Privacy Policy

1. Overview & Identity-Blind Architecture

This policy describes what ArthIQ Labs LLC (“ArthIQ,” “we,” “us,” or “our”) collects, how we handle it, and your rights with respect to it. It covers the KundaliMCP platform, developer portal, and associated services at kundalimcp.com. It does not apply to third-party services linked from the portal.

That claim is about the engine, and the Service is more than the engine. An authenticated request necessarily carries your bearer credential, and the gateway in front of the engine authenticates it, counts it against your plan, and records that a call happened. Section 6 sets out, layer by layer, what each part of the Service sees and stores — because “the engine cannot link a chart to an account” and “nothing in the Service knows who called” are different statements, and only the first is true.

Three things are stored, and we would rather describe them than claim a zero we do not have. Computed results may be held in an encrypted response cache so an identical chart is not recomputed. A record that a call occurred — tool, outcome, latency, your account and a fragment of your key fingerprint, but never the birth inputs — is kept to operate billing and detect abuse. And the conversational chat tool keeps short-lived thread memory so a follow-up question can be understood. Each is detailed below, with its retention period and how to avoid it.

Birth inputs themselves are not written to our database, our application logs, or our error messages at any point.

2. Data the Computation Engine Does Not Collect

This section describes the eight computational tools. The conversational chat tool takes free text and an optional caller-supplied thread identifier, so it is not covered by the exclusions below; see Section 7 for what it accepts and stores.

For the computational tools, the following categories are structurally excluded. The API does not accept fields for these inputs, and the engine has no code paths that could receive or process them:

• —Full names, given names, family names, or nicknames
• —Names, place names, or any human-readable birth descriptor — the API accepts only an ISO 8601 datetime string plus latitude and longitude as floating-point numbers
• —Place names, city names, country names, or addresses
• —Email addresses or phone numbers
• —Device identifiers, IP addresses, or browser fingerprints
• —User account identifiers or session tokens — the engine is not passed the credential the gateway authenticated, so it cannot associate a chart with an account
• —Any free-text field that could contain personally identifiable information

Computation inputs are: geographic coordinates (latitude and longitude as floating-point numbers), an ISO 8601 datetime string representing the birth instant, ayanamsha selection (an enumerated identifier), house system selection (an enumerated identifier), and interpretation-profile selection (an enumerated identifier). These inputs are mathematical. The datetime alone cannot identify an individual without external context (the place name, the person, or other linking data).

3. Caller Responsibility

The responsibility for converting personal data — a person’s name, birth date, and birthplace — into computational inputs (geographic coordinates and an ISO 8601 datetime) rests with the API caller. Personal data that exists in your application before it is abstracted into API inputs is never disclosed to ArthIQ, because there is no field in which to send it.

We describe that architecture rather than assert a conclusion from it. Whether a given field is personal data is a contextual question — a precise timestamp and a precise coordinate pair can be identifying or pseudonymous when combined with an account, an uncommon birthplace, a request time, or a record in your own system — and calling them floating-point numbers does not settle it. Likewise, our role in any particular processing relationship depends on that relationship as a whole, not on our own characterisation of the input format. If you build an application that collects birth information from your users, you are the controller for that personal data, and if you require a data processing agreement covering your use of the Service, contact support@kundalimcp.com.

ArthIQ strongly recommends that API callers implement conversion (from personal data to abstract coordinates) client-side, so that personal data never transits ArthIQ infrastructure. The API is designed to facilitate this pattern: it requires no personal data to produce a complete kundali analysis.

4. Website Data Collection

The KundaliMCP developer portal (kundalimcp.com) collects limited data to operate the website and billing system:

5. API Data Handling

Response cache — what is stored, and why we cannot read it

So that an identical chart is not recomputed on every call, the computed result may be cached. Caching is on by default; send cache: "skip" on any call to suppress both the cache read and the cache write for that request, so no entry is created. Cache lifetime is operator-tunable, defaults to 7 days, and is capped in code at 30 days. Some tools are never cached because their output is not deterministic.

Entries are encrypted with AES-256-GCM under a key derived from your API key alone (HKDF-SHA256), not from any operator secret. We store only the SHA-256 fingerprint of your API key, never the key itself — so the material required to decrypt your cache entries does not exist anywhere in our infrastructure at rest. An operator with full database and cache access reads ciphertext and nothing else. The key is reconstructed only in memory, for the duration of a request, from the API key you present on that request.

The consequences of that design are worth stating precisely, because cryptographic inaccessibility and deletion are not the same thing in every jurisdiction, and we would rather you knew which one we are offering:

• —Entries cannot be inspected, exported, or selectively purged per account. The cache index is an HMAC computed under your API key, which we do not store, so we have no way to enumerate the entries belonging to one key. We can let entries expire, or flush the cache wholesale.
• —Revoking or rotating an API key does not erase the ciphertext. It destroys the only input from which the decryption key could be derived, so the entries become permanently unreadable — by you, by us, and by anyone with full infrastructure access — and are then evicted when their lifetime expires.
• —Deleting your account does not itself trigger a cache purge. Entries created under your keys expire within the configured lifetime, and are unreadable from the moment those keys are revoked. If you want an explicit flush, ask us and we will run one.
• —Cache entries live in a managed Redis service, which may replicate them for availability. Replicas carry the same ciphertext and the same expiry; we do not maintain separate long-term backups of the cache.
• —To create no entry at all, send cache: "skip".

Error messages produced by the computation engine contain only computational error descriptions (e.g., “datetime out of supported ephemeris range” or “invalid coordinate”) — they never echo back input parameters that could reconstruct birth data.

6. Which Layers See What

“No account linkage” is true of the computation engine and false of the Service as a whole, so this section separates them. An authenticated request necessarily carries a bearer credential, and the gateway that checks it also enforces your plan — which means something in the path knows which account is calling, even though the part that computes the chart does not.

7. The Conversational chat Tool

The eight computational tools never call a language model. Their output is produced entirely by our own engine. If you do not use chat, no request of yours reaches a language model provider, and there is no per-account setting to configure: the distinction is which tool you call.

When you do call chat, the following happens:

• —Your message, and the computed chart facts needed to answer it, are sent to a third-party language model provider that generates the prose. We may route between providers for availability and quality, and the active provider is a configuration of the Service rather than a fixed term of it.
• —Thread memory: your question and the answer are stored so a follow-up can be understood. It is encrypted at rest with AES-256-GCM and expires 4 hours after the last turn. Unlike the response cache, this is encrypted under an operator-held key rather than one derived from your credential — the difference matters, and we would rather name it than let the earlier claim carry over.
• —Thread memory is opt-in and keyed on an identifier you supply. Send a session_id (or user_hash) and turns under it are linked; send neither and each turn gets a fresh internal nonce, so nothing is retained across turns. Choose a pseudonym: whatever you send is the key, so do not put an email address or a real name there.
• —Quality and safety records: for each turn we keep metrics — model, route, language, claim and citation counts, whether validation passed, response length. These contain no message text.
• —Suppressed content: when a safety rule removes a statement from a generated answer, the removed fragment and its surrounding sentence are retained with your account identifier so the rule's accuracy can be reviewed by a person. This is answer text produced by the model, not your message.

We are not currently publishing the identity of the language model provider, its processing region, its retention period, whether inputs are excluded from model training, or whether zero-retention terms apply. We would rather record that as an open item than characterise a contract on this page. If those terms are material to your assessment — and for a consumer-facing product they reasonably are — contact support@kundalimcp.com before putting chat in front of end users, and prefer the computational tools in the meantime.

8. Output Data Classification

KundaliMCP API responses include a DataClassification field. This field is set by the API caller, not by ArthIQ. It is passed through the computation pipeline and returned in the response to assist callers in applying appropriate data handling policies to outputs within their own systems.

ArthIQ disclaims responsibility for how callers classify, store, transmit, or protect API outputs. If you associate API output with personal data (e.g., by storing a kundali result alongside a user record), you become the data controller for that association and are solely responsible for its compliant handling under applicable law.

9. Third-Party Sub-Processors

ArthIQ uses the following sub-processors in the operation of the Service. Each operates under its own independent privacy policy and data processing terms:

10. GDPR Compliance (European Union)

For users in the European Union and European Economic Area, the General Data Protection Regulation (GDPR) applies to personal data ArthIQ processes in connection with your account.

A computation output is a transformation of the values you send, and ArthIQ holds nothing that connects it to an identified person: the engine is not given an identity, and the output is not stored in association with your account. Whether it is personal data in your hands is a different question, decided by what you can combine it with — and once you associate an output with a person in your own systems, you are the controller for that association.

Personal data ArthIQ does process (account email address, billing records) is processed on the following legal bases:

1. Contract performance: processing necessary to provide the subscription service you have requested
2. Legitimate interests: fraud prevention, abuse detection, and service security
3. Consent: marketing communications, where applicable and separately obtained

EU/EEA residents may exercise the following rights with respect to personal data ArthIQ holds: right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability, and right to object. Submit requests to support@kundalimcp.com. ArthIQ will respond within 30 days.

11. CCPA Compliance (California)

For California residents, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) apply to personal information ArthIQ processes in connection with your account.

ArthIQ does not sell personal information. ArthIQ does not share personal information with third parties for cross-context behavioral advertising. The computation engine, as described in Section 2, is not given identifying fields and does not collect them; the account-level information ArthIQ does hold, and the layers that hold it, are set out in Section 6.

California residents may request: disclosure of the categories and specific pieces of personal information ArthIQ has collected; deletion of personal information; correction of inaccurate personal information. Submit requests to support@kundalimcp.com. Verifiable consumer requests will receive a response within 45 days.

12. DPDP Act Compliance (India)

For users in India, the Digital Personal Data Protection Act 2023 (DPDP Act) applies to personal data ArthIQ processes in connection with Indian residents.

The same identity-blind architecture applies equally to Indian users: the computational tools accept no identifying fields, and the engine stores nothing. Account and request-level data is held as described in Section 6, and the chat tool has the additional characteristics described in Section 7, for Indian users as for everyone else.

Account and billing data (email address) for Indian subscribers is processed under legitimate uses as defined by the DPDP Act, specifically the performance of a contract for services. Indian residents may exercise their rights under the DPDP Act — including access, correction, erasure, and grievance redressal — by contacting support@kundalimcp.com.

13. Children

The KundaliMCP Service is a B2B developer platform not targeted to, designed for, or marketed toward children. It is not directed at individuals under the age of 13 (or under 16 in the European Union and European Economic Area). ArthIQ does not knowingly collect personal information from children under these age thresholds.

If you believe a child has provided personal information to ArthIQ, contact support@kundalimcp.com and we will promptly delete it.

14. Data Retention

ArthIQ retains data for the minimum period necessary for each purpose:

15. International Data Transfers

ArthIQ Labs LLC is based in Illinois, United States. Limited personal data (account email address, billing records) may be transferred to and processed in the United States and in countries where our sub-processors operate.

For transfers of personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, ArthIQ relies on Standard Contractual Clauses (SCCs) as approved by the European Commission where legally required. For transfers from India, ArthIQ applies appropriate safeguards in accordance with the DPDP Act.

16. Security Measures

ArthIQ implements the following technical security controls:

• —TLS 1.3 required for all data in transit between clients and the Service
• —AES-256-GCM encryption for response-cache values — caller-keyed via HKDF-SHA256 from your API key, 7-day default lifetime with a 30-day ceiling enforced in code, on by default and suppressed per call with cache: "skip"
• —AES-256-GCM encryption for chat thread memory, under a separate operator-held key, expiring after 4 hours
• —SHA-256 hashing of API keys — plaintext keys are never written to any persistent store
• —No plaintext key storage at any layer of the infrastructure
• —Rate limiting keyed on the API credential rather than on the caller's IP address
• —Computation that holds birth inputs in process memory only, so there is no persistence layer to attack for them
• —Cloudflare DDoS protection and edge security on the API surface

No security system is impenetrable. If you discover a potential security vulnerability in the Service, please report it to support@kundalimcp.com. Do not disclose security vulnerabilities publicly until ArthIQ has had a reasonable opportunity to investigate and address them.

17. Changes to This Policy

ArthIQ may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or for other operational reasons. Every update carries a version number, an effective date and a last-updated date at the top of this page; a revision that changes what we do with data increments the version. Version 1.0 kept its April 2026 effective date while its text changed, which is the failure this scheme exists to prevent.

Material changes — those that substantively affect how we handle personal data — will be communicated via the email address on your account at least 14 days before the effective date. Your continued use of the Service following the effective date of an update constitutes acceptance of the revised policy.

18. Contact & Privacy Requests

For privacy inquiries, data access requests, deletion requests, or any other questions about this policy, contact:

ArthIQ will respond to verifiable privacy requests within 30 days (or 45 days for CCPA requests where additional time is required).