tavya

Privacy Policy

Version 2026-11-02.1 · Effective November 2, 2026

What tavya processes, why, where providers fit, and the choices available to you.

Roles and data categories

For account, authentication, support, product telemetry, and billing records, the configured service operator generally determines why and how data is processed.

For repository, prompt, task, workspace, credential, and output data a customer submits under a controller/processor relationship, the customer determines the purpose and the operator processes that data on its behalf. The Data Processing Addendum applies to that processing, including where the customer is itself a processor for another controller. Roles depend on the actual processing, not just whose API key is used.

  • Account data: name, email, login providers, memberships, preferences, sessions, and security events.
  • Billing data: plan, price, renewal state, payment-provider customer/subscription references, acceptance evidence, refunds, and support history. The checkout payment provider handles subscription card details; tavya does not store full subscription payment-card numbers.
  • Customer workspace data: repository files and metadata, prompts, tasks, messages, outputs, environment state, attachments, connected-service data, and audit events.

How data is used

Data is used to provide and secure the service, execute customer instructions, authenticate users, administer subscriptions, respond to support and legal requests, prevent abuse, and maintain reliable operations. This draft does not authorize selling personal data or using private customer repository/workspace content to train general-purpose models.

Lawful bases and required information

Where the operator acts as controller under UK data protection law, account administration and providing a service you request rely on performance of a contract or steps you ask us to take before a contract. Tax, accounting and responses to binding legal requirements rely on compliance with legal obligations.

Security, fraud prevention, service reliability and administration of business-customer contacts rely on legitimate interests in protecting the service and communicating with customers, balanced against individuals’ rights. Where an activity instead requires consent, we must ask separately before starting it; accepting these Terms or this Privacy Policy is not blanket consent to optional tracking or marketing.

Authentication and necessary account or billing information are required to provide the corresponding service. If you do not provide them, we may be unable to create your account, supply a paid subscription or resolve a support request. Optional integrations and their credentials are not required unless you choose to use those integrations.

Sources of information

We receive information from you, your organization’s administrators and invited members, and the identity, repository, model and other services that you authorize us to connect. Those services may supply profile identifiers, access permissions and the records requested by your tasks. Payment providers supply subscription and transaction status. Service operation also generates security and diagnostic records.

Model keys and usage modes

With bring-your-own-key (BYOK), tavya stores the customer-supplied secret in its encrypted credential system and sends selected prompts, context, and files to the model provider the customer chose. Charges and provider data terms belong to that customer account.

With a customer-connected OpenAI, Anthropic, or other subscription login, tavya operates the provider client under that customer connection. With managed usage, the operator supplies the provider account and the provider acts as an applicable subprocessor. The UI must identify the active rail; no mode prevents the chosen provider from receiving the content needed for the request.

Sharing, transfers, and retention

Data is shared with subprocessors only for the service functions described on the Subprocessor list, with customer-selected integrations, when a customer directs, or when legally required. Providers may process data in the regions described by their own service terms and the applicable DPA.

There is no service-wide promise that all data stays in the UK or EEA. Model calls, sandbox execution and connected services may involve other countries. Where the operator is responsible for a restricted transfer, it must use an applicable adequacy decision or appropriate transfer safeguards; a customer instruction or a warning about overseas processing does not replace those requirements. Contact the privacy address for the safeguards applicable to an operator-arranged transfer and how to obtain a copy.

Retention, export, deletion, and backup behavior are described on Data controls. Contact the configured privacy address for access, correction, portability, objection, restriction, or other applicable privacy requests.

Customer-connected services and MCP

When you connect a repository, model account, MCP server or other integration, your authorized tasks may send it tool arguments, files, prompts or other selected information and receive information in return. Review the destination, its permissions and its own terms before allowing access. A connection is not permission for unrelated actions.

A service you independently engage is not automatically an operator subprocessor merely because tavya can connect to it. Conversely, a provider engaged by the operator to deliver the service remains its responsibility even when you choose it from a menu. Any intermediary used by the operator to broker a connection must also be accounted for.

Information returned by an integration may be retained in tavya tasks, conversations, logs or artifacts under Data controls. Disconnecting an integration does not erase those copies or records already held by the destination. The operator remains responsible for its own copies and for processing within its role; it cannot promise deletion from every independent service.

Your rights and complaints

Contact the privacy address shown on this page to request access, correction, erasure, restriction or portability where applicable. You may object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. We may need proportionate information to verify your identity and authority; some rights depend on the purpose and legal basis of processing.

For personal data controlled by your organization, direct requests to that organization; we assist it under the applicable processing agreement. You can also contact us so we can identify the appropriate route.

You may complain to the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or telephone 0303 123 1113. You do not have to complain to us first. You may also have the right to complain to the supervisory authority where you live or work.