Privacy Policy

Last updated April 29, 2026

Short version

ara.so is a service operated by Ara Software, Inc., a Delaware corporation with its principal place of business in San Francisco, California. We receive your text messages, generate sites in response, and deploy them. We do not sell your data. We do not train models on your messages. You can delete your sites and account at any time by texting delete account to the service number.

What we collect

  • Your phone number, used to identify and reply to you.
  • The contents of your messages, used to generate sites.
  • The sites you generate and any metadata about them.
  • Standard server logs (IP, user-agent, timestamps) for abuse prevention.
  • Carrier-level metadata required to deliver SMS replies.

How we use it

We use this information to operate the service: to read your request, generate the site you asked for, deploy it, send replies, and prevent abuse. We do not sell or rent personal data to third parties.

Subprocessors

We rely on a small set of subprocessors to deliver the service: Twilio (SMS), Vercel (hosting), Supabase (database), Anthropic and OpenAI (model providers), and Stripe (billing for paid plans, plus Connect for the seller program). Each subprocessor is bound by a data processing agreement.

Seller program (payments)

If you ask the agent to set up payments and accept the Seller Agreement at ara.so/sell/agree, we record evidentiary metadata to create a tamper-evident acceptance log. This is in addition to the data described in “What we collect” above:

  • Timestamps for when you opened the agreement page and when you tapped “I agree”.
  • Your IP address at the moment of acceptance and an approximate geolocation derived from it (country, region, and city, when available).
  • Your browser’s user-agent string and the page referrer.
  • A snapshot of the phone number on file with us, plus the identifier of the chat thread the consent link was sent in.
  • The version of the Seller Agreement you accepted.
  • The product or sale intent described to the agent at the moment we sent you the consent link (e.g. “sell hats for $1”).

We retain this consent record for as long as we operate the seller program and for as long as reasonably necessary thereafter (books and records). Stripe collects KYC and payout information directly during its own onboarding form; that data is governed by Stripe’s privacy policy, not ours.

California residents (CCPA / CPRA)

In the past twelve months we have collected the following categories of personal information from California residents who use the service:

  • Identifiers — phone number, account identifier, IP address.
  • Internet or other electronic network activity — user-agent, referrer, timestamps, server logs.
  • Geolocation data — coarse location (country / region / city) derived from IP at the moment you accept the Seller Agreement.
  • Commercial information — subscription status and, for sellers, the products or sale intents you describe to the agent.
  • Customer records — the contents of your messages and the sites you ask us to generate.

We collect this information from you directly (your messages and taps) and, where applicable, from your device and network (IP, user-agent, geolocation). We use it to operate the service as described in “How we use it”. We do not sell or share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those permitted under the CPRA.

California residents have the right to know what we collect, to request deletion, to correct inaccurate information, and to opt out of any sale or sharing (we do neither). To exercise these rights, email privacy@ara.so. We will not discriminate against you for exercising any of these rights.

Retention & deletion

We keep your messages and generated sites for as long as your account is active, plus a short window to allow recovery. You can delete your account at any time. Logs are retained for up to 30 days for abuse prevention. Seller-program consent records are retained for the lifetime of the seller program and a reasonable period thereafter as part of our books and records, even if you delete your account, because they document a payments relationship.

Contact

Questions about privacy? Email privacy@ara.so.