Privacy Policy

Southwest Media Services & Arroyo
Effective date: October 26, 2026

Southwest Media Services ("Southwest Media," "we," "us," or "our") operates swmediaservices.com and Arroyo, our marketing operations application at arroyo.swmediaservices.com. This policy explains how we collect, use, disclose, and handle information through our website, services, and authorized connected accounts.

For privacy questions or requests, email jhorton@swmediaservices.com or use our contact page. We are based in Phoenix, Arizona.

1. Information we collect

Information you provide. We receive names, business names, email addresses, phone numbers, project details, messages, and other information you submit through forms or provide while working with us. Client workspaces may contain contact and lead records, campaign plans, drafts, approved media, schedules, budgets, approval history, payment-status records, and communications relevant to our services.

Website activity. Squarespace and analytics services may process IP addresses, browser and device details, referring pages, pages visited, approximate location, interactions, and cookie or similar identifiers. Website analytics and advertising measurement help us understand visits and inquiries.

Connected-account information. When an authorized person connects an account to Arroyo, we receive the information allowed by the permissions granted. This can include account and asset identifiers, account names, authorization tokens, advertising and social performance, website and search analytics, selected files and metadata, inquiry spreadsheet records, and publication or advertising receipts. Connecting a service does not give us unrestricted access to every account or file you own.

2. How we use information

We use information to respond to inquiries; provide and administer services; organize client work and approved assets; prepare and schedule content; carry out authorized publishing and advertising actions; report on results; maintain approvals and action history; reconcile payment-status records; troubleshoot problems; secure our services; and meet applicable legal obligations.

Authorized workspace users can review client information and manage the workflows available to their role. Publishing, advertising activation, and automation follow the relevant client settings, permissions, and approval steps. We do not use connected-account data to build unrelated personal profiles or sell access to your accounts.

3. Facebook and Instagram connections

Arroyo uses Meta APIs for authorized Facebook Pages, linked Instagram professional accounts, and selected advertising accounts. Depending on granted permissions and enabled features, we may access Page and account details, posts and media, insights, advertising resources, campaign performance, and the permissions necessary to create or manage approved content and ads.

Approved content and advertising materials are sent to Meta for the requested action. We retain relevant external IDs, publication links, results, and action records to support reporting and reconciliation. Meta also processes information under its own policies. You can remove Arroyo through the applicable Facebook or Meta business-integration settings. Removing authorization stops future access using that authorization; it does not automatically remove records already stored by Arroyo or posts and ads already created on Meta. See the deletion instructions below.

4. Google connections

Authorized Google connections may provide Google Analytics, Search Console, and Google Ads reporting; advertising-account and campaign resources; selected Google Drive folders, files, and metadata; and inquiry information in an authorized Google Sheet. We use these permissions for the connected features requested by the account holder or authorized client administrator.

Selected media may be temporarily copied for delivery to the publishing or advertising platform you choose. We do not transfer Google account data to advertising platforms to build audiences or personalize advertising. We do not sell Google user data or use it for unrelated profiling or general-purpose AI model training.

Arroyo's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. You can revoke access in your Google Account's third-party connections settings. Revoking access does not itself delete previously stored workspace records; contact us to request deletion.

5. Service providers and disclosures

We disclose information as needed to providers supporting the requested services. These include Squarespace for our website and forms; Cloudflare for Arroyo hosting, storage, and execution; OpenAI/ChatGPT for the application platform and authorized operator workflows; Google for connected Google services; Meta for connected social and advertising services; and Browserbase where used for authorized website-publishing browser sessions.

Only the information relevant to a feature or requested workflow should be provided to that service. Arroyo's template-based content suggestions do not require sending prompts to a paid AI-generation API. If you separately use an AI service with client information, that service's applicable terms and privacy notices also govern its processing.

We may disclose information where required by law, to address fraud or security incidents, to protect rights, or as part of a lawful business transfer subject to applicable safeguards. We do not sell personal information or connected-account data. Advertising and analytics providers may separately process website identifiers through their technologies; you may contact us about available privacy choices.

6. Cookies and your choices

Our website and service providers may use cookies and similar technologies for essential functions, preferences, analytics, and advertising measurement. You can manage cookies through your browser and any consent controls offered on the website. Blocking cookies may affect functionality. You may also use privacy controls provided by Google and Meta. To stop receiving optional marketing messages from us, use the unsubscribe option where provided or contact us.

7. Storage, retention, and security

We retain information while needed for the services and purposes described here, including client administration, reporting, security, dispute resolution, and legal or accounting requirements. Retention varies by record type and the client relationship; we do not promise that every record is automatically deleted after a fixed period. Temporary media-delivery copies are designed for short-lived use and cleanup.

Arroyo uses access controls and encrypted storage for saved connection credentials, together with HTTPS connections. Security measures reduce risk but cannot guarantee absolute security. Please do not send passwords, API keys, payment-card details, or unnecessary sensitive personal information through website inquiry forms or privacy-request emails.

8. Data deletion and privacy requests

To request deletion of information held by Southwest Media or Arroyo, email jhorton@swmediaservices.com with the subject "Arroyo Data Deletion Request." You may also use our contact page.

Include your name, a reply email address, the business or client workspace involved, and the connected service or records you want removed. For Meta-related requests, include the relevant Page, Instagram account, or ad-account name or ID if known. Do not include passwords or access tokens.

We may ask for limited information needed to verify your identity and authority over the records. After verification, we will review the request, delete or de-identify information we are not required or otherwise permitted to retain, and confirm completion or explain any applicable retention exception. We handle requests within the time required by applicable law. If records remain in backups, they may persist until normal backup expiration and should not be restored to active use except as necessary for recovery and legal obligations.

Deleting Arroyo's stored information does not automatically delete posts, ads, or other records held by Google, Meta, Squarespace, or another independent provider. Tell us if you also want assistance removing content we created; provider permissions and recordkeeping requirements may apply. You can separately revoke an integration in the provider's account settings.

Depending on your location and applicable law, you may also request access to, correction of, or a copy of your personal information, object to or restrict certain processing, or withdraw consent where processing relies on consent. Contact us using the details above. We will explain which rights apply and any verification or legal limitations.

9. Client-controlled information

When we process information on a client's instructions, the client may be responsible for deciding why and how it is used and for providing its own privacy notices. If your request concerns a business that uses our services, contacting that business directly may help. We will assist with requests relating to information we handle as appropriate to our role.

10. Children and international processing

Our website and Arroyo are intended for businesses and adult users, not children under 13. If you believe a child has provided personal information, contact us so we can review and remove it as appropriate. Our providers may process information in the United States and other countries, where privacy laws may differ from those in your location.

11. Updates and contact

We may update this policy as services or practices change. The effective date above identifies the current version. Where required, we will provide additional notice or obtain consent before materially different uses of connected-account information.

Southwest Media Services
Phoenix, Arizona
jhorton@swmediaservices.com
(480) 740-4331
Contact us