Privacy Notice
Effective: July 23, 2026 | Version: 2026-07-23
Issued by Krushil, LLC d/b/a Arthavita
Your Financial Data Is Private — Even From Us
Arthavita's founders and employees do not have access to your individual portfolio holdings, financial goals, investment data, or account balances. Your financial information is processed automatically and securely by our systems and AI to generate your personalized recommendations — no human at Arthavita can browse or view your personal financial details.
We do not sell your Nonpublic Personal Information (NPI) to any third party, including data brokers, advertisers, or financial institutions.
1. Who We Are
Krushil, LLC d/b/a Arthavita ("Arthavita," "we," "us," or "our") operates the Arthavita platform at arthavita.co — an AI-powered educational investment, wealth planning, and legacy management service for individuals and families. Arthavita is a financial institution subject to the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. § 6801 et seq., and the FTC Safeguards Rule, 16 CFR Part 314.
This Privacy Notice fulfills our disclosure obligations under the GLBA Privacy Rule (16 CFR Part 313). It describes what Nonpublic Personal Information (NPI) we collect, how we use it, with whom we share it, and what rights you have regarding your information.
2. Nonpublic Personal Information (NPI) We Collect
We collect the following categories of NPI from and about you:
Identity Information
- Full name and email address
- Date of birth and life stage
- State of residence
- Account credentials (passwords are hashed using bcrypt; we never store plaintext passwords)
Financial Information
- Portfolio holdings: investment symbols, share quantities, cost basis, and lot details
- Account balances and net worth entries (manually entered or aggregated via Plaid)
- Retirement projections: contribution rates, withdrawal rates, Monte Carlo scenarios
- Tax profile: filing status, income estimates, capital gains, tax bracket information
- Financial goals and target amounts
- Debt, liabilities, insurance policies, estate planning intentions
- Investment preferences, risk tolerance, and time horizon
Brokerage Connectivity (Optional)
SnapTrade Integration: If you connect a brokerage account, we receive read-only access to your holdings and positions via SnapTrade, a regulated account aggregation service.
- We never receive your brokerage username or password
- Your credentials go directly to your broker — never to Arthavita
- An encrypted OAuth token (AES-256-GCM) is stored to maintain the connection
- That token is never returned in API responses or logged
- You can disconnect at any time from Settings → Connected Accounts
Plaid Integration: For bank and investment account aggregation, we use Plaid for balance, investment, and liability data only — we do not access your transaction history. Plaid's privacy policy governs their data handling: plaid.com/legal.
Automatically Collected Information
- Device type and browser (for compatibility; not used for fingerprinting)
- IP address (used for security monitoring and rate limiting; not sold or profiled)
- Feature usage patterns (used to improve the platform; anonymized)
- Error reports (sent to Sentry with personal and financial data removed before transmission)
3. How We Use Your NPI
We use your NPI exclusively to provide and improve Arthavita's services:
- Generating personalized investment recommendations, retirement projections, and tax guidance
- Powering AI-synthesized coaching and planning insights (via Anthropic Claude API)
- Sending transactional notifications and alerts you have requested
- Maintaining account security (MFA, session management, fraud detection)
- Fulfilling our legal obligations under GLBA and applicable state laws
- Operating and improving the platform
We do not use your NPI for advertising, marketing profiling, or sale to third parties.
4. Service Providers Who May Receive Your NPI
We share NPI only with service providers who process it on our behalf to deliver the platform. Each provider is contractually bound to use your NPI only for the stated purpose and to maintain appropriate security controls.
| Provider | Purpose | NPI Involved |
|---|---|---|
| Railway | Database hosting (PostgreSQL) | All NPI — stored at rest with field-level encryption on sensitive fields |
| Vercel | Application hosting and API route execution | NPI transits through Vercel's infrastructure during request processing |
| Anthropic (Claude AI) | AI investment synthesis and coaching | Portfolio, goals, and retirement data — minimum necessary for synthesis. Not used for training. |
| SnapTrade | Read-only brokerage account aggregation (optional) | Brokerage holdings and positions if you connect a brokerage account |
| Plaid | Bank/investment account balance aggregation (optional) | Account balances, investment holdings, and liability balances if you connect accounts |
| Resend | Transactional email delivery | Email address and notification content |
| Upstash (Redis) | Rate limiting and session management | User ID and session identifiers (transient; not persisted) |
| Sentry | Error monitoring | Error context with financial data and email addresses removed before transmission |
We do not share your NPI with non-affiliated third parties for their own marketing or business purposes.
5. Your Right to Opt Out
We do not share your NPI with non-affiliated third parties for purposes other than those described in Section 4. Accordingly, there is no opt-out of third-party sharing to exercise. If this practice changes, we will update this notice and provide you with opt-out rights before any such sharing occurs.
You may opt out of non-essential communications (e.g., product update emails) at any time from Settings → Notifications.
6. How We Protect Your NPI
- HTTPS / TLS encryption in transit between your browser and our servers
- AES-256-GCM field-level encryption for sensitive fields (retirement data, brokerage tokens)
- bcrypt hashing for passwords — we cannot recover your password
- Multi-factor authentication (MFA) available for all accounts
- Row-level security (RLS) on our PostgreSQL database isolating each account's data
- CSRF protection on all data-mutating API requests
- Redis-backed rate limiting to prevent credential stuffing and brute force
- Error reports to Sentry with NPI scrubbed before transmission
No method of transmission over the Internet is 100% secure. We maintain a Written Information Security Program (WISP) and conduct annual security risk assessments as required by the GLBA Safeguards Rule.
7. Data Retention
We retain your NPI for as long as your account is active and as needed to provide you services. If you request account deletion, we will permanently delete your NPI within 30 days, except where retention is required by law (e.g., financial records subject to a legal hold).
8. Your Rights and Choices
You have the following rights regarding your NPI:
- Access: Request a copy of the NPI we hold about you. Available from Settings → Data & Privacy → Export My Data.
- Correction: Update inaccurate information from your account Settings at any time.
- Deletion: Request permanent deletion of your account and all associated NPI. Available from Settings → Data & Privacy → Delete My Account. Deletion revokes all brokerage connections (SnapTrade, Plaid) and removes your data from our systems within 30 days.
- Portability: Export your data in a machine-readable format from Settings → Data & Privacy → Export My Data.
- Opt-out of marketing: Unsubscribe from non-essential communications from Settings → Notifications or via the unsubscribe link in any email we send.
To exercise any right not covered by self-service Settings, contact us at privacy@arthavita.co. We will respond within 30 days.
9. State-Specific Privacy Rights
California (CCPA)
California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell your personal information.
Michigan and Texas
Michigan residents are protected by the Michigan Identity Theft Protection Act (MCL § 445.63). Texas residents are protected by Texas Business & Commerce Code § 521.053. In the event of a security breach affecting your NPI, we will notify you within the timeframes required by applicable state law.
10. Children's Privacy
Our Service is not directed to individuals under the age of 18. We do not knowingly collect NPI from minors. If you believe we have collected information from a minor, please contact us at privacy@arthavita.co and we will promptly delete it.
11. Changes to This Notice
We may update this Privacy Notice from time to time. When we make material changes, we will notify you via an in-app acknowledgment prompt on your next login and by email. The "Version" date at the top of this notice reflects when it was last updated.
12. Contact Us
For questions about this Privacy Notice, to exercise your data rights, or to report a privacy concern:
Krushil, LLC d/b/a Arthavita
Privacy Officer: Ketan Patel
Email: privacy@arthavita.co
This notice is provided pursuant to the Gramm-Leach-Bliley Act, 15 U.S.C. § 6803, and the FTC Privacy Rule, 16 CFR Part 313. Version 2026-07-23.