Privacy Policy
Your business data is sensitive. This policy explains, in plain language, what we collect, who processes it, how we protect it, and the rights you have.
Summary of key points
This summary highlights the points people ask about most. The full policy below is the controlling document.
- Your data is yours — we do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use your private conversations or business content to train AI models.
- It's encrypted — messages, notes, files, integration tokens, phone numbers, and voice recordings are encrypted at rest, and all traffic is encrypted in transit.
- You stay in control — you connect only the tools you choose, you can disconnect any of them at any time, and you can export or delete your data.
- We use trusted providers — to run the service we rely on a defined set of sub-processors (AI model providers, cloud hosting, payments, messaging, and email), each named below and bound to protect your data.
- You have rights — depending on where you live, you can access, correct, delete, or port your data, and opt out of certain processing. See “Your privacy rights,” “U.S. state privacy rights,” and “European and UK privacy rights.”
Overview
This Privacy Policy explains how Praxivara ("Praxivara", "we", "us", or "our") collects, uses, discloses, and protects information when you use our AI business assistant, our websites, and related services (collectively, the "Service").
Praxivara is designed to be privacy-first: your business data is yours, it is encrypted at rest, and we do not sell it or use it to train AI models. By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.
Who we are and our role
Praxivara provides an AI assistant that can understand your requests and take actions across the third-party tools you choose to connect.
For the personal data we process on our own behalf — such as your account, billing, and security information — Praxivara acts as the data controller. For the business content you route through the Service to your connected tools (the emails, files, calendar events, records, and messages the assistant reads or writes on your instruction), we generally act as a data processor acting on your behalf. If you use Praxivara as part of an organization, that organization is the controller of the business content and you should also review its own privacy notice.
Information we collect
We collect the following categories of information, limited to what we need to operate the Service:
- Account information — your name, email address, password (stored only as a secure one-way hash), profile details, time zone, language, and authentication settings, including two-factor configuration.
- Billing information — your subscription plan, billing status, billing address, tax status, and payment metadata. Card numbers are handled directly by our payment processor; we never store full card details on our systems.
- Conversations and content — the messages you send, the files and images you upload or that the assistant generates, and the notes, tasks, reminders, contacts, and meetings you create. Message and note contents are encrypted at rest.
- Connected-services data — when you connect an integration, we access and act on the data in that tool as you direct, and we store encrypted authorization tokens and the minimum metadata needed to act on your behalf. We never receive or store your third-party passwords.
- Voice and calls — if you use voice or phone features, the audio, recordings, and transcripts of those calls, along with the phone numbers involved. See “Voice and call recording.”
- Email (Praxivara Mail) — if you use our hosted inbox feature, the emails you send and receive through it, including their contents and attachments, which are encrypted at rest.
- Technical, device, and security data — device and browser details, IP address, approximate (city-level) location derived from your IP, network characteristics, session and login history, and request logs used for security, fraud prevention, new-device detection, and reliability.
- Usage data — feature usage, model selections, and credit and storage consumption, used to operate billing and improve performance.
- Assistant memory — if you enable memory, facts and preferences the assistant retains to personalize its help. You can turn memory off or clear it at any time.
- Support communications — the messages, tickets, and any attachments you send when you contact support or use in-product chat.
How we use your information
We use your information for the following purposes:
- To provide the Service — running your assistant, executing the actions you request, and connecting to the tools you authorize.
- To secure your account — detecting suspicious activity, managing sessions, sending new-device alerts, and enforcing two-factor authentication.
- To handle billing — managing subscriptions, trials, credits, storage, taxes, and invoices through our payment processor.
- To communicate with you — sending transactional, security, and service messages, and — only where you have not opted out — product updates you have chosen to receive.
- To provide support — responding to your questions and troubleshooting issues.
- To improve the product — diagnosing issues and improving performance and reliability. We do not use your private conversations or business content to train AI models.
- To comply with law — meeting legal obligations, enforcing our Terms, and protecting the rights and safety of our users and the public.
Legal bases for processing
Where the GDPR or similar laws apply, we rely on the following legal bases, matched to the purposes above:
- Performance of a contract — to create your account and provide the Service you have signed up for.
- Legitimate interests — to secure, maintain, debug, and improve the Service, prevent fraud and abuse, and communicate with you about it — balanced against your rights.
- Consent — for optional processing, such as connecting an integration or receiving optional product emails. You may withdraw consent at any time.
- Legal obligation — to comply with applicable laws, respond to lawful requests, and keep records we are required to keep.
AI features and model training
Praxivara does not use your private conversations or business content to train, develop, or improve generalized AI or machine-learning models.
To generate a response or complete a task, we send only the content necessary to fulfill your request to the AI model providers listed below, which process it on our behalf. We work with providers under business or enterprise terms that, by their terms, do not use content submitted through their APIs to train their publicly available foundation models. This is a contractual commitment we rely on, not something we can independently guarantee on the providers' systems; we keep our provider list current and choose providers whose terms protect your data. AI outputs can be inaccurate — see our Terms for how they should be relied on.
AI model providers
To deliver AI features, the Service sends the content needed to fulfill your request to trusted AI providers that process it on our behalf. We send only what is necessary to complete the task. The providers that may process your requests include:
- Anthropic — large language models (the Claude family) used for chat, reasoning, tool use, agents, and the secure code-execution sandbox.
- OpenAI — large language models, voice transcription and real-time voice, and image generation.
- Google — large language models (the Gemini family) and related cloud AI services.
- xAI — large language models (the Grok family) used for chat, reasoning, and tool use.
These providers act as sub-processors and are contractually restricted to using the data solely to provide their services to us, and not to train their publicly available foundation models. Provider availability may change over time as we add or replace vendors to improve quality, reliability, and privacy.
Infrastructure and operational sub-processors
In addition to the AI providers above, we rely on a defined set of providers to host and operate the Service. Each processes data only as needed to provide its service to us, under confidentiality and data-protection obligations. We maintain the current list on our Trust Center; the principal categories are:
- Cloud hosting and storage — DigitalOcean — compute, managed databases, object storage, and caching that run the application and store your data.
- Payments — Stripe — to process payments, taxes, and subscriptions securely. Full card data is handled by Stripe, not by us.
- Messaging and telephony — Twilio and Linq — to deliver SMS/MMS and voice calls, verification codes, and iMessage where you use those channels. WhatsApp and Telegram messaging are delivered over their respective networks when you connect them.
- Email delivery — Postmark and Resend — to send transactional and security email, and to power the Praxivara Mail inbox feature.
- Integration connectivity — Pipedream — an integration platform that helps broker authorized connections and actions for certain third-party business tools you connect.
- Web search and data — including Brave Search and Firecrawl — to run the web searches and public-web data lookups you or your agents request.
- Security and anti-abuse — IPinfo, NeverBounce, and hCaptcha — for IP geolocation and new-device detection, email-address verification, and bot protection on our forms.
We may update our sub-processors from time to time to improve quality, reliability, and security. Business customers can request advance notice of material sub-processor changes through our Data Processing Addendum.
Third-party integrations
When you connect a third-party tool, you authorize Praxivara to access and act on the data in that tool on your behalf. That data is also governed by the third party's own privacy policy and terms. We access only the permissions (scopes) you grant at the time you connect, and we use them only to perform the actions you request. You can disconnect an integration at any time from the Integrations page, which revokes our ongoing access.
Authorization tokens for your connected tools are encrypted at rest. For certain integrations, connection and action requests are brokered by our integration connectivity provider, which holds the authorization on our behalf; in those cases we store only the identifiers needed to route your requests.
Google user data and Limited Use
When you connect a Google account, Praxivara accesses Google user data only to provide the assistant features you request, and only within the scopes you grant. The scopes we may request are:
- Gmail (gmail.modify) — to read, search, summarize, send, forward, draft, label, and organize the messages you ask the assistant to handle. This scope cannot permanently delete messages or change account settings.
- Google Drive (drive) — to find, open, read, create, rename, move, copy, organize, and share the files you ask the assistant to work with. We request full Drive access because the assistant must act on your pre-existing files, not only files it created; the narrower drive.file scope cannot find or read files the app did not originate.
- Google Calendar (calendar) and Meet (calendar.events) — to check availability and create, edit, reschedule, respond to, or delete the events you ask the assistant to manage, and to create meeting links.
- Google Contacts (contacts) — to look up, create, and update the people you ask the assistant to address or manage.
- Google Docs (documents) and Sheets (spreadsheets) — to read, create, and edit the documents and spreadsheets you ask the assistant to work on, with per-file Drive access (drive.file) to the files involved.
- Google Tasks (tasks) — to create, organize, and complete the task lists and tasks you ask the assistant to manage.
- Email address (userinfo.email) — to show which Google account is connected.
How we use it: we use Google user data solely to provide or improve the user-facing features you invoke in the app across Gmail, Drive, Calendar, Contacts, Docs, Sheets, Tasks, and Meet. We do not use Google user data for advertising of any kind, we do not sell it, and we do not use it to develop, improve, or train generalized or non-personalized AI or machine-learning models.
How we store and protect it: authorization tokens are encrypted at rest and transmitted only over TLS. We never receive or store your Google password. Content from your Google services is processed to fulfill your request and is not retained beyond what is needed to provide the feature. Humans do not read your Google user data except with your affirmative consent (for example, when you contact support and ask us to look at something), where necessary for security or to comply with law, or in aggregated or anonymized form for internal operations.
How we share it: we do not transfer or disclose Google user data to third parties except as needed to provide the features you request (for example, to the AI model provider that generates a summary or reply on our behalf, under terms that prohibit using your data to train their models) or where required by law. You can disconnect Google at any time from the Integrations page, which immediately revokes our access.
Praxivara's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Microsoft (Outlook) user data
When you connect a Microsoft account for Outlook Mail or Outlook Calendar, we access Microsoft Graph data only to provide the features you request, within the permissions you grant:
- Mail (Mail.ReadWrite, Mail.Send) — to read, organize, draft, and send the messages you ask the assistant to handle in your connected mailbox.
- Calendar (Calendars.ReadWrite) — to check availability and create, edit, reschedule, or delete the events you ask the assistant to manage.
- Sign-in and profile (openid, email, User.Read, offline_access) — to complete sign-in, show which account is connected, and maintain your connection so the assistant can act on your behalf until you disconnect.
We use Microsoft user data only to provide these features, never to train AI models or for advertising. Tokens are encrypted at rest, we never receive your Microsoft password, and you can disconnect at any time to revoke access.
SMS and mobile information
If you opt in to text messaging, this section explains how we handle your mobile information for the Praxivara SMS notifications program.
- What we collect — your mobile phone number and your SMS opt-in consent.
- How it's used — only to send the account and assistant messages you signed up for — login codes, account and security alerts, agent activity notifications, reminders, and conversational replies.
- Message frequency — message frequency varies by your account activity.
- Cost — message and data rates may apply.
- STOP — reply STOP at any time to cancel.
- HELP — reply HELP for help, or contact [email protected].
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent will not be shared with any third parties. We share your mobile number only with the messaging providers that deliver these messages for us, and as needed to operate the program.
Voice and call recording
If you use Praxivara's voice or phone features, we process the audio of those calls. Depending on the feature and your settings, calls may be recorded and transcribed so the assistant can act on what was said, produce a summary, and keep a record you can review.
Recordings and transcripts are encrypted at rest, and where a recording is created through a telephony provider we remove the provider's copy after we retrieve it. Where a call plays a recording notice, that notice is your and your callers' indication that the call is being recorded.
Recording laws vary by state and country, and some require the consent of all parties. If you configure an AI agent to place or receive calls, you are responsible for complying with all applicable call-recording and consent laws, including obtaining any consent required from the other party. See our Terms for more.
International data transfers
We are based in the United States, and we and our providers may process and store information in the United States and other countries. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses and, where applicable, the UK Addendum — to protect that data.
Data security
We take reasonable technical and organizational measures to protect your information. Messages, notes, uploaded and generated files, integration tokens, phone numbers, and voice recordings and transcripts are encrypted at rest, and all traffic is encrypted in transit using TLS. We enforce session management, offer two-factor authentication, and restrict internal access. No system is perfectly secure, but we work to protect your information and to respond quickly if an issue arises. See our Security page for more detail.
Data retention
We retain your data for as long as your account is active or as needed to provide the Service, and then delete or de-identify it, except where we must keep limited information to comply with legal obligations, resolve disputes, or enforce our agreements.
You can delete individual conversations, files, and records at any time, and you can clear the assistant's memory. Server access logs are retained for a limited period (up to about 90 days) for security and reliability. When you delete your account, we permanently delete your content and the data we hold about you, revoke our access to your connected tools, and cancel billing, subject to the limited legal-retention exceptions above.
Your privacy rights and choices
Depending on where you live, you may have some or all of the following rights over your personal data:
- Access and portability — to know what personal data we hold and to receive a copy.
- Correction — to fix inaccurate or incomplete data.
- Deletion — to have your personal data deleted.
- Objection and restriction — to object to or restrict certain processing.
- Withdraw consent — to withdraw consent you previously gave, without affecting processing already carried out.
You can exercise many of these directly in the app — editing your profile, disconnecting integrations, managing email preferences, clearing history, or deleting your account. You can also contact us at [email protected]. We will respond consistent with applicable law and may need to verify your identity first. We will not discriminate against you for exercising your rights.
U.S. state privacy rights
If you are a resident of California or another U.S. state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Texas, or Utah), you have additional rights, including the right to know, access, correct, delete, and obtain a portable copy of your personal information, the right to opt out of the sale or sharing of personal information and of targeted advertising, and the right to appeal a decision on your request.
In the prior 12 months, we collected the categories of personal information described in “Information we collect” — including identifiers (such as name, email, and IP address), customer records, commercial and billing information, internet and network activity, approximate geolocation, audio (for voice features), professional information, and inferences drawn to personalize the Service. We collect this information from you, from your devices and use of the Service, and from the tools you connect, and we use and disclose it for the business purposes described in this policy.
- We do not sell or share — we have not sold your personal information or shared it for cross-context behavioral advertising in the preceding 12 months, and we do not do so. Where required, we honor the Global Privacy Control (GPC).
- Sensitive information — we use sensitive information (such as account credentials and, for voice features, audio) only to provide and secure the Service — not to infer characteristics about you. California residents may request that we limit its use.
- Authorized agents — you may use an authorized agent to submit a request on your behalf; we may ask for proof of authorization and to verify your identity.
- Appeals — if we decline your request, you may appeal by replying to our decision. If we deny your appeal, you may contact your state attorney general.
To exercise these rights, email [email protected] or use the in-app controls. We respond within the timeframe required by law (generally 45 days, extendable where permitted). Note that in California, business-contact and workforce personal information is also covered.
European and UK privacy rights
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the rights described in “Your privacy rights” above under the GDPR and UK GDPR, including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.
You also have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concerns first, so please consider contacting us before doing so. If we are acting as a processor on behalf of your organization, please direct requests to that organization, and we will assist it in responding.
Children's privacy
The Service is not intended for anyone under 18, and we do not knowingly collect personal data from individuals under 18. We collect date of birth at sign-up solely to verify that you meet this age requirement. If we learn that we have collected data from someone under 18, we will delete it.
Data Processing Addendum
If you use Praxivara on behalf of an organization and require a Data Processing Addendum (DPA) that reflects the GDPR and similar laws, we make one available. Contact [email protected] to put a DPA in place.
Changes to this policy
We may update this policy from time to time, and we review it at least annually. Material changes will be communicated through the app or by email. The "Last updated" date above reflects the most recent revision. Your continued use of the Service after an update takes effect constitutes acceptance.
Contact us
Questions about this policy or your data, or want to exercise a right? Email us at [email protected] or reach out through our contact page, and our team will respond promptly.
You can also reach us by mail at: Praxivara, 228 Park Ave S #647660, New York, New York 10003, United States.