Privacy Policy

1. Who we are

Calvyn is a sole proprietorship operated by Ari Kleine in California, United States. For questions about this policy or to exercise any right described in it, email hello@calvyn.io.

Our postal address is Calvyn, PO Box 47615, Los Angeles, CA 90047, United States.

2. Two roles — read this before the rest

Calvyn handles personal information in two different capacities, and your rights differ depending on which one applies.

When you hold a Calvyn account, we are the controller of your account information. We decide what to collect and why, and this policy governs it.

When one of our customers deploys an agent and a member of the public chats with it, that customer is the controller of the conversation and we are their processor. We handle those messages on the customer’s instructions, under our Data Processing Addendum — not for our own purposes.

If you chatted with an AI agent on someone else’s website and want that conversation deleted, contact the business that runs the website. They control it. If you cannot reach them, write to us and we will pass the request on and help where we can.

3. What we collect from account holders

Account information. Your name, email address, and a bcrypt hash of your password. We never store your password itself and cannot recover it. We also store when the account was created and which teams you belong to.

Content you create. The agents you configure, their prompts and settings, and the knowledge sources you upload — URLs, PDFs, and pasted text — along with the passages and numerical embeddings we derive from those sources so an agent can retrieve the right passage when answering.

Team and collaboration data. Invitations you send, notifications, and internal notes on handed-off conversations, including who mentioned whom.

Billing information. Your plan, subscription status, and message usage against your allowance. Card numbers never reach our servers — Stripe collects and stores them, and we hold only Stripe’s customer and subscription identifiers.

Support correspondence. Messages you send through the contact form or by email, kept as support tickets so we can follow up.

Product feedback and interaction events, including which rich cards an agent showed and which were clicked, used to give you analytics about your own agents.

Technical logs. Ordinary server logs generated when the service runs, including timestamps and error details. These help us keep the thing working and investigate abuse.

4. What we process on behalf of customers

When an end user talks to an agent, we store the conversation: the messages sent and received, the assistant’s replies, any cards displayed, a session identifier, and timestamps.

End users can type anything into a chat box, including personal details we never asked for. We do not require or request identifying information from end users, and we ask our customers not to configure agents to collect sensitive categories of personal data — health, biometric, precise location, government identifiers, or financial account details — through the widget.

If a conversation is handed off to a human, the handoff record and any notes added by the customer’s team are stored alongside it.

5. Why we use it

To provide the service — authenticate you, run your agents, retrieve the right knowledge, and generate replies.

To bill you correctly and enforce plan limits.

To answer your support requests.

To keep the service secure and available: rate limiting, abuse investigation, debugging, and fraud prevention.

To tell you about material changes to the service, your plan, or these policies. Those are service messages and you cannot opt out of them while you hold an account.

We do not use your content or your end users’ conversations to train foundation models, and our model provider is contractually bound not to train on data sent through their API.

6. We do not sell or share your personal information

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. We have not done so in the preceding twelve months.

We run no advertising networks, no third-party analytics, and no tracking pixels on calvyn.io.

7. Who else touches the data (sub-processors)

We use a small number of vendors to run the service. Each receives only what it needs.

OpenAI — generates agent replies and computes embeddings for your knowledge sources. Receives agent prompts, retrieved passages, and conversation messages. Under OpenAI’s API terms this data is not used to train their models.

MongoDB Atlas — the database where all of the above is stored. Hosted in the United States.

Zeabur — application hosting for the website and the API.

Stripe — payment processing and the billing portal. Receives your email and billing details directly; we never see full card numbers.

Our email delivery provider — sends transactional email such as support replies and account notices. Receives your email address and the message content.

A current list is maintained in the Data Processing Addendum. We will update it there before adding a new sub-processor that handles customer content.

We may also disclose information if legally required — a valid subpoena, court order, or law-enforcement demand — or where necessary to protect the rights, safety, or property of Calvyn, our customers, or the public. Where we are permitted to tell you, we will.

If Calvyn is ever sold or merged, account information may transfer to the acquirer. You would be told before that happened and before any new policy applied to your data.

8. Where data is held and international transfers

Calvyn is operated from the United States, and our infrastructure and sub-processors store and process data in the United States.

If you are in the United Kingdom, European Economic Area, or Switzerland, using Calvyn means your information is transferred to the United States. Where we act as processor for a customer subject to UK or EU data protection law, transfers are covered by the Standard Contractual Clauses incorporated into our Data Processing Addendum.

9. How long we keep it

Account information is kept while your account is open.

Agents, knowledge sources, derived passages, and conversations are kept while your account is open, so your agents keep working and your analytics keep their history. You can delete individual agents, sources, and conversations from the dashboard at any time, and deletion removes them from our database.

When you delete your account, we delete your account record, your agents, your sources and their derived passages, your conversations, handoffs, notifications, invitations, and interaction events. We aim to complete this within 30 days.

Two things survive account deletion, and only these: billing and transaction records that we are required to retain for tax and accounting purposes, and support correspondence where we may need it to resolve a dispute. Both are kept for up to seven years and are not used for anything else.

Ordinary server logs are retained for a short operational period and then rotate out.

Backups are cycled on a rolling basis; deleted data can persist in a backup for a short window before being overwritten, but is not restored to live systems.

10. Your rights

Whoever and wherever you are, you can ask us to: give you a copy of the personal information we hold about you; correct it if it is wrong; delete it; or stop processing it. Account holders can do the first and third directly from the dashboard — there is an export button and a delete-account button in your account settings, and neither requires you to email anybody.

If you are in California, you additionally have the right to know the categories and specific pieces of personal information collected, the categories of sources, the business purpose, and the categories of third parties it is disclosed to — all of which is set out above — the right to delete, the right to correct, and the right not to be discriminated against for exercising any of them. We do not sell or share personal information, so there is nothing for you to opt out of. You may use an authorised agent to make a request on your behalf.

If you are in the UK or EEA, you additionally have the right to object to processing, to request restriction, to data portability, and to lodge a complaint with your local supervisory authority. Our legal bases are: performing our contract with you (providing the service and billing), our legitimate interests (security, abuse prevention, and improving the product), and consent where we ask for it.

To make a request, email hello@calvyn.io from the address on your account. We will respond within 45 days, and will tell you if we need longer. We may need to verify your identity before acting on a request, and we will not charge you for a reasonable one.

11. Cookies and tracking

Calvyn does not use advertising cookies, analytics cookies, or third-party tracking scripts. There is nothing to consent to, which is why you have not been shown a cookie banner.

Signing in stores an authentication token in your browser’s local storage so that you stay signed in. It is strictly necessary for the service to function, it is not a cookie, and it is not readable by anyone else. Clearing your browser storage signs you out.

The embeddable chat widget stores a session identifier so a conversation survives a page refresh. It contains no personal information.

12. Security, stated honestly

Traffic to and from Calvyn is encrypted in transit with TLS. Passwords are hashed with bcrypt and are never stored or logged in readable form. Access to production systems is limited to the operator, and API access is authenticated and rate limited.

What we do not claim: Calvyn has not completed a SOC 2 audit, is not HIPAA-eligible, and has not undergone an independent GDPR audit or penetration test. If your use case requires any of those, Calvyn is not the right vendor for you yet, and we would rather tell you that now than in a procurement questionnaire.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify affected account holders and, where we act as processor, the relevant customer without undue delay and within the timeframes required by applicable law.

13. Children

Calvyn is a business product and is not directed at children. You must be 18 or older to hold an account, and we do not knowingly collect personal information from children under 13.

If you deploy a Calvyn agent on a service directed at children, you are the controller of those conversations and you are responsible for complying with the Children’s Online Privacy Protection Act and any equivalent law. We ask that you do not do so without putting that compliance in place first.

If you believe a child has provided personal information through Calvyn, email hello@calvyn.io and we will delete it.

14. Changes to this policy

We will update this policy as the product changes. The "last updated" date at the top always reflects the current version.

If a change materially affects how we handle your personal information, we will email account holders at least 30 days before it takes effect rather than quietly editing the page.

15. Contact

Privacy questions and requests: hello@calvyn.io.

Legal notices: legal@calvyn.io, or by post to Calvyn, PO Box 47615, Los Angeles, CA 90047, United States.