Privacy Policy

1. Introduction

ERARTA ("the Company," "we," "us," or "our") operates the Hermes platform at hermes.erarta.ai. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Platform. We are committed to protecting your privacy and handling your data transparently.

Mobile App (Hermes Broker)

The Hermes Broker app for iOS and Android uses the same account and the same data as the web platform. On the device we store the sign-in session and your display preferences (language, theme). If you allow notifications, we store a push token for your device. The app does not use advertising identifiers, does not track you across other companies' apps or websites, and does not read your contacts, photos or location.

You can delete your account and personal data inside the app (Menu → Delete account) or on hermes.erarta.ai/delete-account. Deleting the account removes your profile, sign-in, chat history and push tokens. Data that belongs to an organization (clients, reports) stays with the organization. Billing records are kept as required by law.

2. Data We Collect

2.1 Account Information

When you register, we collect your email address, name, and organization details. Authentication is managed through Supabase Auth, which may store session tokens and authentication metadata.

2.2 Chat Messages and AI Interactions

We store your chat messages, AI responses, and conversation history to provide the service, improve AI performance, and enable you to access your conversation history. Chat data is associated with your account and tenant.

2.3 Usage Analytics

We collect usage data through the following services:

• Google Analytics 4 (Measurement ID: G-248LWV1H1G) — tracks page views, user sessions, and key events such as sign-ups, logins, chat queries, and plan upgrades
• PostHog — tracks product usage events including chat messages sent, tools used, and feature engagement

2.4 Billing Information

Payment information is collected and processed directly by Stripe. We do not store your full credit card number, CVV, or other sensitive payment details on our servers. We receive and store transaction identifiers, subscription status, and billing history from Stripe.

2.5 Technical Data

We automatically collect IP addresses, browser type, device information, operating system, referral URLs, and access timestamps through server logs and analytics services.

3. How We Use Your Data

• To provide, maintain, and improve the Hermes platform
• To process your subscription and manage billing through Stripe
• To personalize your experience and deliver relevant AI responses
• To send service-related communications and updates
• To monitor usage patterns and optimize platform performance
• To detect, prevent, and address security issues and abuse
• To comply with legal obligations

4. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential cookies — authentication tokens, session management, and security
• Analytics cookies — Google Analytics and PostHog cookies to understand usage patterns
• Preference cookies — theme settings and UI preferences

You can control cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality.

5. Third-Party Services

We use the following third-party services that may process your data:

• Supabase — database hosting and authentication (servers in AWS Asia-Pacific and Korea regions)
• Stripe — payment processing (PCI DSS Level 1 compliant)
• Vercel — web application hosting and edge delivery
• Amazon Web Services (AWS) — infrastructure, data storage, and API hosting (US East region)
• Google Analytics — usage analytics
• PostHog — product analytics
• Anthropic / OpenAI — AI model providers for chat functionality

Each third-party service operates under its own privacy policy. We encourage you to review their policies.

6. Data Retention

We retain your account data and chat history for as long as your account is active. Upon account deletion, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., billing records). Anonymized and aggregated analytics data may be retained indefinitely.

7. Your Rights

Regardless of your location, we extend the following rights to all users:

• Right of Access — you may request a copy of all personal data we hold about you
• Right to Rectification — you may request correction of inaccurate personal data
• Right to Deletion — you may request deletion of your account and associated data
• Right to Data Portability — you may request your data in a structured, machine-readable format
• Right to Object — you may object to processing of your data for analytics purposes
• Right to Restrict Processing — you may request that we limit how your data is processed

To exercise any of these rights, contact us at privacy@erarta.ai. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS 1.2+), encryption at rest, access controls, and regular security reviews. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

9. International Data Transfers

Your data may be processed in multiple regions including the United States, Asia-Pacific, and the Middle East. We ensure that appropriate safeguards are in place for international data transfers, including the use of industry-standard infrastructure providers with robust data protection practices.

10. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at privacy@erarta.ai.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and updating the "Last updated" date. Your continued use of the Platform after changes constitutes acceptance of the revised policy.

12. Contact Information

For questions or concerns about this Privacy Policy or our data practices, please contact us at:

ERARTA — Data Protection
Email: privacy@erarta.ai
Website: hermes.erarta.ai