Legal
Privacy Policy
Last updated: July 8, 2026
1. Scope and roles
This Privacy Policy explains how Workflow Corporation, doing business as AR Buddy (“AR Buddy,” “we,” “us”), handles information in connection with the AR Buddy client portal, API, and debtor account pages (the “Platform”). It covers two distinct categories of information that we treat very differently:
- Client information — information about our radio-station clients and their authorized users (business contact details, login credentials, API keys). For this information we act as the controller.
- Debtor / Account Data — information about the advertiser/debtor on each placed account, which may include an individual's name and contact details. This data is provided to us by the Client station for the sole purpose of collecting a commercial receivable. For Debtor Data we act as a service provider/processor on behalf of the Client station, which is the controller. We process it only to perform collection and only as instructed by the Client and our agreements, not for our own purposes.
2. If you are a debtor (advertiser)
We receive Debtor Data from our Client stations, not from the debtors themselves. If you are an advertiser or other individual whose information we hold because a station placed an account, the station that engaged us is the controller of your information; please also direct requests to that station. We will assist the station in responding to any request we are obligated to support. We use Debtor Data only to collect the specific account it relates to, and we do not report debtors to consumer credit reporting agencies.
3. What we collect
Client data: business name and call letters, authorized contact name, business email, hashed password (we never store passwords in plain text), API key, and Platform usage/log data.
Debtor / Account Data: advertiser/debtor name, optional invoice reference, original amount, age of the account, account status, and amounts recovered/remitted. Where a Client provides it, we may also hold business contact details and the debtor's state, used to determine applicable legal obligations and notice wording. We follow a data-minimization practice: we do not request or store Social Security numbers, and we do not store raw bank-account or payment-card numbers — online payments are handled by Authorize.net, a PCI-compliant payment processor that returns only a token and confirmation to us.
4. How we use information
- To provide the Platform and perform collection on accounts a Client places;
- To authenticate users and secure accounts (credentials, API keys, logs);
- To produce remittance statements and reconcile funds held in trust;
- To comply with legal obligations, enforce our agreements, and prevent fraud or misuse.
We do not sell personal information. We do not use Debtor Data for our own marketing or for any purpose other than collecting the account it concerns and meeting our legal and contractual duties.
5. How we share information
We share information only as needed to operate the service and meet legal obligations, with:
- Service providers acting under contract on our behalf: Google Cloud Platform (application hosting and database, United States), Resend (transactional email delivery), Authorize.net (payment processing — card and bank details go directly to the processor and never touch our servers), and postal carriers when we mail a letter. Each provider may use the data only to provide its service to us.
- The Client station that placed the account (for Debtor Data, the station is the controller).
- Legal and regulatory recipients where required by law, legal process, or to protect rights and safety.
We do not sell your information, we do not buy debt, we do not report debtors to consumer credit reporting agencies, and we do not share information except as described here.
6. Cookies and tracking
The Platform uses a single essential session cookie to keep you signed in; it is HTTP-only, expires after 7 days, and contains no tracking identifiers. Your light/dark theme choice is stored locally in your browser. We use no advertising cookies, no third-party analytics, and no cross-site tracking, so there is nothing to opt out of and we do not respond differently to “Do Not Track” signals — nothing is tracked either way.
7. Where data is processed
The Platform is hosted on Google Cloud Platform in the United States, and information is processed and stored there. If you use the Platform from outside the United States (for example, Australian or Canadian station groups), your information is transferred to and processed in the United States under this Policy and our Client agreements.
8. Retention
We keep Client data for as long as the account is active and as needed for legal, tax, and recordkeeping purposes. For Debtor Data, our practice is to dispose of it no later than two (2) years after the last date it was used to service the account, except where a longer period is required by a litigation/legal hold, by law, or by our agreement with the Client. We review our retention practices at least annually to minimize unnecessary retention.
9. Security
We protect information using access controls scoped so that each Client sees only its own accounts, encrypted transport (TLS), hashed credentials, audit logging, and a written information-security program. No system is perfectly secure; if we experience a security incident affecting personal information, we will notify affected Clients and individuals and applicable regulators as required by the breach-notification law of each affected individual's state of residence and by our Client agreements.
10. Your choices and rights
Depending on your state of residence and the nature of the data, individuals may have rights to access, correct, or request deletion of personal information, or to dispute the accuracy of an account. Because most Debtor Data is held on behalf of a Client station (controller), we will route or support such requests with that station as required by law. Client-account users may update their account information or request closure at any time. To make a request, contact us at privacy@workflowcorp.com; we may need to verify your identity and, for Debtor Data, coordinate with the relevant Client.
11. Dispute and cease-contact
If you dispute an account or ask that contact stop, tell us or the placing station; we honor validated disputes and cease-contact requests as a matter of policy across our systems.
12. Children
The Platform and the underlying receivables are commercial and not directed to children; we do not knowingly collect information from anyone under 18.
13. Changes
We may update this Policy; material changes will be posted with a new “Last updated” date and, where appropriate, communicated to Clients.
14. Contact
Workflow Corporation (d/b/a AR Buddy)
3201 Pacific Ave, Unit #3, Wildwood, NJ 08260, USA
privacy@workflowcorp.com