Privacy Policy
This Privacy Policy explains how ArdaBot, Inc., a Delaware corporation (“ArdaBot,” “we,” “us”), collects, uses, and shares information when you use Arda (the “Service”). By using the Service, you agree to this Policy. It should be read together with our Terms of Use.
1. Information we collect
- Account information. When you sign up, our authentication provider processes your email address, name, and login credentials on our behalf. We store your handle, display name, and profile settings.
- Payment information. Subscriptions and invoice payments are processed by Stripe. We do not see or store full card numbers; we retain customer, subscription, and payment identifiers and billing status to manage your plan and to record invoice payments. If you enable payouts, the identity, bank, and tax information required for onboarding is collected by Stripe directly under its own privacy policy — we store only your Stripe account identifier and onboarding status.
- Client & invoicing information. Artists may add their clients to the Service — names, email addresses, and project or invoice details such as line items, amounts, due dates, payment status, and comments. We process this information on the artist’s behalf to deliver project access, invoices, payment receipts, and reminders. If you are an artist, you are responsible for having the right to share your clients’ contact details with us.
- Your content. The images and collection details you upload, including any metadata embedded in your files (for example, EXIF data such as camera settings, date, and — if present — GPS location). Embedded metadata may be displayed alongside your work; you control what you upload.
- Usage & device data. Logs, IP address, browser type, pages viewed, and similar diagnostic data, used to operate, secure, and improve the Service.
2. How we use information
- to provide, maintain, and improve the Service;
- to process payments and manage subscriptions;
- to secure the Service, prevent abuse, and enforce our Terms;
- to communicate with you about your account and service updates; and
- to comply with legal obligations.
3. Cookies & similar technologies
We use strictly necessary cookies for authentication and security (for example, to keep you signed in and to remember client project access). We do not use these cookies for advertising. Where required by law, we will obtain consent before setting any non-essential cookies.
4. Service providers & sharing
We do not sell your personal information. We share it only with vendors that process data on our behalf to run the Service, under contractual protections:
- authentication and identity management;
- Stripe (subscription billing, invoice payments, and payouts to artists via Stripe Connect);
- cloud storage and content delivery for your images;
- transactional email delivery (invites, invoices, and reminders);
- hosting, database, queueing, and error-monitoring providers.
We may also disclose information if required by law or to protect the rights, safety, and security of ArdaBot, our users, or the public.
5. Public content
Content you set to public is visible to anyone and may be indexed by search engines. Unlisted content is reachable only via a share link. Client projects can be shared with specific client emails and may include comments or downloads, depending on the artist’s settings. Invoices are reachable by anyone with their unique payment link; treat that link as confidential.
6. Data retention
We retain your information for as long as your account is active and as needed to provide the Service. When you delete content or your account, we delete or anonymize the associated data within a reasonable period, except where we must retain it to comply with legal, tax, or accounting obligations or to resolve disputes.
7. Your rights
Depending on where you live (including under the EU/UK GDPR and the CCPA/CPRA), you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can delete your account to remove your content, or contact us to exercise these rights. We will not discriminate against you for exercising them.
8. International transfers
We operate in the United States and may process information in the U.S. and other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.
9. Security
We use reasonable technical and organizational measures to protect your information, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, and you are responsible for keeping your own backups of your work.
10. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.
11. Changes to this Policy
We may update this Policy from time to time. We will revise the effective date above and, for material changes, provide additional notice where appropriate.
12. Contact
For privacy questions or to exercise your rights, contact ArdaBot, Inc. at support@ardabot.ai.