Privacy Policy

Sarthey uses data to create your timing outputs, keep the service reliable, and protect accounts.

• Provide core functionality: dashboards, signals, add-to-calendar actions, and data export.
• Security: step-up verification (OTP) during sign-in when risk signals are present.
• Operations: detect abuse, debug failures, and improve performance.

Sarthey uses service providers to run the product (for example: email delivery for security codes).

Sarthey does not sell personal data.

Data is kept while an account is active. Settings includes tools for exporting data and deleting the account.

Account deletion removes personal data from active systems within 30 days. The following records are retained as required by Indian law:

• Security and access logs: 180 days (IT Act 2000, CERT-In)
• Fraud prevention records: 3 years (Indian Limitation Act)
• Tax and billing records: 8 years (Income Tax Act, Section 149)
• Legal hold: retained as required by court order

Sarthey processes personal data on the following legal bases under GDPR Article 6:

• Contract performance (Art. 6(1)(b)): To provide the timing intelligence service, process payments, and maintain your account.
• Consent (Art. 6(1)(a)): For optional telemetry, marketing communications, and notifications. You may withdraw consent at any time in Settings.
• Legitimate interest (Art. 6(1)(f)): For fraud prevention, abuse detection, security monitoring, and service improvement.
• Legal obligation (Art. 6(1)(c)): For tax records retention and regulatory compliance.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access: Export the profile, consent history, usage counters, and recent activity currently included in Sarthey's self-service export. If you need additional records retained for legal or operational reasons, contact us.
• Right to rectification (Art. 16): Correct inaccurate data via your Profile in Settings or by contacting us.
• Right to erasure (Art. 17): Delete your account via Settings. Personal account data is removed from active systems. Financial records that must be retained for tax, fraud, or accounting reasons are kept in anonymised form.
• Right to restriction (Art. 18): Request that processing be restricted to storage only. Contact us to exercise this right.
• Right to data portability (Art. 20): Export the current self-service data package in machine-readable JSON via Settings.
• Right to object (Art. 21): Object to processing based on legitimate interest. Contact us to exercise this right.
• Right to withdraw consent: Withdraw optional in-product consents in Settings without affecting prior lawful processing. Analytics-cookie consent follows the cookie banner and your browser or site-data controls.

CCPA / CPRA (California): California residents may request details about collection and use, correction, deletion, and other applicable state-law rights. Sarthey does not sell or share personal data. To exercise these rights, use the self-service tools in Settings where available or contact support@sarthey.com. We will not discriminate against you for exercising any of these rights.

DPDPA (India): Indian data principals may request access, correction, and erasure of personal data, and may nominate another person to exercise rights where applicable. Contact us at support@sarthey.com.

LGPD (Brazil): Brazilian data subjects may request confirmation, access, correction, anonymisation, portability, deletion, and information about the public and private entities with which data is shared. Contact us at support@sarthey.com.

Sarthey works with the following categories of service providers to operate the product:

• Payment processing: Payments are handled by a PCI-DSS certified payment processor. Card and payment details are processed entirely by the payment provider and never stored on Sarthey servers.
• Email delivery: Transactional emails (verification codes, export delivery) via a third-party email provider.
• Error monitoring: An error tracking service is used to detect and fix issues. Personal data is excluded from error reports by default.
• Hosting: Cloud infrastructure within the United States.

Where personal data is transferred outside the European Economic Area (EEA), Sarthey relies on Standard Contractual Clauses (SCCs) approved by the European Commission or other appropriate safeguards as required by applicable law.

Sarthey generates timing signals using algorithmic processing of profile and date inputs. These outputs are informational and observational. They do not constitute advice, instructions, or decisions that produce legal or similarly significant effects. You are never obligated to act on any output.

• Self-service export scope: Current exports include the most recent 90 days of daily signals and action history.
• Generated export files: Download links expire after 24 hours.
• Payment records: Retained for 8 years as required by Indian tax law.
• Security and audit records: Retained for 180 days for security monitoring, up to 3 years for fraud prevention.

Sarthey stores a short-lived access token in browser localStorage, a secure refresh token in an HttpOnly cookie, and preferences like theme and consent choice in local storage. Analytics load only after consent. You can review the current storage list in the Cookie Policy.

If you believe your data protection rights have not been adequately addressed, you have the right to lodge a complaint with your local supervisory authority. In the EU, you can find your relevant authority at edpb.europa.eu.

For privacy questions, data requests, complaints, grievances, or legal notices, contact us at support@sarthey.com. All inquiries are logged and routed to the appropriate team.

If a jurisdiction requires named grievance or controller details, those details are published in the active legal document managed by Sarthey. If you are not satisfied with the response, you may escalate to the relevant regulatory authority in your jurisdiction.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice within the product. Continued use of Sarthey after changes constitutes acceptance. We encourage you to review this page periodically.