Privacy, by design

Sarathi is operated by Altus Labs (“Sarathi”, “we”, “us”). This policy applies to the Sarathi service — the website at getsarathi.com, onboarding and the dashboard, and the Sarathi assistant you talk to on WhatsApp. Sarathi is currently in an early, invitation-only release.

• Your identity. Your WhatsApp phone number and the name you give us. Sarathi is passwordless — you sign in with a one-time code, so we never hold a password for you. You may add a recovery email as a safety net.
• What you send Sarathi. The messages, questions, and files you send — because that is the work you’re asking us to do. We keep what’s needed to help you and to remember context you’ve asked us to remember.
• Services you choose to connect. If, and only if, you connect a calendar, tasks, or a storage folder, we access the specific, scoped data you approve — nothing wider (see “Connected services”).
• Basic technical data. Standard logs needed to run the service securely — delivery status, error diagnostics. We keep these minimal and never sell them.

• We don’t read your email inbox. Sarathi has its own inbox that you forward things to. It structurally cannot see your personal mail.
• We don’t roam your accounts. A connection is not surveillance — Sarathi only accesses a connected service when you ask it to, when you’ve approved an automation, or on a schedule you’ve switched on.
• We don’t ask for your other passwords. Connections use OAuth, and where a service supports it we request the narrowest possible scope — often a single folder we create.
• We don’t sell your data, and we don’t run ads.

We use your information for one thing: to do what you ask, and to do it better next time. That means understanding your request, taking the action (or drafting it for your approval), and remembering the context you want remembered.

To understand and act, Sarathi uses AI models. Being honest about the limit: at the moment Sarathi acts on something, that content is processed in readable form by our systems and the AI model — that is inherent to an assistant that actually does the work. Outside that moment, we hold to the safeguards in “Security” below.

Every connection is optional, explained before you grant it, and removable at any time.

• Calendar — Sarathi reads your events to brief you and suggest times, and adds an event or a timed reminder only when you explicitly ask. It never edits or deletes existing events on its own.
• Tasks and reminders — Sarathi keeps and surfaces what you need to do, and adds a reminder when you ask.
• Storage — a single folder that Sarathi creates and owns (“Sarathi’s desk”), using folder-scoped access. Sarathi cannot see the rest of your drive.
• Sarathi’s email — an inbox of your own at getsarathi.com that you forward to; Sarathi files, extracts, and reminds. It is not access to your main mailbox.

When you connect a Google account, Sarathi requests only the narrowest scopes needed for the jobs you asked for — nothing wider:

• Google Calendar (calendar.events) — Sarathi reads your events to brief you and check availability, and creates an event or a timed reminder only when you explicitly ask. It does not edit or delete existing events on its own.
• Google Tasks (tasks) — Sarathi reads and adds to-dos and reminders when you ask it to.
• Google Drive (drive.file) — folder-scoped. Sarathi can see and manage only the files it creates in one folder it makes for you (“Sarathi’s desk”). It cannot see, search, or open anything else in your Drive.

How we use and store it. We use Google data solely to provide the features you request over WhatsApp — reading your schedule, creating events and reminders, and filing notes in your folder. We do not use Google data for advertising, we do not sell it, and we do not use it to train AI models. Your Google access and refresh tokens are encrypted (AES-256-GCM) before storage and are never written to our logs. Calendar, task, and file contents are processed at the moment you ask and are not kept beyond what’s needed to complete your request or what you’ve asked Sarathi to remember.

How we share it. To understand your request and draft a response, the relevant content may be processed by our AI provider (Anthropic) at that moment; it is not used to train their models. We do not otherwise share Google user data.

Limited Use. Sarathi’s use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Sarathi’s access to Google at any time — from Sarathi’s Privacy Dashboard, or directly in your Google account permissions. Revoking immediately stops all access.

Sarathi does the running-around; you keep the reins. For anything consequential — sending a message, creating an invite, anything that spends money or can’t be easily undone — Sarathi asks first. It explains what it did and why (“I checked your calendar because you asked”), and every action is recorded in an activity log you can review.

We don’t sell your data. We share it only with the service providers that make Sarathi work, and only as needed:

• Meta / WhatsApp — to send and receive your messages (Sarathi runs on WhatsApp).
• Anthropic — the AI models that understand your requests and draft responses.
• Supabase and Vercel — secure database and application hosting.
• Google or Microsoft — only if you connect one, and only for the scopes you approved.

We may also disclose information where the law requires it, or where it’s needed to protect people from harm.

• Encrypted in transit and at rest; connection tokens are stored encrypted and never written to our logs.
• Zero staff access to your content by design — the founders included. We don’t operate a mailbox into your data. Any exceptional (“break-glass”) access is off by default, tightly scoped to a specific incident, and written to an append-only audit log. Today that log is reviewed internally by the founders; as we grow, that review moves to an independent third party. We have no routine, standing access to your data.
• Step-up for identity documents — you can set a vault PIN so your identity documents (passport, Aadhaar, PAN) can’t be opened over chat without it — not even from your own phone — so a lost or swapped SIM alone can’t reveal them.
• Process and delete — where we only need to act on something in the moment, we don’t keep a copy beyond what you’ve asked us to remember.

We can’t claim cryptographic impossibility while Sarathi is actively doing your work (see the honest limit in section 04) — so we commit instead to no-staff-access-by-design, audit, and continuing to close that gap.

We keep your information for as long as your account is active and you want Sarathi to remember it. You can delete individual memories, disconnect any service, or delete your whole account at any time; when you delete, we remove your data from active systems and from backups on our normal backup cycle.

Because Sarathi is passwordless, your account recovers through your verified number or your recovery email — if both are permanently lost, the account cannot be recovered, by design.

• Memory Manager — view, edit, delete, or export what Sarathi remembers.
• Privacy Dashboard — see and manage every connection and permission.
• Activity log — a record of what Sarathi did on your behalf.
• Vault PIN — require a PIN to open identity documents (step-up authentication), set in My Account.
• Disconnect or delete — any service, or your whole account, whenever you want.

Depending on where you live, you also have rights under laws such as India’s DPDP Act and the EU/UK GDPR — including access, correction, deletion, and portability. To exercise any of these, contact us below.

Sarathi isn’t intended for people under 18, and we don’t knowingly create accounts for them.

As Sarathi grows we’ll update this page and change the “last updated” date. If a change materially affects you, we’ll tell you before it takes effect.

Questions, requests, or anything privacy-related: privacy@getsarathi.com.

Sarathi · operated by Altus Labs · getsarathi.com