connected, and the Arkimoz consultants who support that account, and nobody else. Meta data is never sold, never used for advertising, never shared with third parties except to provide the feature you asked for (see section 4), and never used to develop, improve or train generalised AI or machine learning models.
How long. The access Meta grants lasts 60 days and is not renewed automatically. The access token is encrypted at rest (AES-256-GCM); after 60 days it no longer allows any reading, and you have to connect Meta Ads again to resume.
Your control and deletion. You can disconnect Meta Ads at any time from its page in GTM Engine (“Delete credentials”): the Meta token is deleted at once. To withdraw access on Meta's side as well, remove GTM Engine from your business integrations at facebook.com/settings?tab=business_tools. To have all the data we hold about your Meta connection deleted, write to contact@arkimoz.com: it is done within 30 days and we confirm it to you by email.
4. Recipients and processors
At Arkimoz, only the members of your GTM Engine account and the Arkimoz consultants who support it see this information. Five providers work on our behalf, under our instructions:
- OVHcloud (France): hosting of GTM Engine, its database and our own browsing-recording tool (clicks, scrolling, mouse movements, only after your consent; field contents never appear in the recordings). Without consent, only anonymous measurement is done: pages viewed, time, scrolling and click positions, with no cookie or identifier and without keeping the IP address (legitimate interest).
- Clerk (United States): sign-in and account security.
- Anthropic (United States): the Claude models that write your pre-audit and analyses, and the Claude assistant you connect to GTM Engine. Anthropic does not train its models on data sent through its commercial API.
- Resend (United States): delivery of notification emails.
- Google (Ireland and United States): the Google APIs you connect (see section 3), and the site's fonts, loaded from Google's servers.
The privacy policy of the arkimoz.com website is separate and available at arkimoz.com/en/confidentialite.
5. Transfers outside the European Union
Part of Clerk's, Anthropic's, Resend's and Google's processing takes place across the Atlantic. Where the provider is certified, the Data Privacy Framework adopted by the European Commission covers it; otherwise, the model clauses the Commission published for this purpose apply, signed with each of them.
6. Retention periods
- Clients: the length of the engagement, then 5 years (commercial limitation period); accounting records, 10 years as required by the French Commercial Code.
- Workspace and connector credentials: as long as the account is open; when the account is closed, they are deleted, except what the law requires us to keep.
- Google and LinkedIn Ads reports: not stored, read live.
- LinkedIn access token: encrypted, usable for 60 days at most, deleted as soon as you disconnect LinkedIn Ads.
- Browsing recordings and anonymous journeys (tool hosted with OVHcloud): 90 days after the last visit, then deleted automatically.
- Server logs: 12 months at most.
7. Your rights
The GDPR and the French Data Protection Act give you the right to access, rectify, erase, restrict, object to (in particular to prospecting, at any time and without giving a reason) and port your data. Consent you have given can be taken back whenever you like; what was done before remains lawful. You can also set instructions for what happens to your data after your death.
To exercise these rights, write to contact@arkimoz.com. You will get an answer within one month at most. If our answer does not suit you, you can file a complaint with the CNIL, the French data protection authority (cnil.fr).
8. Cookies
GTM Engine sets the cookies it needs to work: your sign-in session, the account you are viewing and your language. On the public pages, no browsing-recording cookie is set before you choose: a banner lets you accept or refuse, just as easily either way. If you refuse, the site works normally.
9. Security
We apply appropriate technical and organisational measures: hosting in France with OVHcloud, encrypted connections (HTTPS), connector credentials and tokens encrypted at rest (AES-256-GCM), access to data limited to the people who need it, and internal tools protected by authentication.
10. Updates to this policy
We revise this text whenever our tools, our organisation or the applicable law change. Last updated: 21 October 2026.