Privacy Policy

Aruna Labs, Inc. ("Aruna Labs," "Arka," "we," "our," or "us") operates the Arka data platform and related services ("Service"). We are committed to protecting your privacy and being transparent about how we collect, use, store, and protect your personal information.

By using the Service, you agree to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

We collect information you voluntarily provide, including:

• Name
• Email address
• Authentication details
• Workspace or project information
• Support messages or uploaded content

1.2 Information We Automatically Collect

We may collect:

• IP address, device and browser information
• Usage activity (pages viewed, features used, timestamps)
• Diagnostic, performance, and analytics data

1.3 Data You Upload or Connect

If you upload files (e.g., CSVs) or connect cloud systems, we process the data you submit or pull through authorized integrations.

We do not claim ownership of this data.

1.4 Information from Google OAuth

If you authenticate or connect via Google OAuth, we may receive:

• Google account email
• OAuth tokens scoped to your permission
• BigQuery access (read / job execution), if explicitly approved by you

We request the minimum necessary scopes and only access Google data for the specific functionality you authorize.

You see exactly what scopes we request on the Google OAuth consent screen.

2. How We Use Your Information

We use personal information to:

• Operate and deliver the Arka platform
• Authenticate users and maintain secure sessions
• Connect to your authorized data sources
• Execute queries or tasks you initiate
• Improve product performance and reliability
• Communicate with you about updates or support
• Comply with legal and security obligations

Use of Google API Data (Google OAuth Compliance)

We use Google API data only for the specific functionality you approve, such as:

• Reading tables from BigQuery
• Running BigQuery jobs

We do not:

• Sell Google data
• Share Google data except as required to fulfill your request
• Use Google data for advertising
• Store Google data beyond what is necessary for the Service

Our access follows the Google API Services User Data Policy, including the Limited Use requirements.

3. Cookies & Tracking Technologies

We use cookies and tracking technologies to:

• Maintain sessions and authentication
• Analyze usage patterns
• Improve product experience

You may disable cookies, but some features may not function properly.

4. How We Share Information

We do not sell your personal data.

We may share personal information with:

• Service providers and subprocessors (listed below)
• Regulators or law enforcement when legally required
• Another organization in connection with a merger, acquisition, or restructuring

All subprocessors are contractually required to protect personal information and follow applicable regulations.

5. Service Providers and Subprocessors

We work with third-party subprocessors to deliver authentication, hosting, analytics, communication, and AI functionality.

Our current subprocessors include:

Authentication

• Google OAuth
• GitHub OAuth
• Okta

Infrastructure & Hosting

• Vercel — application hosting and compute
• NeonDB — managed PostgreSQL database
• Vercel Blob Storage — file storage for user-uploaded data such as CSVs
• GitHub — source code hosting (no customer data stored)

Analytics

• Mixpanel

Email Delivery

• Resend

Workspace & Productivity

• Google Workspace

AI Processing Providers

• OpenAI
• Anthropic (Claude models)

Domain Services

• Namecheap

A complete and up-to-date subprocessors list is available at: https://www.arka.so/subprocessors

6. Your Rights and Choices

6.1 Access, Correction, and Deletion

You may request:

• A copy of the personal data we hold
• Correction of inaccurate information
• Deletion of your personal data

6.2 Consent Withdrawal

If processing is based on consent, you may withdraw it at any time.

6.3 CCPA (California Residents)

You may:

• Request details on how your data is used
• Opt out of data sharing
• Request deletion
• Appeal a denied request

6.4 Google OAuth Permissions

You can revoke Arka's access to your Google account at: https://myaccount.google.com/permissions

7. Legal Bases for Processing (GDPR)

Where GDPR applies, we process personal data based on:

• Contractual necessity (providing the Service)
• Legitimate interest (improving security and product functionality)
• Consent (Google OAuth integrations, certain analytics)

8. Data Retention

We retain personal data only for as long as needed to:

• Provide the Service
• Fulfill legal obligations
• Resolve disputes

User-uploaded data, logs, and analytics may have specific retention periods.

9. International Data Transfers

We may store or process information outside your region (e.g., U.S. or EU datacenters). We implement:

• Encryption
• Access controls
• Vendor DPAs and contractual safeguards

10. Security

We use industry-standard security controls, including:

• Encryption in transit and at rest
• Role-based access controls
• Secure development and monitoring practices
• Regular security reviews

11. Children's Privacy

We do not knowingly collect personal information from individuals under 16 years old. If such data is identified, we delete it promptly.

12. Policy Updates

We may update this Privacy Policy periodically to reflect:

• Product changes
• Legal or regulatory updates
• New subprocessors or integrations

The "Last updated" date will always reflect the current version.