Privacy Policy

This Privacy Policy explains how Platform China (HK) Art Limited ("Artara", "we", "us", or "our") collects, uses, and protects your personal data when you use artara.ai and related websites, emails, and services (the "Service"). We are the data controller for the personal data described in this policy.

1. Information We Collect

• Account information: your email address, your name, and your password if you set one. Passwords are stored in hashed form by our authentication provider.
• Profile details you provide: date and time of birth, gender, place of birth, current city, and time zone. We use these details to create your Five Elements profile and personalised content.
• Content and preferences: artworks you save, feedback you send us (for example, how you feel on a given day), and your language and display preferences.
• Payment information: payments are processed by Stripe, our reseller and Merchant of Record. We never receive or store your full card number. We receive limited information such as your plan, subscription status, and billing country.
• Usage data: pages you visit, your device and browser type, approximate location derived from your IP address, and whether you open our emails. We collect this through analytics tools and server logs.

2. How We Use Your Information

• To create and manage your account and provide the Service, including daily reflections, curated artworks, and reports.
• To send service emails, such as sign-in links, daily reflection emails, trial reminders, and billing notices.
• To process subscriptions and purchases, and to handle refunds and support requests.
• To understand how the Service is used and improve it.
• To keep the Service secure, prevent fraud and abuse, and comply with legal obligations.

We do not use your personal data to make automated decisions that have legal or similarly significant effects on you.

3. Legal Bases (EEA and UK Users)

We process your personal data on the following legal bases:

• Contract: to provide the Service you signed up for.
• Legitimate interests: to secure, analyse, and improve the Service.
• Consent: for marketing emails and, where required, non-essential cookies. You can withdraw your consent at any time.
• Legal obligation: for example, to keep transaction records for tax purposes.

4. How We Share Your Information

We do not sell your personal information. We share it only with service providers that help us run the Service. They may use it only to provide their services to us, and they are contractually required to protect it:

• Supabase: database, sign-in, and file storage
• Vercel: website hosting
• Resend: email delivery
• PostHog: product analytics
• Stripe (Link): payments, sales tax, billing, receipts, and payment support, as our Merchant of Record. Stripe provides this service under its Link brand, and its own privacy policy applies to the payment information you give it at checkout
• Alibaba Cloud Mail: receiving and answering customer support emails
• AI service providers: generating personalised text for some content. We send only the information needed to generate that content.

We may also disclose information when required by law, to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of assets.

5. International Transfers

Our service providers may process your data in the United States, the European Union, mainland China (customer support emails), and other countries. Where required by law, we rely on appropriate safeguards, such as Standard Contractual Clauses, for these transfers.

6. Cookies and Similar Technologies

We use:

• essential cookies to keep you signed in and keep the Service secure;
• local storage to remember preferences such as theme and language;
• analytics cookies (PostHog) to understand how the Service is used.

You can control or delete cookies through your browser settings. If you block essential cookies, some parts of the Service may not work.

7. Data Retention

We keep your personal data for as long as your account is active, or for as long as we need it for the purposes described in this policy. If you ask us to delete your account, we will delete or anonymise your personal data within 30 days. The only exception is information we must keep to meet legal, tax, or accounting obligations, such as transaction records.

8. Your Rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• delete your data;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw your consent at any time.

EEA and UK users may also complain to their local data protection authority. California residents have the right to know, delete, and correct their personal information, and will not be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising. Hong Kong users have the right to access and correct their personal data under the Personal Data (Privacy) Ordinance.

To exercise any of these rights, email support@artara.ai. You can unsubscribe from marketing emails at any time by using the link in any email.

9. Security

We use industry-standard measures to protect your data. Data is encrypted in transit (HTTPS) and at rest by our infrastructure providers, and access is restricted to authorised personnel. No method of transmission or storage is completely secure, but we work to protect your information.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the Service before they take effect.

12. Contact Us

Email: support@artara.ai