Aretia Labs

Privacy policy

Last updated 12 October 2026

This is a draft and is being reviewed before launch.

1. Who we are

Aretia Labs ({{FOUNDER: legal entity type and registration number}}, {{FOUNDER: registered address}}) makes software products, including Project.Hermes. Aretia Labs is the controller of the personal data described here.

This policy explains what we collect, why, who sees it, how long we keep it and the choices you have.

2. What this policy covers

This policy covers two things: this website, and the Aretia Labs account, the single sign-in you use across our products.

Each product may add its own notice for the data that is specific to it, such as the content you create inside it. Where a product notice and this policy overlap on the account, this policy applies to the account.

3. What this website collects

This website has no accounts, no forms, no advertising and no analytics, and it sets no cookies.

  • Theme choice: if you switch between light and dark, your choice is saved as aretia-theme in your browser’s local storage. It stays on your device and is never sent to us.
  • Email: if you write to us, we receive your address and what you send, and use it only to reply.
  • Hosting logs: our hosting provider records technical details of each request, described under Hosting and logs below.

4. The Aretia Labs account

When you create an Aretia Labs account we hold:

  • Your details: your email address and, if you give it, your name. Your password is stored only as a secure hash.
  • Authentication data: your credentials, sign-in sessions (including the IP address and user agent of the device you signed in from) and security events such as sign-ins and password resets.
  • Account records: when the account was created and last changed. {{FOUNDER: confirm account data fields}}

We use this to sign you in once across our products and to keep the account secure. The same account is recognised by each product you use it with, and each product receives only what it needs to know who you are.

5. Why we use it, and our legal basis

  • To create your account, sign you in and send the emails you need, such as verification and password reset. Basis: performing our contract with you (GDPR Article 6(1)(b)).
  • To keep the service secure, prevent abuse and fix errors. Basis: our legitimate interests (Article 6(1)(f)).
  • To meet legal duties, such as tax and accounting rules, and lawful requests. Basis: legal obligation (Article 6(1)(c)).

We don’t sell your data, and we don’t use it for advertising.

6. Hosting and logs

This website is hosted on Amazon Web Services. Like any host, it may record the IP address, time, requested page, browser and response of each request, to keep the site secure and working. {{FOUNDER: access logging on or off, and log retention period}}

7. Who we share it with

We share data only with providers that help us run the service, and only as much as they need to do that job.

  • Hosting: Amazon Web Services.
  • Transactional email (account verification, password reset): {{FOUNDER: transactional email provider}}.

We may also share data where the law requires it, or to protect people’s safety. Products you use with your account are covered by their own notices.

8. International transfers

We process data in {{FOUNDER: processing regions}}, so your data may be transferred outside the EEA, the UK and India. Where the law requires it, we rely on safeguards such as an adequacy decision or the Standard Contractual Clauses (and the UK equivalent) with our providers.

9. How long we keep it

  • Account data: kept while the account exists. If you ask us to delete the account, we delete it, except for records we must keep by law.
  • Backups: {{FOUNDER: backup retention}}. Deleted data leaves backups when they expire.
  • Hosting logs: as set out under Hosting and logs.
  • Emails to us: as long as needed to deal with your message and any follow-up.

10. Your rights

Depending on where you live, you can ask to access, correct, delete or move your data, restrict or object to how we use it, and withdraw consent. To use any of these rights, write to {{FOUNDER: privacy email}}. We’ll reply within the time the law sets, usually one month. If you’re unhappy with our answer, you can complain to your local data protection authority.

  • EU and UK (GDPR): the rights above, including the right to object to processing based on our legitimate interests.
  • India (Digital Personal Data Protection Act, 2023): the right to access information about your data, to have it corrected, completed or updated, to have it erased, to seek grievance redressal, and to nominate someone to exercise your rights if you die or can’t act. Grievance officer: {{FOUNDER: grievance officer name and email}}.
  • California (CCPA/CPRA): the right to know what we collect, to delete it, to correct it, and to opt out of the sale or sharing of personal information. We don’t sell or share personal information, and we won’t treat you worse for using your rights.

11. Children

Our products and the Aretia Labs account aren’t meant for anyone under {{FOUNDER: minimum age, suggested 16}}, and we don’t knowingly collect their data. If you think a child has given us data, write to us and we’ll delete it.

12. Security

Data is encrypted in transit, and passwords are stored only as a secure hash. Access to production systems is limited to the people who need it. No system is perfectly secure; if a breach affects your data we’ll tell you, and the regulators, as the law requires.

13. Changes

If we change this policy we’ll update the date above, and tell you by email or in the products you use when a change is significant. For the rules that apply to the service itself, see the terms.

14. Contact

Questions or requests about your data? Write to {{FOUNDER: privacy email}}, or to support@aretialabs.com for anything else. Grievance officer (India): {{FOUNDER: grievance officer name and email}}.

Back to top