Privacy Policy

ARJ Labs LLC Last updated: September 24, 2026.

What changed: Added Google Analytics 4, its cookies and opt-out choices, clarified Cloudflare Web Analytics and necessary billing cookies, and added Google as a service provider.

This policy is written to be read. If any sentence is unclear, email us and we will explain it.

1. Who we are

ARJ Labs LLC is a New Hampshire limited liability company at 9 Clearwater Dr, Dover, NH 03820. We operate the website at arjlabs.com and its subdomains, and we build and run websites for other businesses.

In this policy, "we" and "us" mean ARJ Labs LLC. "You" means anyone visiting one of our sites or doing business with us.

Contact for anything in this policy:

• Email: alex@arjlabs.com
• Phone: 603-978-1994
• Mail: ARJ Labs LLC, 9 Clearwater Dr, Dover, NH 03820

2. What this policy covers

This policy covers arjlabs.com and the sites we operate on our subdomains, including our services page, our build request page, our work pages, and the free website audit.

It does not cover websites we build and operate for a client. Those are covered in section 8.

3. Information we collect

We collect less than most websites, and we would rather say so plainly than pad this list. Here is what we collect and how we use it.

3.1 The free website audit. The audit form asks for a website address and your email address.

• Our server fetches that site's publicly published files, including its homepage, robots.txt, sitemap, and any llms.txt file, and scores what it finds.
• We store the email address, the website address, the score, and the results in our own database, so we can follow up on the audit you asked for and so we know which checks are useful.
• The report itself is shown to you in your browser immediately. You do not need an account and there is nothing to log in to.
• We do not store your IP address. It is used in memory for a few seconds to stop automated abuse of the tool, and then it is gone. It is never written to our database.
• The audit is a static check of what a site publishes. It is not a Google ranking, not an AI citation, and not a traffic forecast.

3.2 The build request form. The form asks for your business name, what the business does, the type of work requested, your current website, email address, phone number and optional notes. You consent to our using these details to respond and prepare your project. When submitted successfully, the form sends these details to our contact endpoint; it does not open your email app. Do not include passwords or payment-card details. Inquiry retention is described in section 9.

3.3 The contact form. Where our contact form is live, it collects your name, your email address, the topic you choose, and your message. Submissions are stored in our own database so we can reply, and an email notification is sent to us. The form includes an invisible field that only automated bots fill in; if it is filled, the submission is discarded. We limit submissions per network address to stop spam, and that address is used for the limit only, not stored with your message.

3.4 Email you send us directly. When you email us, we receive your address, your name if you include it, and whatever you write. We keep it so we can answer you and run the project.

3.5 Payment information. When we provide a checkout for an accepted project, payments are processed by Stripe. When you pay:

• You are redirected to a Stripe-hosted checkout page. Your card number, expiry date, and security code are entered on Stripe's page, never on ours, and we never receive or store them.
• We receive confirmation that a payment succeeded, the amount, the currency, the billing name and email, and the last four digits and brand of the card.
• We store the order and billing event records needed to run the subscription, and the version of the terms you accepted, so we can show what you agreed to and when.
• Stripe holds the card for future Engine billing under its own privacy policy.

The launch fee has a 7-day refund window from payment, separate from the 7-day launch guarantee, governed by our Terms of Service. Engine billing begins only when your approved site is verified live. Cancel anytime with no minimum term or extra notice period, effective at the end of the paid monthly period. Payment and consent records include any refund or cancellation needed to administer your request.

3.6 Technical information from our hosting provider. Our sites run on Cloudflare. Like every web host, Cloudflare processes standard request data to serve the page and protect the site, which can include your IP address, your browser identification, and the page you requested. We do not use this to build a profile of you and we do not combine it with anything else.

Cloudflare Web Analytics gives us cookieless, aggregate page-view statistics. It uses no fingerprinting and is not used to identify you. We do not use it for advertising or sell these statistics.

3.7 Google Analytics 4 and what we do not collect. We use Google Analytics 4 (Google LLC) on arjlabs.com to understand which pages are used: pages viewed, referrer, device/browser type, approximate location (country/city derived by Google from IP), and on-site events. GA4 does not log or store IP addresses. Google signals and ad personalization are turned off. We do not use it for advertising and do not send names, emails or form contents to Google.

We honor Global Privacy Control: Google Analytics does not load when your browser has GPC turned on. You can also block cookies or use Google's opt-out browser add-on.

• No advertising pixel, no session recording, and no social trackers run on our pages.
• We do not sell your information or share it with advertisers.
• We do not collect precise location, your contacts, or your device's files.
• We do not use your information to train an AI model.

If we ever add a product that tracks you across sites, this section will be rewritten before it goes live, not after.

3.8 Network addresses, in one place. This is the single position, and it applies everywhere on our sites:

• We read your IP address when you submit a form, run an audit, or start a checkout. We use it for one purpose only: stopping automated abuse, such as spam and card testing.
• We do not store your IP address as an address. It is not written to our database alongside your message, your audit, or your order.
• To enforce our abuse limits, we may hold a one-way hash of the address combined with the hour. That hash cannot be reversed back into your address, and it is used only to count requests.
• We do not use your IP address to identify you, to build a profile, or for advertising.

4. Cookies

Google Analytics sets first-party cookies _ga and _ga_<container-id> that last up to 2 years. These help measure use of this site, not advertising.

The strictly necessary __Host-arj-billing checkout/billing session cookie is set only when you start a checkout. It is HttpOnly, Secure and SameSite=Strict. Cloudflare may also set security cookies to protect the site from abuse. Cloudflare Web Analytics itself is cookieless.

Your browser may store your audit report locally while you read it; that stays on your device. You can block cookies in your browser, though blocking the billing cookie may prevent checkout or billing features from working.

5. How we use your information

We use it to:

• Answer your question, run your audit, and prepare or deliver work you asked for
• Send you the written estimate you requested
• Provide the service you bought, including hosting and the Engine
• Bill you and keep proper accounting records
• Send you service messages, such as a receipt, a notice that a subscription will renew, or a change in these terms
• Keep records of agreements and consents, including what you accepted and when
• Meet legal, tax, and accounting obligations
• Protect the site from abuse and spam

We do not sell or rent your information.

6. Who we share it with

We share information only with the service providers that make the service work, and only what each one needs:

We may also disclose information if the law requires it, if we need to enforce our agreements, or to protect the rights and safety of others.

If we ever sell or transfer the business, customer records may transfer with it. This policy would continue to apply to your information until updated, and we would tell you.

7. Where your information is stored

Information is stored on the service providers listed above, in the United States. Our own database runs on Cloudflare's infrastructure.

8. Websites we build and operate for clients

When we build and operate a website for a client, the client owns that website, its domain, its content, and its files. For the visitor data that flows through it, we act on the client's behalf and at the client's direction.

That means:

• If you are a visitor to a client's website, the client is responsible for the privacy notice on that site, and you should address privacy requests to that client.
• We will assist our clients in answering your requests, and we keep visitor information only as long as the client needs it.
• We do not use a client's visitor data for our own marketing or our own purposes.

Where we add a checkout to a client's site, the money moves through the client's own payment account. The client is the merchant.

9. How long we keep it

Our planned Google Analytics event-data retention setting is 14 months; it is pending configuration before launch. Cookie lifetime is separate, as described in section 4.

• Audit requests, including the email address and the report results: up to 3 years, so we can answer a follow-up question about the audit you ran
• Contact and inquiry messages: up to 3 years after the last contact, so we have context if you come back
• Client and project records, invoices, and payment records: 7 years, because tax and accounting rules require it
• Consent records, including what you accepted and when: for the life of the agreement plus the period in which a claim could be brought
• IP addresses used for abuse limits: not retained at all

10. Your choices and your rights

You can ask us to:

• Tell you what we hold about you
• Correct anything wrong
• Delete it, where we are not required to keep it
• Stop sending you marketing email
• Provide a copy in a portable format

Email alex@arjlabs.com and we will respond within 30 days. We may need to confirm who you are before acting, and we will not charge you for a reasonable request.

We honor these requests whether or not a particular law requires us to. If you are in California or another state with its own privacy law, you may also have the right to know the categories of information we collect and to not be discriminated against for exercising your rights. We do not discriminate.

We do not respond differently to a browser's "Do Not Track" signal, because we do not track you across sites to begin with.

11. Security

We use HTTPS on every page, restrict access to our systems, and keep credentials out of our website code. No system is perfectly secure. If a breach ever affects your information, we will tell you what happened and what we are doing about it.

12. Children

Our services are for businesses. Our sites are not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, email us and we will delete it.

13. Changes to this policy

If we change this policy we will update the date at the top and note what changed. If the change is significant, we will tell active clients by email before it takes effect. Continuing to use the site after a change means you accept the updated policy.

14. Questions

Email alex@arjlabs.com, call 603-978-1994, or write to ARJ Labs LLC, 9 Clearwater Dr, Dover, NH 03820. We would rather answer a question than have you guess.