Privacy policy

Last updated November 8, 2026

Paivo runs a white-label AI assistant that agencies brand as their own and sell to their clients. This policy explains what we collect, why, who we share it with, how long we keep it, and the choices you have. It covers paivo.co, the Paivo console at dashboard.paivo.co, and the assistant we run for agencies under their brands.

Who is responsible for your data

For agencies that sign up with us, and for visitors to paivo.co, Paivo decides how personal data is used.

When you use an assistant your agency or IT provider gave you, that agency is responsible for your data, and we process it on its behalf. Its own privacy policy applies to you. Ask the agency first about your data; we help agencies answer those requests.

What we collect

Agency accounts

Your name, email address and role, and your agency’s name.
Your brand: assistant name, logo, colours and domains, and the support contact you give clients.
When you last signed in, and a log of changes made to your agency and clients, with who made them.

People at an agency’s clients

Name, email address, role, the client they belong to, and the time zone their browser reports.
Conversations: their messages, the assistant’s replies, and the results of the tools it used.
Files they attach, and files the assistant makes for them.
Help requests they send their agency, and their notifications.
Credit use for each request: the model, the tokens and the cost.

Connected accounts and tools

When a business connects its Google Workspace or Microsoft 365 account, or another tool through an MCP server, we store the access tokens or credentials it gives us, encrypted. The assistant then reads and acts on that account only as needed to answer the person using it. See “Google user data” below.

Payments

Payments go through Stripe. We store Stripe’s identifiers for customers, cards and subscriptions, never card numbers. A managed agency’s clients pay into the agency’s own Stripe account.

Emails we send

We keep a copy of each email we send, such as sign-in codes, invitations and notifications.

Technical data

Our servers log each request’s IP address, path, status and time. Our monitoring records how requests performed, with internal IDs for the agency, client and person, but not the content of messages.

paivo.co

paivo.co has no forms, no analytics and no cookies. It loads fonts from Google Fonts, so your browser contacts Google when you open it. If you email us, we keep the email.

Cookies and browser storage

The console and the assistant set one cookie, session, which keeps you signed in. It can’t be read by scripts, and it expires 30 days after you last use it. They also keep unsent message drafts and sign-in steps in your browser’s storage. We use no advertising or analytics cookies.

How we use it

To run the service: sign you in, answer messages, run tools, store files and show usage.
To bill agencies and their clients.
To send emails the service needs, such as sign-in codes and notices about credits and payments.
To support agencies, fix problems, and keep the service secure.
To meet legal obligations.

We don’t sell personal data, use it for advertising, or train AI models on it.

AI models

To answer a message, we send the conversation, the files the assistant reads, and the results of the tools it used to OpenRouter, which passes them to the model provider the agency chose, such as OpenAI, Anthropic or Google. Web searches go through OpenRouter to Exa.

Those providers handle the data under their own terms. That includes how long they keep it, and whether they may use it to improve their models. An agency that uses its own OpenRouter key, or a client’s, controls those settings in that OpenRouter account.

What agencies can see

An agency can see its clients’ people, their credit use, and the help requests they send it. A help request can share the conversation it’s about. An agency admin can also sign in as someone at a client to help them, for up to an hour at a time, with a banner on screen, and see what that person sees. Each of these sign-ins is recorded in the agency’s activity log.

Who we share it with

We share personal data only with the services that run Paivo, under their terms, and only as much as each needs:

Amazon Web Services, in the United States: servers, database, file storage, backups, email delivery and logs.
Cloudflare: network security, encryption in transit, and agencies’ custom domains.
OpenRouter, the model providers it routes to, and Exa for web search.
Fly.io: the isolated sandboxes where the assistant runs code on files.
Ably: delivering replies to the browser as they’re written.
Stripe: payments.
Dash0: monitoring.
Google: sign-in with Google, Google Workspace when a business connects it, Google Fonts, and our own email inbox.
Microsoft: Microsoft 365, when a business connects it.
Netlify: hosting paivo.co.

We also disclose data when the law requires it, to protect people or the service, or as part of a merger or sale of Paivo, under this policy.

Google user data

People can sign in to an assistant with Google. Then we receive only their name and email address.

A business can also connect its Google Workspace account through its own Google OAuth app. The assistant can then read Gmail and write drafts, read and change Calendar events, and read Drive files and create new ones.

We use this data only to do what the person asks the assistant to do. To answer, it goes to the AI model as described above.
We don’t sell it, use it for advertising, or use it to train AI models.
No one at Paivo reads it, unless the person asks us to, it’s needed for security, or the law requires it.
Disconnecting the account removes our access at Google.

How long we keep it

Accounts: while the agency’s account is open. Someone removed from an agency or client can no longer sign in. We keep their record so history and the activity log stay accurate. Ask us to erase it.
Conversations: until someone deletes them. We erase a deleted conversation, with its files, 14 days later.
Sandboxes: deleted after 7 days without use.
Backups: 30 days.
Server logs: 30 days.
Payment records: as long as tax and accounting rules require.
Closed accounts: when an agency closes its account, we delete its data and its clients’ data within 30 days of its request, except what the law requires us to keep.

Security

Traffic is encrypted in transit. Account and tool credentials are encrypted at rest, and sign-in sessions are stored only as hashes. Stored files and backups are encrypted. The assistant runs code in a separate microVM for each conversation, with restricted network access. Only Paivo staff who need it can reach production systems. No system is perfectly secure; if a breach affects your data, we’ll tell the affected agencies without undue delay.

Your choices

You can ask to see, correct, export or delete your personal data, or object to how we use it. Agency users can email us at ani@paivo.co. If you use an assistant from an agency, contact that agency, and we’ll help it respond. We won’t treat you differently for asking.

Where data is stored

We store and process data in the United States. Some of the services above may process it elsewhere.

Children

Paivo is for businesses. It isn’t meant for anyone under 18, and we don’t knowingly collect children’s data.

Changes

We’ll post changes here and update the date at the top. If a change matters, we’ll also email agencies before it takes effect.

Contact

Questions about this policy: ani@paivo.co.