Privacy Policy
What we collect on arkonyk.com, whobilled.me and descriptors.com, why we collect it, who it goes to, and how to tell us to stop.
Effective date: August 17, 2026 · Last updated: August 17, 2026
1. Who we are
Arkonyk, LLC (“Arkonyk”, “we”, “us”) is a payments software company organized as a limited liability company under the laws of Ohio, United States, with its principal place of business at 3008 Deerfoot Trail, Huron, Ohio 44839.
For the purposes of the UK and EU General Data Protection Regulation, Arkonyk is the controller of the personal data described in this policy.
2. What this policy covers
This policy applies to three websites we operate:
- arkonyk.com — our company and product site.
- whobilled.me — a free public tool where anyone can look up a billing descriptor from a card statement to find the business behind the charge.
- descriptors.com — where merchants and partners claim and manage their billing descriptor profiles.
Where a practice applies to only one of these, we say so. Paid use of descriptors.com is also governed by a separate customer agreement, and where that agreement and this policy differ for account data, the agreement controls.
This policy does not cover sites we link to. Once you leave one of our sites, the operator of the site you arrive at is responsible for what happens to your information.
3. Information we collect
Information you give us directly
| What | When | Where |
|---|---|---|
| Name, work email address, company, and anything you write in the message field | You submit the contact form | arkonyk.com |
| Name, work email address, company, and role | You request a gated download such as the quarterly report | arkonyk.com |
| Account details: name, business email, business name and address, and the descriptor and business information you choose to publish | You create or claim a descriptor profile | descriptors.com, whobilled.me |
| Payment details | You subscribe to a paid plan | descriptors.com — handled by our payment processor. We do not receive or store full card numbers. |
| Anything you send us | You email or call us | — |
The lookup terms you type into whobilled.me are processed to return a result and to understand which descriptors confuse people most. We do not ask for your identity to perform a lookup, and you should not include personal information in a search.
Information collected automatically
- Server logs. Our hosting providers record your IP address, browser type, the pages requested and the time of the request. This is ordinary web-server operation.
- Analytics. Where analytics are enabled and permitted, we collect pages viewed, referring site, approximate location derived from a truncated IP address, device and browser type, and interactions such as clicking a call to action or using a calculator. See Cookies and analytics.
- Visitor identification. On arkonyk.com we use services that try to identify who is visiting. One identifies the company a visit comes from, worldwide. The other — for visitors in the United States only — attempts to identify the individual professional visiting, by matching cookies and device identifiers against identity data its provider has compiled across other websites. Where a match is made we may receive a name, job title, business contact details and employer, together with the pages visited. Match rates are partial; most visitors are not identified. See Cookies, analytics and visitor identification, including how to opt out.
- Local storage. If you make a cookie choice, we store that choice in your browser so we do not have to ask again.
- Calculator inputs. Figures you enter into an on-site calculator are processed in your browser. If you use “copy my results link”, those figures are placed in the resulting web address so the page can be reproduced. Anyone you send that link to can see those figures. We do not treat business figures as personal data, but do not put personal information into those fields.
Information from other sources
We may receive business contact details from partners, industry events, publicly available sources, and business-data providers — principally Apollo.io (ZenLeads, Inc.) and Clay (Clay Labs, Inc.) — and merchant descriptor data from acquirers, ISOs, payment facilitators and the merchants themselves.
Where we obtain your personal data from someone other than you, GDPR Article 14 requires us to tell you the source and the categories of data held. We will do so at our first communication with you, and in any event within one month of obtaining it.
4. How we use it, and our legal basis
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Answering your enquiry and providing anything you asked for | Steps taken at your request before entering a contract; our legitimate interest in responding |
| Providing, securing and supporting our services and accounts | Performance of a contract |
| Publishing merchant profile information supplied and confirmed by the merchant | Performance of a contract; legitimate interest in an accurate public register |
| Answering “what is this charge?” lookups | Legitimate interest in helping cardholders identify legitimate charges |
| Understanding how our sites are used and improving them | Consent where required for cookies; otherwise legitimate interest |
| Sending marketing about products related to your professional role | Consent where required; otherwise legitimate interest in business development |
| Preventing fraud and abuse, and enforcing our terms | Legitimate interest; legal obligation where applicable |
| Meeting legal, tax and accounting obligations | Legal obligation |
We do not sell your personal information, and we do not use it for advertising of any kind. We do not run advertising on our sites, and advertising and personalisation signals are switched off in our analytics configuration. We do use visitor-identification services for our own sales and marketing — described in sections 3, 5 and 6 — and one of these matches visitors against identity data collected across other websites. You can opt out of that identification at any time; section 6 explains how.
5. Who we share it with
We share personal data only with service providers who process it on our instructions, and only as needed:
| Provider | What it does | What it receives |
|---|---|---|
| GitHub Pages (GitHub, Inc.) | Serves arkonyk.com | IP address, request logs |
| Vercel Inc. and Railway Corp. | Run the gated-download service and product applications | IP address, request logs, form fields you submit |
| Resend, Inc. | Delivers our transactional email — contact-form enquiries and gated-download notifications sent to our own inboxes | Name, email address, company, and the content of the form you submit |
| Google Analytics (Google LLC / Google Ireland Ltd) | Website analytics | Truncated IP, device and browser data, pages viewed, on-site events |
| Apollo.io (ZenLeads, Inc.) | Business visitor identification — matches visits from company networks to the organization visiting. It does not identify individual people on our sites. | IP address, pages viewed, device and browser data |
| RB2B, Inc. | Person-level visitor identification, United States visitors only — matches visits against its own identity graph to tell us which individual professionals visited. RB2B is a registered data broker in several US states; its stated policy is that it does not resell the data it provides to us. | IP address, cookies and device identifiers, pages viewed |
| Google Fonts (Google LLC) | Serves the typefaces our pages use | IP address and browser details, at the moment a font loads |
| Our payment processor | Takes subscription payments on descriptors.com; we will name the processor here when paid subscriptions launch | Payment and billing details, directly from you |
We may also disclose information where the law requires it, to establish or defend legal claims, or to a buyer or successor if the business or its assets are sold — in which case we will tell you before your information becomes subject to a different policy.
6. Cookies and analytics
A cookie is a small file a website stores in your browser. We use as few as we can.
| Type | Purpose | Set without consent? |
|---|---|---|
| Strictly necessary | Security, and remembering your cookie choice | Yes — the site cannot work without them |
| Analytics & business visitor identification | Understanding which pages are useful, and recognising which companies visit our business pages | Outside the EEA, UK and Switzerland: yes. Inside them: no — not until you agree |
| Person-level visitor identification | Recognising which individual professionals visit arkonyk.com, United States visitors only | In the US: yes, unless your browser sends a Global Privacy Control signal. Everywhere else: it does not run |
| Advertising | None. We do not use them. | — |
For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics storage is denied by default and the visitor-identification service does not load at all. Until you agree, our analytics provider receives only aggregate, cookieless signals, and nothing identifying is stored on your device.
Person-level identification, and how to opt out
For visitors in the United States, arkonyk.com uses RB2B to attempt to identify the individual professional visiting. The matching works by comparing cookies and device identifiers set on our site against identity information RB2B has associated with those identifiers on other websites. This means a third party is using identifiers gathered across different websites to recognise you here. It applies only on arkonyk.com — not on whobilled.me or descriptors.com — and only to United States traffic.
You can prevent it in any of these ways, each fully effective:
- Turn on Global Privacy Control in your browser or install a GPC extension — we detect the signal and the identification service is not loaded at all;
- Block third-party cookies in your browser settings;
- Opt out directly with the provider at app.retention.com/optout (RB2B operates on its parent company’s platform, which is why the address differs) — and if you are in the EU or UK, where this service does not run on our sites at all, you can additionally register a GDPR opt-out with the provider at rb2b.com/rb2b-gdpr-opt-out;
- Email us at [email protected] and we will delete any identification we hold about you and suppress future contact.
You can also block or delete cookies in your browser settings. Doing so will not stop you using our sites.
7. Do Not Track
Some browsers can send a “Do Not Track” signal. There is still no common industry standard for how a website should respond to one, so our sites do not currently respond to Do Not Track signals. As described in section 6, the person-level visitor-identification service we use on arkonyk.com does rely on identifiers its provider has collected across other websites; every other part of our sites involves no cross-site tracking.
We do honour the Global Privacy Control signal where your browser or extension sends one, and we treat it as a request to disable non-essential analytics.
The Global Privacy Control commitment above is implemented in our site code: when your browser sends the signal, the analytics and visitor-identification services described in section 6 are not loaded.
8. Marketing email
If you give us your work email address, or we obtain it from a business source, we may send you email about our products and about developments in payments that relate to your role.
- Every marketing email contains a working unsubscribe link and our postal address.
- We action unsubscribe requests promptly, and within ten business days at the latest.
- Unsubscribing costs nothing, requires no account, and needs nothing from you beyond the request itself.
- You can also write to us at the address in section 15 and ask to be removed.
- Unsubscribing from marketing does not stop essential messages about an account or a transaction.
Where the law of your country requires your prior consent to receive marketing email — which includes several European countries even for business addresses — we will obtain it before sending, and you can withdraw it at any time.
9. How long we keep it
| Category | Retention |
|---|---|
| Enquiries and form submissions | 24 months from our last contact with you |
| Marketing contact records | Until you unsubscribe; we then keep a suppression record indefinitely so we do not contact you again |
| Customer account records | For the life of the account, then 7 years for tax and accounting |
| Published descriptor profile data | While the profile is active, plus a change history |
| Analytics data | 14 months |
| Server and application logs | 30 days |
10. International transfers
We are based in the United States and our service providers are mostly based there too. If you are in the United Kingdom, the European Economic Area or Switzerland, your personal data will be transferred outside your country.
Where we transfer personal data out of the UK or EEA we rely on the European Commission’s Standard Contractual Clauses, the UK Addendum or International Data Transfer Agreement as applicable, or on the EU–US and UK–US Data Privacy Framework where the recipient is certified. You can ask us for a copy of the safeguards that apply.
11. Your rights
Depending on where you live, you may have the right to:
- Ask what personal data we hold about you and get a copy
- Have inaccurate data corrected
- Ask us to delete data we no longer need
- Ask us to restrict how we use it, or object to our use of it — including any use for direct marketing, which you can stop at any time
- Receive certain data in a portable format
- Withdraw consent where we relied on it, without affecting what we did beforehand
- Not be discriminated against for exercising any of these rights
To exercise any of these, write to us at the address in section 15. We will verify your identity before acting, and we will respond within the time the law allows — one month under the GDPR, forty-five days under California law. Using these rights is free, and you may use an authorised agent.
If you are in the UK or EEA you also have the right to complain to your data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk). We would rather you came to us first, but the right is yours either way.
Merchants: correcting your listing
If your business is listed on whobilled.me or descriptors.com and something is wrong, tell us and we will investigate and correct it. Merchant listing information is business information rather than personal data, but the correction route is the same, and it is open to you whether or not you are a customer.
12. Security
We use encryption in transit, restrict access to the people who need it, and choose established providers for hosting and payments. No system is perfectly secure, and we cannot guarantee that a transmission over the internet is completely safe. Please do not send us sensitive personal information through a website form or an unencrypted email.
13. Children
Our sites are intended for business users and adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, tell us and we will delete it.
14. Changes to this policy
If we change this policy we will post the new version here and update the effective date at the top. If the change materially affects how we handle information we have already collected, we will give more prominent notice — a notice on the site, and an email where we hold your address and the change warrants it — before it takes effect. We keep prior versions and will provide one on request.
15. How to contact us
Questions about this policy, or a request about your personal data:
Arkonyk, LLC
3008 Deerfoot Trail
Huron, Ohio 44839, United States
Email: [email protected]
General enquiries: [email protected]
Visa is a registered trademark of Visa Inc. Mastercard and Ethoca are registered trademarks of Mastercard International Incorporated. Verifi is a registered trademark of Verifi, Inc., a Visa company. All other trademarks are the property of their respective owners. Arkonyk is not affiliated with, sponsored by or endorsed by any card network, and references to network programmes are descriptive only.