Privacy Policy

Two different roles we play

This distinction determines which parts of this policy apply to you.

When we act as a controller. For information about the people who sign up for, buy, and administer the Services, including account details, billing data, website visitors, and marketing contacts, we decide how and why that data is used. Those activities are governed by this policy.

When we act as a processor. When your organization submits briefs, attachments, organizational context, or data pulled from your connected applications, we process that content on your organization’s instructions in order to produce deliverables. Your organization decides what goes in and why. Our handling of that content is governed by our contract with your organization, including any data processing addendum, and this policy describes it only for transparency. If you are an individual user under an organization’s account and want your content deleted or corrected, contact your organization’s administrator first.

1. Information we collect

You provide it directly

• Account and contact data. Name, work email, phone number, company name, role, and account credentials, collected when you create an account, start a trial, book a demo, or contact us.
• Billing data. Billing contact, billing address, tax details, and transaction records. Card numbers go directly to our payment processor. We do not store full payment card numbers.
• Inputs. Briefs, instructions, attachments, brand guidelines, organizational context, agent configuration, and any data retrieved from applications you connect at your direction. Inputs may contain personal data about your employees, customers, or prospects if you choose to include it.
• Outputs. Deliverables and other content the Services generate from your Inputs, including files stored in your Library.
• Support and communications. The content of emails, support requests, demo calls, and any messages you send us.
• Feedback. Ratings, bug reports, and suggestions. If you rate an Output, we may store the associated run so we can understand the rating.

We collect it automatically

• Device and connection data. IP address, approximate location derived from IP address, browser and device type, operating system, and referring URL.
• Usage data. Pages viewed, features used, tasks submitted, agents invoked, run duration, token consumption, and deliverable counts.
• Log and diagnostic data. Error events, stack traces, and performance traces. Our error monitoring is configured to strip the content of briefs and deliverables before transmission, so we receive the shape of an error rather than what you wrote.
• Cookies and similar technologies. Described in Section 7.

We receive it from third parties

• Connected applications. When you authorize a connection, we receive data from that application as needed to complete the work you requested.
• Payment and business tools. Our payment processor, CRM, and analytics providers return transaction status, engagement data, and similar operational information.
• Prospect data. For our own marketing, we use business contact data from commercial data providers. If you received an email from us and did not sign up, this is likely why, and every such message includes a way to opt out.

What we do not want you to send us

Do not submit health records, payment card data, government identification numbers, biometric data, or data about children through the Services unless we have agreed in writing in advance. Our Terms prohibit it, and we are not configured to handle those categories.

2. How we use information

• To operate the Services, route briefs to the right department, execute agent runs, and produce and store deliverables.
• To create and administer your account, authenticate users, and enforce plan entitlements.
• To meter usage and process billing, including trials, subscriptions, and overage.
• To provide support and respond to your requests.
• To monitor, secure, debug, and improve the Services, including analyzing aggregated usage patterns and error rates.
• To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms.
• To send you operational, security, and billing notices, which you cannot opt out of while you hold an account.
• To send marketing communications where you have opted in or where permitted by law, with an opt-out in every message.
• To comply with legal, tax, and accounting obligations, and to establish or defend legal claims.

We do not train AI models on your content

We do not use your Inputs or Outputs to train or fine-tune generative AI models, and our model providers do not train their generative models on data we transmit on your behalf. Those providers may transiently log inputs for their own safety and abuse monitoring, which is separate from training and is described in their own terms. We use aggregated, de-identified operational metrics, such as token counts, run duration, error rates, and feature adoption, to operate and improve the Services. Those metrics do not identify you and do not reveal the content of your briefs or deliverables.

We may access specific content only where necessary to investigate a suspected violation of our Terms, to respond to a support request you initiate, or to comply with law.

3. Agent actions and connected applications

The Services differ from a typical SaaS product in one way that matters for privacy: agents take actions in systems you connect.

When you authorize a connection, you direct us to send your Inputs, instructions, and generated content to that third-party application, and to retrieve data from it. That application receives the data directly and handles it under its own privacy policy, not ours. Some connections remain active until you disconnect them.

Credentials for connected applications are held by our integration provider on your behalf. We do not receive or store passwords for your third-party accounts.

Agent work runs inside an isolated execution environment created for that run and destroyed when the run finishes. Deliverables are moved to your Library before the environment is torn down. Nothing persists in the execution environment between runs.

Before you connect an application, confirm that you have authority to grant that access and that doing so is consistent with your own obligations to your customers and employees.

4. Who we share information with

We do not sell personal data for money. Our marketing website does use advertising platform tags, which under several state privacy laws counts as sharing personal data for targeted advertising. Section 8 explains what that means and how to opt out. We never sell or share the content you submit to the platform.

We share information with:

• Service providers. Hosting, database and storage, sandboxed execution, AI model providers, integration brokering, payment processing, analytics, error monitoring, email delivery, and CRM. Our current list is at alyvon.com/subprocessors. Each is bound by contract to use the data only to provide services to us.
• Our own sales and marketing tools. If you are a prospect rather than a customer, your business contact details may sit in our prospecting, outbound email, LinkedIn outreach, and CRM tools rather than in the platform itself. Those providers are listed in a separate section of the same subprocessor page so you can see where your data is held and exercise your rights over it.
• Your organization. If you use an account provisioned by your employer or client, administrators of that account can view, export, and delete content in it, including yours.
• Connected applications you authorize. As described in Section 3.
• Professional advisors. Lawyers, accountants, auditors, and insurers, under confidentiality obligations.
• Legal and safety recipients. Government authorities, law enforcement, and others where we have a good faith belief that disclosure is required by law or reasonably necessary to prevent serious harm, investigate fraud, or enforce our Terms.
• Corporate transactions. An acquirer or successor in a merger, financing, reorganization, or sale of assets, including a future reincorporation of the business.

5. Data retention

We keep personal data only as long as needed for the purposes described here.

Deletion requests are honored across live systems promptly and work through backups on the cycle above. We may retain data longer where required by law or where necessary to establish or defend a legal claim.

6. Your rights and choices

Depending on where you live, you may have the right to:

• Know what personal data we hold and how we use it.
• Access a copy of it, and receive it in a portable format.
• Correct inaccurate data.
• Delete data, subject to exceptions.
• Opt out of targeted advertising, sale, or sharing of personal data.
• Opt out of marketing communications at any time.
• Object to or restrict certain processing.
• Withdraw consent where processing relies on it.
• Appeal a denial of a request.

To exercise any of these, email privacy@alyvon.com. We will verify your identity before acting, usually by confirming control of the email address on the account. We respond within 45 days where US state law applies, and within one month where the GDPR or UK GDPR applies, with extensions where the law permits. We will not discriminate against you for exercising a right.

A note on accuracy. We cannot guarantee that AI-generated Outputs are factually accurate about any person. If an Output contains inaccurate personal data about you, tell us and we will make reasonable efforts to address it, but the nature of these systems means we cannot promise a specific correction will hold across future generations.

If your data is in a customer’s account, we will route your request to that customer, who is the controller of it.

7. Cookies and analytics

We use cookies and similar technologies for authentication and session management, for security, to remember preferences, and to measure how our website and product are used. Our marketing website uses a tag management container that loads analytics tags and advertising platform tags. Our application loads no advertising tags.

You can accept or decline non-essential cookies using the Your Privacy Choices link in our website footer, and you can change that choice at any time. You can also manage cookies through your browser. Blocking cookies that are strictly necessary will break parts of the Services.

8. US state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Florida, or another state with a comprehensive privacy law, the rights in Section 6 apply to you.

Categories collected, disclosed, and purposes are described in Sections 1, 2, and 4. We collect identifiers, commercial information, internet activity, geolocation inferred from IP address, professional information, and the content you submit.

Sale and sharing. We do not sell personal data for money. Our marketing website uses advertising platform tags, and that data flow counts as sharing personal data for cross-context behavioral advertising under the California Consumer Privacy Act, and as processing for targeted advertising under Colorado, Connecticut, Virginia, Texas, Oregon, and similar state laws. You may opt out at any time using the Your Privacy Choices link in our website footer, or by emailing privacy@alyvon.com. We honor Global Privacy Control signals sent by your browser. We do not sell or share the content you submit to the platform, and our application carries no advertising tags.

Sensitive personal data. We do not collect sensitive personal information for the purpose of inferring characteristics, and we do not use or disclose it beyond the purposes permitted without a right to limit.

Authorized agents may submit requests on your behalf with written proof of authorization.

9. International users and transfers

We operate from the United States, and our infrastructure and service providers are primarily located there. If you use the Services from outside the United States, your personal data is transferred to and processed in the United States, where data protection law differs from that of your country.

The Services are offered to businesses in the United States, and we do not currently market or target them to individuals in the European Economic Area, the United Kingdom, or Switzerland. If you access the Services from outside the United States, you do so on your own initiative. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we put an appropriate transfer mechanism in place before doing so.

Legal bases under the GDPR and UK GDPR. Where those laws apply, we process personal data on the basis of contract for providing and administering the Services and processing payment, legitimate interests for securing and improving the Services, preventing abuse, and marketing to business contacts, consent for optional cookies and certain marketing, and legal obligation for tax, accounting, and lawful requests.

You have the right to lodge a complaint with your local supervisory authority.

10. SMS and email communications

If you provide a phone number and opt in, we may send transactional SMS messages, such as appointment and demo reminders. We send marketing SMS only where you have given separate, specific consent. Transactional and marketing consent are collected separately and are never bundled into one checkbox. Message and data rates may apply. Reply STOP to opt out of SMS and HELP for assistance.

Marketing email includes an unsubscribe link and our physical postal address in every message. Unsubscribing from marketing does not stop operational, billing, or security notices while you hold an account.

11. Security

We maintain administrative, technical, and organizational safeguards designed to protect personal data, including tenant isolation and row-level access controls in our database, encryption in transit and at rest, isolated per-run execution environments, time-limited signed access to stored files, scoped credential brokering for connected applications, access logging, and content scrubbing before data reaches our error monitoring provider.

No system is completely secure and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal data, we will notify you without undue delay and as required by law.

12. Children

The Services are for business use and are not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, email privacy@alyvon.com and we will investigate and delete it where appropriate.

13. Changes to this policy

We may update this policy. We will change the effective date at the top and, for material changes, notify account holders by email or in-product notice before the change takes effect.

14. Contact

Skyyr Digital LLC, doing business as Alyvon

13256 Strode Ln, Windermere, FL 34786

Phone: 407-993-2979

Privacy and legal: privacy@alyvon.com

General and support: support@alyvon.com