Privacy Policy

1. Roles

This Privacy Policy explains how Arya Labs, Inc. (“Arya Labs,” “Samva,” “we,” “us,” or “our”) handles personal information relating to Samva websites, dashboards, APIs, email Services, and related communications.

Arya Labs is generally a controller for account, identity, billing, website, security, abuse-prevention, service-improvement, and direct-support information.

When a customer submits contacts, message content, templates, events, or related recipient information to use the Services, the customer generally determines the purposes and means of processing and Arya Labs acts as a processor or service provider. The customer is responsible for providing notices, obtaining permissions, responding to recipient requests, and giving lawful instructions. The Data Processing Addendum governs that processing.

2. Information We Collect

We may collect:

• account names, email addresses, organization details, authentication records, and support communications;
• billing, subscription, invoice, tax, payment-status, and usage information; payment-card details are handled by payment providers rather than stored by Samva as the card number;
• domains, sender identities, API keys, contacts, templates, message content, attachments, campaigns, and other Customer Content;
• delivery, bounce, complaint, unsubscribe, suppression, open, click, timestamp, IP-address, user-agent, clicked-URL, and provider-webhook information;
• security, authentication, audit, quota, abuse, reputation, and operational telemetry;
• website, device, browser, cookie, analytics, and session-replay information as described in the Cookie and Analytics Notice; and
• information provided when you contact us, request support, report abuse, or exercise a privacy right.

Do not submit payment-card data, protected health information, special-category personal data, children’s data, or other regulated data through the Services unless Arya Labs has approved that use in a separate written agreement.

3. How We Use Information

We use information to:

• provide, authenticate, maintain, and support the Services;
• process messages and delivery events;
• manage billing, limits, subscriptions, and invoices;
• operate unsubscribe, suppression, bounce, complaint, and anti-abuse controls;
• secure accounts, investigate misuse, and protect recipients and infrastructure;
• communicate about accounts, changes, incidents, support, and product operations;
• measure and improve the Services, including analytics and session replay where permitted and configured;
• comply with law, respond to lawful requests, resolve disputes, and enforce agreements; and
• create aggregated or de-identified information that does not reasonably identify a person.

4. Engagement Tracking

Samva may process email opens and clicks, including timestamps, IP addresses, user agents, clicked URLs, and link metadata, when engagement tracking is enabled for the relevant message or organization. Tracking may be enabled by default in some contexts and will be disabled or require consent where applicable law requires prior consent.

Customers are responsible for providing recipients with required notices and obtaining required permissions. A recipient’s engagement preference is separate from an unsubscribe or suppression record. Suppression data may be retained to prevent future contact even after other data is deleted.

5. Cookies, Analytics, and Session Replay

Essential cookies and similar technologies support authentication, security, routing, preferences, and core functionality. Non-essential analytics and session-replay technologies are governed by the Cookie and Analytics Notice.

Where applicable law requires consent, we will request and record consent before enabling non-essential technologies. Withdrawing consent does not affect processing already completed and may not disable essential functionality.

6. Sharing

We may share information with:

• infrastructure and service providers that process information for us, including AWS, Cloudflare, PlanetScale, Upstash, Autumn, Stripe, Axiom, PostHog, and Cloudflare Turnstile;
• customer-authorized recipients, providers, or integrations necessary to deliver a customer’s messages;
• professional advisers, auditors, insurers, financing parties, and transaction counterparties subject to appropriate confidentiality;
• authorities, courts, or other parties when required by law or necessary to protect rights, safety, the Services, or recipients; and
• a successor in a merger, acquisition, financing, reorganization, or sale of assets.

Our current subprocessor list and notice process are available at /legal/subprocessors.

7. International Processing

Samva uses providers and infrastructure that may process information in the United States and other countries. Provider location and transfer mechanisms vary by service. Where data-protection law requires a transfer safeguard, Arya Labs will use an applicable lawful mechanism, such as an adequacy decision, contractual safeguard, or other legally recognized measure.

8. Retention and Deletion

We do not promise one uniform retention period for all information. Retention varies by data type, operational purpose, customer configuration, legal obligation, security need, billing requirement, backup lifecycle, and provider behavior.

You may request account deletion through available controls or by contacting us. Workspace deletion may not immediately remove every copy and may not remove data that must remain for billing, legal compliance, security, abuse prevention, audit, backups, or suppression. Suppression data may be retained specifically to prevent re-contact.

Customers must handle deletion and correction requests for recipient data and may ask Samva for reasonable assistance where technically available.

9. Security

We use technical and organizational measures appropriate to the nature of the information and the Services. These include encryption in transit, access controls, tenant isolation, credential protection, key-management controls, logging, operational monitoring, and provider security controls. No system or transmission is completely secure, and we do not promise that unauthorized access will never occur.

If we determine that a security incident requires notice, we will provide prompt notice through an appropriate channel, subject to law, investigation, security, and provider constraints.

10. Rights and Requests

Depending on location and applicable law, individuals may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, and to withdraw consent.

For account and website information, contact privacy@samva.dev. For recipient and Customer Content held on behalf of a customer, contact the relevant customer first. We will assist customers with legally required requests where appropriate and technically possible. We may verify identity and authority before responding.

11. Children

The Services are not directed to children. Do not use Samva to collect or process children’s data without a separate written agreement and all required protections.

12. Changes

We may update this Policy by posting a new version and effective date. For material changes, we will provide reasonable notice through the Services or email where required.

13. Contact

Privacy requests: privacy@samva.dev

Legal notices: legal@samva.dev

Arya Labs, Inc.
1111B S Governors Ave #29161
Dover, DE 19904