What we collect on arkonyk.com, whobilled.me and descriptors.com, why we collect it, who it goes to, and how to tell us to stop.
Effective date: August 17, 2026 · Last updated: August 17, 2026
Arkonyk, LLC (“Arkonyk”, “we”, “us”) is a payments software company organized as a limited liability company under the laws of Ohio, United States, with its principal place of business at 3008 Deerfoot Trail, Huron, Ohio 44839.
For the purposes of the UK and EU General Data Protection Regulation, Arkonyk is the controller of the personal data described in this policy.
This policy applies to three websites we operate:
Where a practice applies to only one of these, we say so. Paid use of descriptors.com is also governed by a separate customer agreement, and where that agreement and this policy differ for account data, the agreement controls.
This policy does not cover sites we link to. Once you leave one of our sites, the operator of the site you arrive at is responsible for what happens to your information.
| What | When | Where |
|---|---|---|
| Name, work email address, company, and anything you write in the message field | You submit the contact form | arkonyk.com |
| Name, work email address, company, and role | You request a gated download such as the quarterly report | arkonyk.com |
| Account details: name, business email, business name and address, and the descriptor and business information you choose to publish | You create or claim a descriptor profile | descriptors.com, whobilled.me |
| Payment details | You subscribe to a paid plan | descriptors.com — handled by our payment processor. We do not receive or store full card numbers. |
| Anything you send us | You email or call us | — |
The lookup terms you type into whobilled.me are processed to return a result and to understand which descriptors confuse people most. We do not ask for your identity to perform a lookup, and you should not include personal information in a search.
We may receive business contact details from partners, industry events, publicly available sources, and business-data providers — principally Apollo.io (ZenLeads, Inc.) and Clay (Clay Labs, Inc.) — and merchant descriptor data from acquirers, ISOs, payment facilitators and the merchants themselves.
Where we obtain your personal data from someone other than you, GDPR Article 14 requires us to tell you the source and the categories of data held. We will do so at our first communication with you, and in any event within one month of obtaining it.
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Answering your enquiry and providing anything you asked for | Steps taken at your request before entering a contract; our legitimate interest in responding |
| Providing, securing and supporting our services and accounts | Performance of a contract |
| Publishing merchant profile information supplied and confirmed by the merchant | Performance of a contract; legitimate interest in an accurate public register |
| Answering “what is this charge?” lookups | Legitimate interest in helping cardholders identify legitimate charges |
| Understanding how our sites are used and improving them | Consent where required for cookies; otherwise legitimate interest |
| Sending marketing about products related to your professional role | Consent where required; otherwise legitimate interest in business development |
| Preventing fraud and abuse, and enforcing our terms | Legitimate interest; legal obligation where applicable |
| Meeting legal, tax and accounting obligations | Legal obligation |
We do not sell your personal information, and we do not use it for advertising of any kind. We do not run advertising on our sites, and advertising and personalisation signals are switched off in our analytics configuration. We do use visitor-identification services for our own sales and marketing — described in sections 3, 5 and 6 — and one of these matches visitors against identity data collected across other websites. You can opt out of that identification at any time; section 6 explains how.
We share personal data only with service providers who process it on our instructions, and only as needed:
| Provider | What it does | What it receives |
|---|---|---|
| GitHub Pages (GitHub, Inc.) | Serves arkonyk.com | IP address, request logs |
| Vercel Inc. and Railway Corp. | Run the gated-download service and product applications | IP address, request logs, form fields you submit |
| Resend, Inc. | Delivers our transactional email — contact-form enquiries and gated-download notifications sent to our own inboxes | Name, email address, company, and the content of the form you submit |
| Google Analytics (Google LLC / Google Ireland Ltd) | Website analytics | Truncated IP, device and browser data, pages viewed, on-site events |
| Apollo.io (ZenLeads, Inc.) | Business visitor identification — matches visits from company networks to the organization visiting. It does not identify individual people on our sites. | IP address, pages viewed, device and browser data |
| RB2B, Inc. | Person-level visitor identification, United States visitors only — matches visits against its own identity graph to tell us which individual professionals visited. RB2B is a registered data broker in several US states; its stated policy is that it does not resell the data it provides to us. | IP address, cookies and device identifiers, pages viewed |
| Google Fonts (Google LLC) | Serves the typefaces our pages use | IP address and browser details, at the moment a font loads |
| Our payment processor | Takes subscription payments on descriptors.com; we will name the processor here when paid subscriptions launch | Payment and billing details, directly from you |
We may also disclose information where the law requires it, to establish or defend legal claims, or to a buyer or successor if the business or its assets are sold — in which case we will tell you before your information becomes subject to a different policy.
A cookie is a small file a website stores in your browser. We use as few as we can.
| Type | Purpose | Set without consent? |
|---|---|---|
| Strictly necessary | Security, and remembering your cookie choice | Yes — the site cannot work without them |
| Analytics & business visitor identification | Understanding which pages are useful, and recognising which companies visit our business pages | Outside the EEA, UK and Switzerland: yes. Inside them: no — not until you agree |
| Person-level visitor identification | Recognising which individual professionals visit arkonyk.com, United States visitors only | In the US: yes, unless your browser sends a Global Privacy Control signal. Everywhere else: it does not run |
| Advertising | None. We do not use them. | — |
For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics storage is denied by default and the visitor-identification service does not load at all. Until you agree, our analytics provider receives only aggregate, cookieless signals, and nothing identifying is stored on your device.
For visitors in the United States, arkonyk.com uses RB2B to attempt to identify the individual professional visiting. The matching works by comparing cookies and device identifiers set on our site against identity information RB2B has associated with those identifiers on other websites. This means a third party is using identifiers gathered across different websites to recognise you here. It applies only on arkonyk.com — not on whobilled.me or descriptors.com — and only to United States traffic.
You can prevent it in any of these ways, each fully effective:
You can also block or delete cookies in your browser settings. Doing so will not stop you using our sites.
Some browsers can send a “Do Not Track” signal. There is still no common industry standard for how a website should respond to one, so our sites do not currently respond to Do Not Track signals. As described in section 6, the person-level visitor-identification service we use on arkonyk.com does rely on identifiers its provider has collected across other websites; every other part of our sites involves no cross-site tracking.
We do honour the Global Privacy Control signal where your browser or extension sends one, and we treat it as a request to disable non-essential analytics.
The Global Privacy Control commitment above is implemented in our site code: when your browser sends the signal, the analytics and visitor-identification services described in section 6 are not loaded.
If you give us your work email address, or we obtain it from a business source, we may send you email about our products and about developments in payments that relate to your role.
Where the law of your country requires your prior consent to receive marketing email — which includes several European countries even for business addresses — we will obtain it before sending, and you can withdraw it at any time.
| Category | Retention |
|---|---|
| Enquiries and form submissions | 24 months from our last contact with you |
| Marketing contact records | Until you unsubscribe; we then keep a suppression record indefinitely so we do not contact you again |
| Customer account records | For the life of the account, then 7 years for tax and accounting |
| Published descriptor profile data | While the profile is active, plus a change history |
| Analytics data | 14 months |
| Server and application logs | 30 days |
We are based in the United States and our service providers are mostly based there too. If you are in the United Kingdom, the European Economic Area or Switzerland, your personal data will be transferred outside your country.
Where we transfer personal data out of the UK or EEA we rely on the European Commission’s Standard Contractual Clauses, the UK Addendum or International Data Transfer Agreement as applicable, or on the EU–US and UK–US Data Privacy Framework where the recipient is certified. You can ask us for a copy of the safeguards that apply.
Depending on where you live, you may have the right to:
To exercise any of these, write to us at the address in section 15. We will verify your identity before acting, and we will respond within the time the law allows — one month under the GDPR, forty-five days under California law. Using these rights is free, and you may use an authorised agent.
If you are in the UK or EEA you also have the right to complain to your data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk). We would rather you came to us first, but the right is yours either way.
If your business is listed on whobilled.me or descriptors.com and something is wrong, tell us and we will investigate and correct it. Merchant listing information is business information rather than personal data, but the correction route is the same, and it is open to you whether or not you are a customer.
We use encryption in transit, restrict access to the people who need it, and choose established providers for hosting and payments. No system is perfectly secure, and we cannot guarantee that a transmission over the internet is completely safe. Please do not send us sensitive personal information through a website form or an unencrypted email.
Our sites are intended for business users and adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, tell us and we will delete it.
If we change this policy we will post the new version here and update the effective date at the top. If the change materially affects how we handle information we have already collected, we will give more prominent notice — a notice on the site, and an email where we hold your address and the change warrants it — before it takes effect. We keep prior versions and will provide one on request.
Questions about this policy, or a request about your personal data:
Arkonyk, LLC
3008 Deerfoot Trail
Huron, Ohio 44839, United States
Email: privacy@arkonyk.com
General enquiries: info@arkonyk.com
Visa is a registered trademark of Visa Inc. Mastercard and Ethoca are registered trademarks of Mastercard International Incorporated. Verifi is a registered trademark of Verifi, Inc., a Visa company. All other trademarks are the property of their respective owners. Arkonyk is not affiliated with, sponsored by or endorsed by any card network, and references to network programmes are descriptive only.