Privacy Policy

SUVI ("we", "our", or "us") operated by SUVI PTE LIMITED is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services at suvi.ai.

We may collect the following types of information:

• Account Information: Name, email address, and profile details when you sign up or authenticate via Google OAuth.
• Usage Data: Information about how you interact with our platform, including pages visited, features used, and session duration.
• Device Information: Browser type, operating system, IP address, and device identifiers.
• Communications & Integrations: Data processed through connected services such as Slack, when you choose to integrate them with SUVI.
• Connected Google Data: With your permission, Suvi reads and searches Gmail, manages drafts and labels, sends messages, accesses Calendar events, and searches, reads and manages Drive files, including existing Google Sheets. These features can process data in the background when enabled. The access, purposes and deletion controls are described below.

• To provide, maintain, and improve our services.
• To authenticate your identity and manage your account.
• To communicate with you about updates, support, and promotional offers.
• To analyze usage patterns and improve user experience.
• To comply with legal obligations.

We do not sell your personal information. We may share your data with:

• Service Providers: Third-party services that assist in operating our platform (e.g., hosting, analytics). The specific sub-processors that may receive user-derived content are listed in the Sub-processors section below.
• Legal Requirements: When required by law, regulation, or legal process.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.

When you connect Google, you review and grant permissions through Google's consent screen. Suvi uses the granted access for the connected features you enable and request:

• Sign-in and email address (openid, userinfo.email): to identify your Google account and sign you in.
• Gmail access (gmail.modify): to read and search messages, classify incoming mail, prepare email briefs, extract tasks and commitments, create and manage reply drafts, apply or remove labels, and organize threads, including archiving and returning them to the inbox. This permission does not allow immediate, permanent deletion of messages that bypasses Gmail's trash.
• Gmail sending (gmail.send): to send messages and replies you request and approve. Send-only permission does not grant inbox reading or draft management.
• Calendar events (calendar.events): to read, create, update and delete events, respond to invitations, prepare meeting information and provide scheduling assistance.
• Full Google Drive access (drive): to search and read existing files you ask about, export documents for processing, upload files, create folders and manage sharing when requested. Existing Google Sheets can be imported as business data sources and kept in sync. This permission reaches beyond files created by Suvi or individually selected through a file picker.

Gmail, Calendar and Drive change notifications and polling may keep enabled features up to date while you are away. Google connections are associated with users in a company workspace. Workspace data and business records can be available to other workspace users according to their permissions.

Limited Use. Suvi's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train or fine-tune generalized AI or machine-learning models. AI processing for connected features is described in the Sub-processors section below.

Human access to Google user data is limited to cases permitted by Google's Limited Use requirements, such as your affirmative permission to access specific data, security investigations, or compliance with applicable law.

What we store. Google-derived data may include email subjects, sender details, message content and attachments used for processing, email briefs, reply drafts, sync cursors, calendar event details and meeting-preparation notes, meeting transcripts and audio, extracted tasks and memories, imported Drive or Sheet records, and downloaded files. Operational logs and assistant conversation history may quote Google content. Embeddings and other derived data are held in our own database; we do not use a third-party vector database service. OAuth tokens are stored to maintain the access you granted. Retention and the limits of deletion are described below.

Two different things can happen to your data, and we separate them below: providers we use to run the Service, and services you choose to connect.

Providers we use to operate Suvi. These receive data as part of normal operation:

• Open-weight AI models and inference providers: Suvi uses open-weight models for assistant responses, email classification, drafting, task extraction, document understanding and meeting notes. Depending on the enabled configuration, hosted inference can use OpenRouter to route requests to the provider running the selected model, including Parasail or CoreWeave. Conversation content and the Gmail, Calendar or Drive information needed for those features can be included in the request. Open model weights do not by themselves mean that processing is self-hosted or that no third party receives the data.
• Amazon Web Services: infrastructure, database and object storage used to run Suvi and store the data and files it processes on your behalf.
• WhatsApp (Meta) and Telegram: where you have connected a messaging channel, Suvi delivers notifications, replies and email briefs through it. Those messages can contain content drawn from your Gmail, Calendar and Drive.

Services you connect yourself. These are third-party accounts you already hold. Nothing is sent to them unless you connect the service and direct Suvi to use it, and you can disconnect any of them at any time:

• Fireflies: when connected, Suvi can call it during a conversation to read or create meeting notes. Because it is available to the assistant while it is working, content from the conversation - which may include Google data - can be sent to it.
• Notion, Zoho and LeadRat: used when you ask Suvi to write something to them, such as saving a note or pushing a lead. Content you direct Suvi to send may include Google-derived data.
• GitHub: optional backup of your assistant memory, which may contain user-derived facts, to a repository that you own and control. The transfer is over HTTPS and the contents are stored under your own account's access controls; Suvi does not add its own encryption layer to this backup.

The data you and the assistant generate, including Google-derived content, is also processed on Suvi's application infrastructure to provide the enabled features. The service providers listed above may process that content as part of operating the Service. We do not sell it or transfer it to data brokers or advertisers.

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL) and at rest. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

We retain Google-derived records to provide the features you enable until they are deleted through the applicable controls or a deletion request. Stored Google records do not have a single automatic expiry period. Short-lived processing caches have separate expiry settings: the pending Gmail queue expires after six hours without refreshed queue activity, and processed-message IDs expire after seven days without a refresh. These settings do not delete durable database records, conversation history or business records.

Disconnecting is different from deleting stored data. Disconnecting a Google account stops Suvi from using that connection for new access, but does not erase information already stored in Suvi. You can also revoke Suvi's access from your Google Account permissions. Revoking access there does not itself delete Suvi's stored copies.

Delete my Google data. The company workspace owner can use this action in Settings, preview the records to be removed and confirm deletion without deleting the Suvi account. This is a company-workspace action: it affects the workspace's Google connections and Google-derived data, including other connected users. It is not limited to one user's records.

The deletion process attempts to revoke connected Google grants, stop Gmail, Calendar and Drive change notifications, remove stored meeting audio, and delete the Google-derived database records, caches and files covered by the preview. These include email briefs and drafts, calendar records, meeting data, Google-derived tasks and memories, applicable workflow and import records, Gmail attachments and downloaded Drive files. The result reports anything that could not be confirmed as removed. A token whose revocation fails may be retained so revocation can be retried. Mixed WhatsApp or Telegram delivery queues are not cleared because they also carry non-Google messages.

The following data is retained after that action:

• Imported business records: products, inventory, stock movements, catalogue data and import recipes created from Drive or Sheets. These become independently maintained business records, and imported rows cannot reliably be separated from rows entered manually.
• Conversation history and operational logs: these may contain quoted Gmail, Calendar or Drive content. Derived information that is no longer attributable to a Google source can also remain, including facts combined with other information.
• Copies under your control: an optional memory backup in your own GitHub repository is not removed by Suvi's Google-data deletion action.

You can request deletion of retained data, or request Google-data deletion if you are not the workspace owner, by emailing contact@suvi.ai. We will process your request within 30 days. We may need to verify your identity and coordinate with the workspace owner where shared business records or other users' data are involved.

Under the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Object to or restrict processing of your data.
• Withdraw consent at any time.
• Request data portability.

We use cookies and similar technologies to enhance your experience, analyze traffic, and personalize content. You can control cookie preferences through your browser settings.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date.

This Privacy Policy shall be governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region. For any questions regarding your personal data rights under the Hong Kong Personal Data (Privacy) Ordinance (PDPO), you may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong.

If you have questions about this Privacy Policy, please contact us:

• Company: SUVI PTE LIMITED
• Address: A Block, Hankow Centre, 47 Peking Road, Tsim Sha Tsui, Hong Kong
• Email: contact@suvi.ai