Privacy Policy

Aksara is operated by Echoforge. This policy explains how we handle personal data when you visit Aksara, create a store, connect payments or Calendar, buy a digital product, book a call, or contact support.

Aksara decides how account, platform, security, and transaction records are used to operate the service. A creator may separately decide how to use buyer data for the creator's lawful business purposes. In that case, the creator is independently responsible for that use.

• Account data: email, name, username, avatar, authentication provider, and account settings.
• Store content: profile text, links, projects, product descriptions, covers, previews, and fulfillment files.
• Seller payment data: connected Stripe account identifiers, seller country, currency, onboarding status, and payment capability status. Bank and identity documents go directly to Stripe.
• Order data: buyer email, purchased item snapshots, price, currency, fees, refunds, delivery state, and Stripe transaction identifiers.
• Booking data: availability settings, time zone, reserved appointment times, buyer email, meeting links, calendar event identifiers, cancellation and rescheduling history, reminders, and related support requests.
• Usage data: page views, clicks, setup progress, referrer, browser and device information, and product events.
• Support and safety data: messages, reports, refund requests, security logs, and information needed to investigate fraud or abuse.
• File-security data: file names, types, sizes, checksums, scan results, and malware signatures when a file is rejected. Private fulfillment files are processed only to store, scan, and deliver them.

We receive data from creators and buyers, their browsers and devices, Stripe and other service providers, public product reports, and authentication providers chosen by the user.

We use personal data to provide accounts and stores, process and record payments, deliver purchases, prevent fraud, provide support, measure product performance, comply with legal duties, and protect Aksara and its users.

We do not sell personal data. We do not use buyer emails for unrelated advertising by Aksara.

Published storefronts, usernames, creator names, bios, links, product descriptions, prices, and public product images can be viewed by anyone and may appear in search results or external caches. Paid fulfillment files are not public and are delivered through time-limited access after authorization.

• Supabase provides authentication and the application database. Some legacy profile images may also remain in Supabase Storage during migration.
• Cloudflare R2 stores new product covers, previews, and private fulfillment files.
• Stripe processes subscription payments, buyer checkout, connected seller onboarding, refunds, disputes, and payouts.
• PostHog processes product analytics and pseudonymous usage events. Signed-in events may be associated with an Aksara user ID.
• Ahrefs provides cookieless traffic analytics for public marketing pages.
• Google provides optional sign-in and separately authorized Calendar and Meet features. Sign-in provides the account fields you approve. Calendar access is explained below.
• Hosting and email providers process request logs and transactional messages needed to run and secure the service.
• ClamAV scans private fulfillment files inside Aksara's hosted scanner before a product can be published.

These providers may process data in countries outside your own under their applicable privacy terms and transfer safeguards.

Connecting Calendar is a separate choice from signing in with Google. Signing in does not give Aksara access to your calendar. When call bookings are available, creators can choose Connect Google Calendar and review Google's permission screen. Buyers do not need to connect a calendar or create an Aksara account to book.

We request permission to read and manage events on calendars you own, check availability on calendars you can access, and read your calendar list. Aksara uses these permissions to identify your primary calendar, let you select calendars to check for conflicts, and create, check, reschedule or cancel Aksara appointments on your primary calendar. We do not request access to your Gmail messages, contacts or Google Drive files for this feature.

Calendar names and identifiers are shown to you when choosing conflict calendars. Availability checks return busy time intervals, rather than the titles, descriptions or attendees of unrelated events. We check those intervals when generating availability and arranging appointments. We do not save a copy of those unrelated busy intervals.

We store your selected calendar identifiers and connection status, plus the appointment times, Google event identifiers and Meet links needed to deliver and manage your bookings. We send Google the call title, appointment times, buyer email and booking identifiers to create the calendar invitation and Meet conference. Google may send invitations and change notices to the participants. The buyer and creator receive the meeting details for their appointment. Aksara does not record call audio or video through this feature.

Google authorization tokens are encrypted in our server-side credential store. They never appear in the creator or buyer interface. Refresh tokens allow scheduling and appointment checks while you are away from Aksara. We use Calendar data for booking features and related support, not advertising or sale. Human access is limited to your specific permission, necessary security investigations, or legal obligations. Aksara's use and transfer of information from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Any transfer of this Google data as part of a business sale requires your prior consent.

You can disconnect Calendar in Bookings settings or revoke access in your Google Account connections. Disconnecting in Aksara pauses new bookings immediately and queues credential revocation and deletion. If Google is temporarily unavailable, that cleanup is retried. Disconnecting does not cancel existing appointments or delete their meeting links, payment records or support history. Those records remain available for existing purchases and follow the retention rules below. You can contact support to request eligible data deletion.

Calendar permission does not subscribe anyone to marketing. Marketing choices are separate from booking agreements and privacy notices. See paid call setup and booking cancellations for the booking workflow.

We disclose information to the creator involved in a purchase, service providers working for us, payment and fraud providers, professional advisors, a buyer's authorized representative, and authorities or other parties when required by law or needed to protect rights and safety.

If Aksara is involved in a merger, financing, acquisition, reorganization, or sale of assets, information may be disclosed as part of that transaction subject to appropriate confidentiality and legal requirements.

Required authentication cookies keep signed-in users logged in. Optional analytics storage helps us understand product usage. You can change analytics preferences from Cookie settings in the site footer or account page. Ahrefs traffic analytics is cookieless.

A creator can see order details needed to fulfill and support a sale, including buyer email, purchased product, amount, refund status, and delivery state. A creator must use buyer data only for the transaction, support, legal obligations, and communications the buyer has requested.

Account and store data is kept while the account is active. Security logs, payment records, order snapshots, refunds, disputes, and tax or accounting records may be retained after account closure when needed for legal obligations, fraud prevention, buyer support, or enforcement. Public pages are removed from Aksara when an eligible deletion is completed, but external caches may take longer to update.

Retention periods depend on the type of record, legal requirements, active disputes, fraud risk, and whether the data is still needed for the purpose collected. We delete or anonymize data when it is no longer needed, subject to backup and legal-retention cycles.

We use access controls, row-level database policies, Stripe-hosted payment collection, private object storage, signed download links, and restricted server credentials. No online service can guarantee absolute security. Contact us promptly if you believe an account or purchase has been compromised.

Account settings provide data export and deletion controls. Depending on where you live, you may also have rights to access, correct, delete, restrict, or object to processing, and to receive a portable copy of your data. Some financial or security records may need to be retained even after a deletion request.

Send privacy requests to support@aksara.so. We may need to verify your identity before acting on a request.

Residents of states with applicable privacy laws may also have the right to confirm processing, correct information, request deletion or a portable copy, opt out of certain targeted advertising, sale, or profiling, and appeal a denied request. Aksara does not sell personal data. We will not discriminate against a person for using an applicable privacy right.

Aksara is not directed to children under 13. Seller accounts are for adults who can enter a binding agreement. Contact us if you believe a child provided personal data without appropriate consent.

We may update this policy as the service changes. Material changes will be communicated through the product, email, or an updated notice on this page.

Questions can be sent to support@aksara.so.