Privacy Policy
Last updated: July 13, 2026
Your business data is sensitive. This policy explains, in plain language, what we collect, who processes it, and how we protect it.
Overview
This Privacy Policy explains how Praxivara ("Praxivara", "we", "us", or "our") collects, uses, discloses, and protects information when you use our AI business assistant, our websites, and related services (collectively, the "Service").
Praxivara is designed to be privacy-first: your business data is yours, it is encrypted at rest, and we do not sell it or use it to train AI models. By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.
Who we are
Praxivara provides an AI assistant that can understand your requests and take actions across the third-party tools you choose to connect. For the personal data we process on our own behalf (such as your account and billing details), Praxivara acts as the data controller. For the business content you route through the Service to your connected tools, we generally act as a data processor acting on your instructions.
Information we collect
We collect the following categories of information, limited to what we need to operate the Service:
- Account information — your name, email address, password hash, and authentication details (including two-factor settings) needed to create and secure your account.
- Billing information — your subscription plan, billing status, and payment metadata. Card numbers are handled directly by our payment processor; we do not store full card details on our systems.
- Conversations and content — the messages you send, files you upload or that the assistant generates, notes, tasks, reminders, and the actions you ask the assistant to perform. Message and note contents are encrypted at rest.
- Connected services data — when you connect an integration, we store encrypted OAuth tokens and the minimum metadata needed to act on your behalf. We never receive or store your third-party passwords.
- Technical and security data — device, browser, IP address, approximate location derived from IP, and session information used for security, fraud prevention, and reliability.
- Usage data — feature usage, model selections, and credit consumption used to operate billing and improve performance.
AI model providers and sub-processors
To deliver AI features, the Service sends the content needed to fulfill your request to trusted third-party providers that process it on our behalf. We send only what is necessary to complete the task, and we work with providers that offer business / enterprise terms designed to protect your data. The providers that may process your requests include:
- Anthropic — large language models (the Claude family) used for chat, reasoning, and tool use.
- OpenAI — large language models, voice transcription and real-time voice, and image generation.
- Google Cloud / Google Gemini — large language models (the Gemini family) and related cloud AI services.
- Twilio (messaging services) — used to deliver messaging and related communications where applicable.
These providers act as sub-processors and are contractually restricted to using the data solely to provide their services to us. We rely on their business / API terms, under which submitted content is not used to train their publicly available foundation models. Provider availability may change over time as we add or replace vendors to improve quality, reliability, and privacy.
Infrastructure and operational providers
We also rely on a small set of providers to host and operate the Service. They process data only as needed to provide their services to us, under confidentiality and data-protection obligations:
- Hosting and platform infrastructure — to run the application, database, and backend functions.
- Stripe — to securely process payments and manage subscriptions.
- Email delivery providers — to send transactional and security emails (such as sign-in alerts and account notifications).
- IP geolocation providers — to resolve approximate location from IP addresses for security and new-device detection.
How we use your information
We use your information for the following purposes:
- To provide the Service — running your assistant, executing the actions you request, and connecting to the tools you authorize.
- To secure your account — detecting suspicious activity, managing sessions, sending new-device alerts, and enforcing two-factor authentication.
- To handle billing — managing subscriptions, trials, credits, and invoices through our payment processor.
- To communicate with you — sending transactional, security, and service-related messages.
- To improve the product — diagnosing issues and improving performance and reliability. We do not use your private conversations to train AI models.
- To comply with law — meeting legal obligations and enforcing our Terms.
Legal bases for processing
Where the GDPR or similar laws apply, we process personal data on the following legal bases: performance of our contract with you (to provide the Service), our legitimate interests (to secure, maintain, and improve the Service), compliance with legal obligations, and your consent where required (for example, when you connect an integration). You may withdraw consent at any time by disconnecting an integration or closing your account.
SMS / Mobile Information
If you opt in to text messaging, this section explains how we handle your mobile information for the Praxivara SMS notifications program.
- What we collect — your mobile phone number and your SMS opt-in consent.
- How it's used — only to send the account and agent messages described above — login codes, account and security alerts, agent activity notifications, reminders, and conversational replies.
- STOP — reply STOP to cancel at any time.
- HELP — reply HELP for help, or contact [email protected].
Mobile information and SMS opt-in consent will not be shared with or sold to third parties or affiliates for marketing or promotional purposes.
Text messaging originator opt-in data and consent is not shared with any third parties.
Third-party integrations
When you connect a third-party tool, you authorize Praxivara to access and act on the data in that tool on your behalf. That data is governed by the third party's own privacy policy and terms. We access only the scopes you grant and use them only to perform the actions you request. You can disconnect an integration at any time, which revokes our ongoing access.
Google user data and Limited Use
When you connect a Google account, Praxivara accesses Google user data only to provide the assistant features you request, and only within the scopes you grant.
- Gmail (gmail.modify) — the content, headers, and labels of messages you ask the assistant to read, search, summarize, send, forward, draft, or organize.
- Google Drive (drive) — the files and folders in your Drive that you ask the assistant to find, open, read, create, rename, move, copy, organize, or share. We request full Drive access because the assistant must act on your pre-existing files, not only files it created; the narrower drive.file scope cannot find or read files the app did not originate.
- Google Calendar (calendar) — your calendars and events, to check availability and create, edit, reschedule, respond to, or delete events you ask the assistant to manage.
- Google Contacts (contacts) — your contacts, to look up, create, and update the people you ask the assistant to address or manage.
- Google Docs (documents) — the documents you ask the assistant to read, create, or edit.
- Google Sheets (spreadsheets) — the spreadsheets, rows, and cells you ask the assistant to read, create, or edit.
- Google Tasks (tasks) — the task lists and tasks you ask the assistant to create, organize, or complete.
- Email address (userinfo.email) — your Google address, so we can show which account is connected.
How we use it: we use Google user data solely to operate the user-facing features you invoke in the chat across Gmail, Drive, Calendar, Contacts, Docs, Sheets, and Tasks. We do not use Google user data for advertising of any kind, and we do not use it to develop, improve, or train generalized or non-personalized AI or machine-learning models.
How we store and protect it: OAuth access and refresh tokens are encrypted at rest and transmitted only over TLS. We never receive or store your Google password. Content from your Google services is processed transiently to fulfill your request and is not retained beyond what is needed to provide the feature.
How we share it: we do not sell Google user data, and we do not transfer or disclose it to third parties except as needed to provide the features you request (for example, the AI model provider that generates a summary or reply on our behalf, under terms that prohibit using your data to train their models) or where required by law. You can disconnect Google at any time from the Integrations page, which immediately revokes our access.
Praxivara's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
International data transfers
We and our providers may process and store information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) to protect international transfers of personal data.
Data security
Messages and notes are encrypted at rest. All traffic is encrypted in transit using TLS. Integration tokens are encrypted, and we enforce session management and optional two-factor authentication. While no system is perfectly secure, we take reasonable measures to protect your information. See our Security page for more detail.
Data retention
We retain your data for as long as your account is active or as needed to provide the Service. You can delete conversations at any time, and you may request deletion of your account and associated data by contacting us. We may retain limited information where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.
Your rights and choices
Depending on your location, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You may also have the right to lodge a complaint with a supervisory authority. To exercise these rights, contact us through our contact page. We will respond consistent with applicable law.
Children's privacy
The Service is not intended for anyone under 18, and we do not knowingly collect personal data from individuals under 18. If we learn that we have collected such data, we will delete it.
Changes to this policy
We may update this policy from time to time. Material changes will be communicated through the app or by email. The "Last updated" date above reflects the most recent revision. Continued use after an update constitutes acceptance.
Contact us
Questions about this policy or your data? Email us at [email protected] or reach out through our contact page, and our team will respond promptly.