Privacy Policy

Version 2026-06-26 · Effective 2026-06-26

This Privacy Policy describes how Artha Labs, Inc. (“Artha,” “we”) collects, uses, and shares information about you when you use arthalabs.co or our mobile applications (the “Service”).

1. Information we collect

1.1 You give us

• Account info: your email address, chosen handle, and (optionally) display name, bio, and avatar.
• Trader configuration: the tickers, asset classes, and pricing rules you choose to share.
• Communications: messages you send to support.

1.2 We collect automatically

• Device and log data: IP address, browser type, operating system, pages visited, referrer, and timestamps.
• Push tokens: if you use our mobile app, the per-device token we need to deliver push notifications.

1.3 We collect from third parties

• Brokerage data (via SnapTrade): when you connect a brokerage, SnapTrade provides us your account ID, balances, positions, orders, and transaction history. SnapTrade authenticates you directly with your broker; Artha never sees your broker login credentials.
• Payment data (via Stripe): when you subscribe to a Pro tier or onboard as a trader, Stripe processes your card or bank information directly. Artha receives a customer or Connect account identifier and metadata about subscription status — never your full card number.

2. How we use information

• To operate and maintain the Service.
• To detect a trader’s trades and fan them out to subscribers (notifications, copy-trade execution).
• To process payments, calculate platform fees, and remit earnings to traders.
• To prevent fraud and abuse and to enforce our Terms of Service.
• To send transactional emails (sign-in links, trade alerts).
• To comply with legal obligations (tax reporting, court orders).

We do not sell your personal information. We do not use your information to train AI models. We do not display third-party advertising on the Service.

3. Who we share information with

We share the minimum information necessary with the following sub-processors, each under contractual confidentiality and security obligations:

• Supabase — authentication, database, and realtime updates.
• SnapTrade — brokerage connectivity and trade execution.
• Stripe — payment processing and Stripe Connect payouts to traders.
• Inngest — background job orchestration (fan-out, retries).
• Resend — transactional email delivery.
• Expo — mobile push-notification delivery.
• Vercel — application hosting and CDN.

We may also share information (a) with law enforcement when legally compelled or where we believe disclosure is necessary to protect rights, property, or safety; (b) with professional advisors under confidentiality; and (c) in connection with a merger, acquisition, or sale of assets, in which case the acquirer will be bound by this Policy or a successor with comparable protections.

4. Data retention

We retain your account information for as long as your account is active. When you delete your account, we delete your profile and secrets within 30 days, but retain transactional, tax, and compliance-related records (e.g., subscription payment records, trade history that is the subject of a Stripe Connect payout) for the period required by applicable law — typically seven years for U.S. financial records.

5. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information (subject to the retention exceptions above);
• Object to or restrict certain processing;
• Receive a portable copy of your information;
• Withdraw consent (where processing is based on consent) without affecting the lawfulness of prior processing;
• Lodge a complaint with a supervisory authority (EU/UK residents).

To exercise any of these rights, email privacy@arthalabs.co. We respond within 30 days.

6. California residents (CCPA / CPRA)

California residents have the rights described in Section 5 and may also designate an authorized agent to make requests on their behalf. We do not sell or share personal information for cross-context behavioral advertising. We do not process sensitive personal information for purposes that would require an opt-out.

7. International transfers

Artha’s servers and most sub-processors are located in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data-protection laws than your jurisdiction. Where required, we rely on Standard Contractual Clauses for cross-border transfers.

8. Children

Artha is not directed at children under 18 and we do not knowingly collect personal information from children. If you believe we have, please contact us so we can delete it.

9. Security

We implement industry-standard administrative, technical, and physical safeguards designed to protect your information, including encryption in transit (TLS) and at rest, narrowly-scoped service-role database access, and signed webhook payloads. No system is perfectly secure; you use the Service at your own risk.

10. Cookies and similar technologies

We use first-party cookies that are strictly necessary for authentication (session cookies set by Supabase Auth). We do not use advertising cookies. If we add analytics in the future, we will update this Policy and provide an opt-out where required by law.

11. Changes to this Policy

We may update this Policy by changing the version date and posting the revised text. Material changes will be notified by email or in-app banner.

12. Contact

Privacy questions: privacy@arthalabs.co. Postal: Artha Labs, Inc., Attn: Privacy, 2261 Market St #4775, San Francisco, CA 94114.