Privacy Policy

Arizal (“we”, “us”, or “our”) is operated by Arizal from India. This Privacy Policy explains how we handle personal data when you use our websites, apps, APIs, and MCP connections.

Privacy, data-rights, and Grievance Officer (India DPDP Act) requests: support@arizal.app.

This policy is a practical disclosure based on how the product works today. It is not a substitute for formal legal advice. Entity name and postal address will be updated when your registered business details are finalized.

Arizal is a personal productivity and life-planning service (tasks, goals, habits, calendar planning, reflections, and optional integrations). It is not a medical device and does not provide medical, mental-health, or financial advice.

Depending on how you use the service, we may process:

• Account data: name, email address, password (stored as a secure hash), timezone, and preferences.
• Workspace content you create: tasks, goals, habits, life areas, collections, reflections, inbox captures, notes, and related metadata.
• Usage and technical data: IP address, device/browser information, approximate logs needed for security, rate limiting, and debugging.
• Optional analytics data, only after consent: page path, product interaction events, device/browser details, and approximate location derived by Google Analytics. We do not intentionally send task content, health data, or other workspace content.
• Authentication session data: access tokens (short-lived) and refresh tokens (httpOnly cookies).
• API / MCP credentials: API key prefixes and hashed secrets; OAuth client metadata and consented scopes when you connect assistants.
• Payment and billing data: processed by Razorpay (we do not store full card numbers). Razorpay may receive name, email, payment method, and billing details needed to charge your subscription.
• Integration data you connect: Google Calendar events and WHOOP metrics you authorize us to sync.

• Directly from you when you register, update your profile, or create content.
• Automatically through cookies, local storage, and server logs required to run the product.
• Through Google Tag Manager / Google Analytics only when you enable Analytics in Cookie settings.
• From third-party services when you connect integrations (Google Calendar, WHOOP) or use payment checkout (Razorpay).
• From Unsplash when you search or select photos for goals or vision boards (search queries and selected image URLs).
• From API keys or MCP OAuth clients you authorize to access your workspaces within the scopes you grant.

We use personal data to:

• Provide and maintain the service (contract / performance of a contract).
• Authenticate you, secure accounts, prevent abuse, and enforce rate limits (legitimate interests / security).
• Process subscriptions and invoices via Razorpay (contract).
• Sync optional integrations you connect (consent / contract).
• Respond to support and privacy requests (legal obligation / legitimate interests).
• Improve reliability and product quality using aggregated or de-identified signals where possible (legitimate interests).
• Measure product usage through optional Google Analytics when you consent (consent).

Under India’s Digital Personal Data Protection Act, 2023 (DPDP), we process personal data for lawful purposes with notice as described here, and for purposes you reasonably expect when using the service.

We do not sell your personal data. We share data with service providers who help us operate Arizal, only as needed for their role. See our Sub-processors page for the current list.

• Hosting and database providers that store application data.
• Razorpay for payments, billing, fraud prevention, and related processing.
• Google for optional consented analytics, and Google Calendar / WHOOP when you connect those integrations.
• Professional advisors or authorities when required by law.

We use Razorpay for payment processing and subscription billing. Razorpay may collect personal data needed to process payments, prevent fraud, and operate its services. Learn more at https://razorpay.com/privacy/.

Billing terms, cancellation, and refunds are described in our Subscription & Refund Policy. Current Pro pricing: ₹299/month or ₹2388/year (subject to the checkout screen).

We operate from India. Your data may be processed in other countries by sub-processors (for example Razorpay, Google, or hosting providers). Where required, we rely on appropriate safeguards such as contractual protections with providers. By using Arizal, you understand that processing may occur outside your home country.

• Account and workspace data: kept while your account is active.
• Items you move to Trash: retained for about 30 days, then permanently purged by our automated process.
• Security and operational logs: kept for a limited period needed for security, abuse prevention, and troubleshooting.
• Billing records: retained as needed for tax, accounting, and dispute resolution (often via Razorpay).
• After account deletion: we delete or anonymize personal data within a reasonable period, except where we must retain limited records by law.

We use industry-standard measures appropriate to the sensitivity of the data, including:

• Passwords hashed with bcrypt (never stored in plain text).
• Third-party OAuth tokens encrypted at rest (AES-256-GCM).
• Scoped API keys stored as hashes; secrets shown only once at creation.
• HTTPS in production, rate limiting, and workspace-scoped access controls.

No method of transmission or storage is 100% secure. Please use a strong unique password and protect your API keys.

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to certain processing, and to withdraw consent for optional integrations. You can:

• Email support@arizal.app with the subject “Privacy request” and specify access, correction, deletion, or export.
• Use in-app account tools when available (profile updates; data export and account deletion as we ship them).
• Disconnect integrations from Settings → Integrations.
• Revoke API keys and deny MCP OAuth access from Settings → API & MCP.

We will respond within a reasonable period (typically within 30 days where GDPR-style timelines apply, or as required under applicable Indian law).

If you are in India, you are a “Data Principal” under the Digital Personal Data Protection Act, 2023. You may contact our Grievance Officer at support@arizal.app for complaints about personal data processing. We will acknowledge and work to resolve grievances as required by applicable rules.

If you are a California resident, you may have rights to know, delete, correct, and opt out of sale/sharing of personal information. We do not sell personal information for money. We do not use advertising trackers that sell or share data for cross-context behavioral advertising in the current product. To exercise rights, email the privacy address above.

Arizal is not directed to children under 16. If you believe a child has provided personal data, contact support@arizal.app and we will take appropriate steps to delete it.

We may update this policy from time to time. The “Last updated” date at the top of the page will change when we do. Material changes may also be communicated in-product or by email when appropriate. Continued use after the effective date means you accept the updated policy.

Last updated: 19 July 2026.