Privacy Policy

Who we are

Sovra ("we", "us") operates the Sovra platform: an AI-native workspace where a team of agents with shared memory acts on your behalf. We are the controller of the personal data described here. You can reach us at shaun@sovra.ae.

What we collect

Account data: your name, email address, avatar and sign-in method, and the organisation you belong to if your workspace is managed by one.

Content you provide: messages, files, documents, spreadsheets, presentations and instructions you give to Sovra, and the memory Sovra builds from them so it can recall what matters to you later.

Connected service data: when you choose to connect a third-party account such as Google Workspace, Microsoft 365, WhatsApp, Telegram, Reddit or GitHub, we receive the data needed to carry out the actions you ask for. Each connection is optional and can be removed at any time from Settings.

Usage and device data: log, diagnostic and performance information about how the service behaves, used to keep it reliable and secure.

How we use it

To provide the service: run the agents you ask for, build and recall your memory, deliver notifications and sync the connected services you have enabled.

To keep the service safe and working: authenticate you, prevent abuse, debug failures and measure performance.

To communicate with you about the service, including security notices and material changes to these terms.

We do not sell personal data and we do not use your content or connected-service data to show you advertising.

Google user data

If you connect Google Workspace, Sovra asks Google for permission to the specific services you select: Drive, Gmail, Calendar, Contacts, Tasks, Sheets or Docs. You see the exact permissions on Google's consent screen and can grant a subset.

Sovra accesses Google data only to carry out requests you make in the product, such as finding a file, drafting or sending an email you asked for, reading or creating calendar events, or filling a spreadsheet. Access happens at the time of your request. We do not run background scans of your mailbox or files.

Sovra's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we only use Google user data to provide or improve user-facing features that are prominent in Sovra; we do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to you; we do not use it for advertising; and no human reads it unless you have given explicit permission for specific data, it is necessary for security purposes such as investigating abuse, it is required to comply with law, or it has been aggregated and anonymised for internal operations.

We do not use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models. When fulfilling your request requires an AI model, the relevant content is processed by our model providers under contracts that prohibit them from training on it.

Google access and refresh tokens are encrypted at rest and are used only to call Google APIs on your behalf. Disconnecting Google in Settings revokes the tokens with Google and deletes them from our systems, and you can also revoke access at any time from your Google Account permissions page.

Other connected services

Microsoft 365, WhatsApp, Telegram, Reddit and GitHub connections work the same way: credentials are encrypted at rest, access is limited to the actions you request, and disconnecting removes the credentials from our systems. Each provider's own privacy policy also applies to your use of their service.

Who we share data with

Service providers that process data on our behalf and under our instructions: Google Cloud for hosting, Supabase for database, authentication and storage, and AI model providers including Anthropic, Google and OpenAI for generating responses. Each is bound by contract to protect your data and to use it only to provide their service to us.

Your organisation, if your workspace is administered by one, for the data held in that workspace.

Authorities or other third parties where required by law, to protect the rights and safety of users, or in connection with a merger or acquisition, with notice to you where the law allows.

Retention and deletion

We keep your data for as long as your account is active or as needed to provide the service. You can delete individual conversations, memories and connected accounts at any time from within Sovra.

You can delete your account from Settings or by emailing shaun@sovra.ae. Account deletion removes your content, memory and connected-service credentials from our live systems within 30 days, after which they are purged from backups on their normal rotation.

Security

Data is encrypted in transit and at rest. Third-party credentials are additionally encrypted at the application layer. Access to production systems is restricted to authorised staff and is logged. No system is perfectly secure, so we also encourage you to use a strong, unique password and to review your connected services periodically.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. To exercise these rights, email shaun@sovra.ae. We respond within the period required by applicable law.

Children

Sovra is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We will post any changes on this page and update the date at the top. For material changes we will also notify you in the product or by email before they take effect.