Saarthi Privacy Policy

1. Introduction

Saarthi ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

We understand that the information you entrust to Saarthi is highly personal and sensitive. This policy describes our practices regarding your data privacy and security.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password
• Family Information: Names, relationships, and contact details of family members
• Asset Information: Descriptions of assets, institutions, reference numbers, estimated values
• Beneficiary Information: Beneficiary assignments and share percentages
• Documents: Files and documents you upload related to assets
• Digital Signatures: Signature text and consent acknowledgments

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent on pages
• Device Information: IP address, browser type, operating system, device identifiers
• Cookies: Small data files stored on your device (see Cookie Policy below)
• Log Data: Server logs including timestamps and error reports

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide Services: To deliver, maintain, and improve Saarthi's core functionality
• Account Management: To create and manage your account, process payments, provide customer support
• Communication: To send service updates, security alerts, and support messages
• Personalization: To customize your experience and provide relevant features
• Security: To detect, prevent, and address fraud, security issues, and technical problems
• Analytics: To analyze usage patterns and improve our service (aggregated data only)
• Legal Compliance: To comply with legal obligations and enforce our Terms of Service

4. Data Security

We implement the following measures to protect your information:

• Encryption in transit and at rest: TLS for all traffic, AES-256 at rest
• Credential vault: Digital credentials (passwords, PINs, access notes) are encrypted with a per-record key derived via HKDF-SHA256 before they are written to the database. They are decrypted only through a server function bound to your account — Saarthi staff have no route to the plaintext
• Privacy tiers: Every asset and beneficiary record carries a private, semi-private or transparent tier that you control, deciding what each family member can see
• Access controls: Row-level security on every table; writes to core records go through server-side functions rather than the client
• Authentication: Hashed passwords, managed sessions, optional mobile OTP verification
• Monitoring: Continuous logging with personal data redacted from logs

5. Data Sharing and Disclosure

We do NOT sell your personal information to third parties. We may share your information only in the following limited circumstances:

• With Your Consent: When you explicitly authorize us to share information with family members or beneficiaries you invite
• Service Providers: With trusted third-party vendors who help us operate the service (hosting, email delivery, payment processing) under strict confidentiality agreements
• Legal Requirements: When required by law, legal process, or to protect rights, property, or safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred (you will be notified)

6. Cookie Policy

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for authentication, security, and basic functionality (cannot be disabled)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use the service to improve it
• Performance Cookies: Monitor performance and identify issues

You can control cookie preferences through your browser settings or our cookie consent banner. Note that disabling certain cookies may limit functionality.

7. Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Portability: Export your data in a machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to certain processing activities
• Withdraw Consent: Withdraw previously given consent

To exercise these rights, please contact us through your account settings or our support channels.

8. Data Retention

We retain your information for as long as necessary to provide services and comply with legal obligations:

• Active Accounts: Data retained while your account is active
• Deleted Accounts: Most data deleted within 30 days; some data retained for legal/security purposes for up to 7 years
• Backups: Backup copies may persist for up to 90 days after deletion

9. Children's Privacy

Saarthi is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will take steps to delete it.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top of this policy indicates when it was last revised.

12. Contact Us

For questions about this Privacy Policy, or to exercise your privacy rights, contact us at support@saarthi.me.