Last updated: September 3, 2026

Sutra Fitness, Inc., doing business as Arketa ("Arketa," "we," "us," or "our"), provides an online platform that enables fitness instructors to host classes, offer on-demand content, and engage with customers. This Privacy Policy explains how we collect, use, share, retain, and protect your personal data when you interact with our services, including our website (www.arketa.com), branded website widgets (app.arketa.co), the Arketa mobile app ("App"), branded mobile apps ("Branded App"), and other interactions with us (collectively, our "Services").

This policy applies to personal data collected through our Services but does not cover information about employees or contractors. If you book a fitness class through a third-party platform using our technology, this policy applies only to data we directly collect.

If you are a California resident, the section "Your Privacy Choices" and the "California Notice at Collection" at the end of this policy apply to you in addition to the rest.

1. Information We Collect

Data you provide

Registration: name, email, address, username, password, and billing details.
Communications: anything you send us by email, through a form on our website, or in the chat window on our website (see "Chat" below).
Fitness partner activity: bookings, attendance, preferences.
Job applications: resume data and background checks (if applicable).

Data collected automatically

Device and usage data: IP address, browser and device type, the pages you visit, the links and buttons you click, timestamps, the page that referred you, and campaign parameters in the URL (for example utm_source, gclid, fbclid).
Geolocation: approximate location derived from your IP address (used on the website to decide which privacy rules apply to you, see "Tracking technologies and cookies"); precise location only with your consent in the App.
Cookies and similar technologies: see "Tracking technologies and cookies" below and our Cookie Policy at www.arketa.com/legal/cookies.
Advertising data: information about the ads you saw or clicked, from our advertising partners.
Visitor identification data: on our marketing website, a business-identification service may match your visit to a business contact profile. See "Visitor identification" below.

Data from third parties

Referrals: provided by users.
Fitness partners: attendance and communication data.
Payment processors: transaction confirmations.
Background checks: for job candidates.
Business data providers: company and professional profile information used to identify business visitors to our website (see "Visitor identification").

2. How We Use Your Information

To provide, operate and personalize the Services
To communicate with you (support, service updates, marketing where permitted)
To measure how our website and marketing perform, and to conduct analytics and research
To advertise our Services, including showing you ads on other sites and apps based on your visit to ours, where you have not opted out or, in regions where consent is required, where you have consented
To identify businesses that visit our website so our sales team can follow up (see "Visitor identification")
To detect fraud, abuse and invalid ad traffic, and to keep the Services secure
To evaluate and manage job applications
To comply with legal obligations and protect our rights

3. How We Share Your Information

We share personal information in the following circumstances:

Service providers: companies that process data on our behalf and under our instructions, such as hosting, email delivery, payments, customer support tooling, analytics, and the consent-management platform. They are bound by contract to use the data only to provide their service to us. The providers active on our website are named in "Tracking technologies and cookies".
Advertising partners: when you visit our website with advertising cookies enabled, the advertising platforms named in "Tracking technologies and cookies" receive information about your visit (such as the pages you viewed, the buttons you clicked, an advertising identifier, and, if you started a free trial or booked a demo, a hashed form of your email, name and phone number) and use it to measure our ads and show you ads for Arketa on their own services. Under the California Consumer Privacy Act this is "sharing" of personal information for cross-context behavioral advertising, and may be a "sale" under some state laws. You can opt out at any time; see "Your Privacy Choices".
Fitness partners: for class facilitation and records.
Legal requirements: law enforcement, courts, and regulators when required by law or to protect rights and safety.
Business transfers: in a merger, acquisition, financing or sale of assets, with notice to you.
Public posts: comments or content you make public.
With your consent: any other situation where you agree.

We do not sell personal information for money. We do not share personal information with third parties or affiliates for their own marketing or promotional purposes, other than the advertising partners described above.

SMS and opt-in data. We do not share end-user mobile numbers or SMS opt-in data with third parties or affiliates for marketing or promotional purposes. We share such data only with service providers (for example SMS delivery platforms and customer communication tools) solely to deliver the services you have requested, and those providers are contractually obligated to use it only to support our service operations.

4. Tracking Technologies and Cookies

Our website uses cookies, pixels, software development kits and similar technologies placed by Arketa and by the partners listed below. Some are necessary for the site to work; the rest are grouped into three categories that you can allow or refuse. The full list of cookies, with names and expiry, is in our Cookie Policy at www.arketa.com/legal/cookies.

How consent works, by region

We determine your approximate region from your IP address when you visit the website, and apply the rules for that region.

Opt-in regions — California, the European Economic Area, the United Kingdom, Switzerland, Quebec, and any visit whose region we cannot determine: Functional, Analytics and Advertising technologies stay off until you choose "Accept all" or turn on individual categories in the banner. Refusing has no effect on your ability to use the website.
Everywhere else: Functional, Analytics and Advertising technologies run by default. A notice tells you this on your first visit and lets you reject all of them or choose by category.
Any time, any region: the "Cookie Settings" and "Your Privacy Choices" links in the footer reopen your preferences.
Global Privacy Control: if your browser or extension sends the Global Privacy Control signal (GPC), we treat it as a request to opt out of Analytics and Advertising technologies and of the sharing of your personal information, in every region, without you having to do anything else. Your GPC signal applies to that browser; if you also have an account with us and want the opt-out applied to it, contact us as described in "Your Privacy Choices".

We keep a record of the choice you make (the categories, the time, your region, and the version of the notice you saw) so we can honor it and demonstrate that we did.

Essential (always on)

Needed for the website to function and to remember your privacy choices. No consent is required.

Website hosting and delivery — Vercel, Next.js, Payload CMS: Serving pages, security, the arketa_consent_region cookie that records which privacy rules apply to you
Consent management — Termly: Showing the banner and storing your choice
Pricing table — Stripe: Displaying plans and prices on pricing pages
Demo scheduling — RevenueHero: The booking calendar, only on pages where you book a demo and only when you use it
Job board — Ashby: Listing open roles on our careers page
Forms — Arketa (our CMS) and HubSpot Forms: Receiving the forms you submit

Functional

Features you can choose to use. Off until accepted in opt-in regions; on by default elsewhere.

Website chat — Intercom: The chat window (see "Chat")
Video — YouTube (served from youtube-nocookie.com): Playing embedded videos; nothing loads until you press play

Analytics

Understanding how visitors use the site and which marketing brought them here.

Google Analytics 4 — Google: Page and event analytics
PostHog — PostHog: Product analytics of the website (page views, clicks, form steps). Session recording is not used. Requests are routed through our own domain for reliability.
HubSpot tracking code — HubSpot: Associates your page views with your contact record once you submit a form, so our sales team knows what you looked at
Dreamdata — Dreamdata: Business-to-business marketing attribution
Mesh Interactive — Mesh Interactive: Session and form-interaction analytics
Polygraph — Polygraph: Detecting fraudulent and automated ad traffic
VWO — Wingify: A/B testing (used on our app dashboard, not on the marketing site)
First-party campaign cookies — Arketa: utm_* cookies that remember which campaign brought you here for 30 days, and pass that information to our app and our sales tools when you sign up

Advertising

Measuring our ads and showing you Arketa ads on other services based on your visit. Using these is "sharing" for cross-context behavioral advertising under California law.

Meta Pixel — Meta Platforms: Ad measurement and retargeting on Facebook and Instagram; on trial sign-up and demo booking, sends a hashed form of your email, name and phone number for ad matching
Google Ads — Google: Conversion measurement and remarketing, including enhanced conversions (hashed contact data) on trial start
TikTok Pixel — TikTok: Ad measurement and retargeting
LinkedIn Insight Tag — LinkedIn: Ad measurement and retargeting
Reddit Pixel — Reddit: Ad measurement and retargeting
Microsoft Advertising UET — Microsoft: Ad measurement and retargeting on Bing and Microsoft properties
Capterra — Gartner Digital Markets: Attribution for our Capterra listing (demo booking page only)
Nexxen — Nexxen (formerly Amobee): Measurement beacons for display advertising campaigns
RB2B — RB2B: Business visitor identification (see "Visitor identification")

Chat

The chat window on our website is provided by Intercom. When you open the chat, your messages, your name and email if you give them, the page you are on, and technical information about your browser are transmitted to and stored by Intercom on our behalf so that our team can read and reply. Intercom acts as our service provider and processes chat data only under our instructions. We tell you this in the chat window before you send your first message. The chat only loads if Functional technologies are allowed; if you have declined them, a "Contact us" link takes you to an email form instead. Chat transcripts are kept as described in "Data Retention".

Visitor identification

On our marketing website we use RB2B, a service that attempts to match a visit from a business network or device to a business contact profile (name, company, work email and LinkedIn profile) from RB2B's data sources, so our sales team can follow up with companies that showed interest in Arketa. This runs only when Advertising technologies are allowed and only for visitors RB2B identifies as located in the United States. You can prevent it by rejecting Advertising technologies, by sending a Global Privacy Control signal, or by using the "Your Privacy Choices" link.

5. How We Protect Your Information

We use administrative, technical, and physical safeguards designed to protect your personal information. These include encryption of data in transit (TLS) and at rest, role-based access controls and least-privilege access for our personnel, multi-factor authentication on internal systems, logging and monitoring of access to production systems, and regular review of our security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to protect your information in line with industry standards and applicable law.

6. Google User Data and Gmail Integration

Arketa offers an optional integration with Google that allows business owners and their authorized staff to connect a Gmail account to Arketa. When you connect your Google account, Arketa requests access only to the scopes needed to provide the feature, which currently include: seeing your primary Google Account email address and basic profile information so we can identify the account you connected; viewing your email messages and settings; sending email on your behalf; and, for the Google Calendar sync, seeing and editing the calendars you can access in Google Calendar. You can review the exact permissions on Google's consent screen before granting access, and you can disconnect at any time.

How we use Google user data. We use Gmail data solely to provide the user-facing features you enable, such as managing your Gmail inbox from within Arketa and reading and replying to your emails without leaving Arketa. We do not use Google user data for advertising, we do not sell Google user data, and we do not use it to determine creditworthiness or for lending purposes.

Limited Use. Arketa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Arketa does not use Google Workspace data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

How we share Google user data. We do not transfer or disclose Google user data to third parties except as necessary to provide or improve the features you have enabled (for example, our cloud hosting and infrastructure providers, which are bound by confidentiality and data-processing agreements), to comply with applicable law, or as part of a merger, acquisition, or sale of assets, with notice to you. Human access to Google user data is limited to the account owner's authorized staff, and to Arketa personnel only with your explicit consent for support or security purposes, or where required by law.

How we protect Google user data. Google user data is encrypted in transit using TLS and encrypted at rest. OAuth access and refresh tokens are stored encrypted and are never exposed to browsers, client-side code, or third parties. Access to systems that store Google user data is restricted to authorized personnel on a least-privilege basis, protected by multi-factor authentication, logged, and regularly reviewed. We maintain administrative, technical, and physical safeguards designed to protect this data against unauthorized access, loss, alteration, or misuse, and we will notify affected users of any security incident involving their Google user data as required by applicable law.

Retention and deletion. We retain Google user data only as long as needed to provide the connected feature. If you disconnect your Google account from Arketa, or revoke Arketa's access from your Google Account permissions page, we delete the associated OAuth tokens immediately and delete any stored Google user data within 7 days, except where retention is required by law. You may also request deletion of your Google user data at any time by emailing privacy@arketa.com or using https://www.arketa.com/privacy-requests.

7. Data Retention

We retain your data only as long as necessary for the purposes above, including:

Account data — while your account is active, plus a reasonable period after closure
Financial data — typically 7 years
Communications, including chat transcripts — as needed to respond and for our records; chat transcripts held by Intercom are deleted after
Website analytics data — Google Analytics event data 2 months; other analytics providers 3 months
Advertising and visitor-identification data — held by the partner under its own retention period 3 months
Consent records — for as long as needed to demonstrate your choice, and at least 3 months
Job applicant data — 1–3 years, if required by law

Data no longer needed is securely deleted or anonymized.

8. Your Privacy Rights

GDPR (EU/EEA, UK and Switzerland)

Access, correct, delete, or restrict use of your data
Object to certain uses, including direct marketing
Withdraw consent at any time (for cookies, through "Cookie Settings" in the footer)
Request data portability
Lodge a complaint with your supervisory authority

CCPA/CPRA (California) and other US state laws

Right to know what personal information we collect, use, disclose, sell or share
Right to delete and to correct
Right to opt out of the sale or sharing of personal information and of targeted advertising (see "Your Privacy Choices")
Right to limit the use of sensitive personal information
Right not to be discriminated against for exercising these rights
Residents of Colorado, Connecticut, Oregon, Texas, Virginia and other states with privacy laws have similar rights, which we honor through the same channels

How to exercise your rights

Email privacy@arketa.com or use our form at https://www.arketa.com/privacy-requests. We will verify your request and respond within the time required by law. You may use an authorized agent where the law allows; we may ask the agent for proof of authorization.

Marketing opt-out

Unsubscribe links in emails
Reply "STOP" to texts
Cookies and ads: see "Your Privacy Choices"

Device settings

Control access to location or device permissions in your phone settings.

9. Your Privacy Choices / Do Not Sell or Share My Personal Information

When you visit our website with Advertising technologies allowed, we let advertising platforms (Meta, Google, TikTok, LinkedIn, Reddit, Microsoft, Capterra, Nexxen) and a visitor-identification service (RB2B) collect information about your visit through pixels and scripts, as described in "Tracking technologies and cookies". Under the California Privacy Rights Act this is "sharing" of personal information for cross-context behavioral advertising, and it may be a "sale" under other state laws. The information shared is identifiers (cookie and advertising IDs, IP address), internet activity (pages viewed, buttons clicked), and, if you sign up for a trial or book a demo, a hashed form of your contact details. We do not knowingly share the personal information of anyone under 16.

You can opt out of sharing at any time, in any of these ways:

Footer link. Click "Your Privacy Choices" (or "Cookie Settings") at the bottom of any page and turn off Advertising (and, if you wish, Analytics and Functional), then save.
Banner. When the cookie banner or notice appears, choose "Reject all" or "Manage choices".
Global Privacy Control. Turn on GPC in your browser or install a GPC extension. We honor the signal automatically on every page load, in every region.
Email. Write to privacy@arketa.com with the subject "Do not sell or share".
Form. Submit a request at https://www.arketa.com/privacy-requests.

Opting out through the footer link, the banner or GPC takes effect immediately in that browser and is remembered by a cookie; if you clear cookies or use another browser or device you will need to opt out again there. Opting out by email or through the form is applied to the contact records we hold about you (including in HubSpot and RB2B) and to the advertising platforms as far as they allow, within 15 business days. Opting out does not affect ads you see that are not based on your visit to our site, and does not affect our own emails, which you control with the unsubscribe link.

10. International Data Transfers

Your data may be processed in the United States or other jurisdictions where we or our service providers operate. For transfers out of the EEA, UK and Switzerland we rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss addenda) and secure your data through encryption and access controls.

11. Global Privacy Control and Do Not Track Signals

We honor the Global Privacy Control (GPC) signal as described in "Your Privacy Choices". We do not respond to the older "Do Not Track" (DNT) browser setting, for which there is no accepted standard; our own product analytics (PostHog) does respect DNT. You can also limit interest-based advertising across the web through the Digital Advertising Alliance at optout.aboutads.info and through your browser's cookie settings.

12. Children's Privacy

We do not knowingly collect data from children under 13 (or under 16 in the EU). If you believe we have, please contact us and we will delete it.

13. Third-Party Services

We are not responsible for the privacy practices of partners, processors, or other linked sites. Review their policies independently. The partners active on our website are named in "Tracking technologies and cookies"; each has its own privacy policy describing what it does with data it receives. If you connect a Google account to Arketa, our handling of that data is described in the "Google User Data and Gmail Integration" section above.

14. Contact Us

Email: privacy@arketa.com
Mail: Sutra Fitness, Inc., Attn: Privacy Team, 2 E 28th St, PMB 141, New York, NY 10016
EU DPO: dpo@arketa.com
Privacy requests form: https://www.arketa.com/privacy-requests

15. Updates to This Policy

We may update this Privacy Policy. The new version will be posted with a revised "Last updated" date at the top, and we keep prior versions on file. Significant updates may be communicated directly.

16. California Notice at Collection

This notice applies to California residents and supplements the rest of this policy. The categories below use the terms in the California Consumer Privacy Act.

Identifiers — Name, email, phone, postal address, username, IP address, cookie and advertising identifiers: Providing the Services, communication, analytics, advertising, visitor identification, security — Account data: life of the account plus a reasonable period; cookies: see Cookie Policy — Shared with advertising partners (cookie/advertising IDs, IP, hashed email/name/phone on conversion) when Advertising technologies are allowed. Not sold for money.
Customer records (Cal. Civ. Code § 1798.80) — Name, contact details, billing details: Providing the Services, payments — Financial data typically 7 years — Not sold or shared
Commercial information — Bookings, purchases, plans, trial and demo activity: Providing the Services, analytics, advertising measurement — Life of the account plus a reasonable period — Shared with advertising partners as conversion events (trial started, demo booked) when Advertising technologies are allowed
Internet or network activity — Pages viewed, clicks, referring page, campaign parameters, chat messages, form interactions, device and browser data: Analytics, advertising, chat support, fraud detection, visitor identification — Analytics: Google Analytics 2 months; others per vendor (see "Data Retention") — Shared with advertising partners when Advertising technologies are allowed; disclosed to service providers for analytics and chat
Geolocation data — Approximate location from IP address (website); precise location with consent (App): Applying the correct privacy rules; App features — Not stored beyond the session for the website — Approximate location may be shared with advertising partners as part of IP address
Professional or employment information — Company, job title, work email (from forms and, for business visitors, from RB2B): Sales follow-up, visitor identification — Life of the contact record — Disclosed to our CRM service provider; obtained from RB2B
Inferences — Interest in Arketa's products inferred from pages visited: Marketing and sales follow-up, advertising audiences — Life of the contact record — Shared with advertising partners as audience membership when Advertising technologies are allowed
Sensitive personal information — Account password (login credentials); precise geolocation in the App with consent: Authentication; App features — Life of the account — Not sold or shared; not used to infer characteristics
Job applicant information — Resume, background check results: Recruiting — 1–3 years — Not sold or shared

We collect these categories from you directly, from your device and browser automatically, from our fitness partners, payment processors and background-check providers, and from business data providers (RB2B). We do not sell personal information for money, and we do not knowingly sell or share the personal information of consumers under 16. To opt out of sharing, see "Your Privacy Choices". To exercise your other rights, see "Your Privacy Rights".