Privacy Policy

1.1 Key Definitions

For purposes of this Privacy Policy:

“Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or can reasonably be linked to an identified or identifiable individual, as defined by applicable law.

“Input” means prompts, system instructions, files, data, code, messages, context, or other content submitted to the Services by or on behalf of a customer or End User.

“Output” means the final content generated by the Services and made available in response to Input.

“Customer Content” means Input and Output.

“End User” means an individual who accesses or interacts with a Customer Application or otherwise uses the Services through a customer.

“Keyed API Traffic” means requests submitted to the MMI API using a Customer API key or other authenticated API credential.

“Playground Content” means Customer Content submitted through Aivana’s interactive Playground or another feature that Aivana clearly identifies as an evaluation, feedback, preview, testing, or product-improvement environment.

“Service Data” means system-generated, technical, operational, analytical, or derived information relating to the provision, performance, security, evaluation, use, or improvement of the Services. Service Data may include request identifiers, token or billable-unit counts, latency, error information, feature-use signals, routing signals, benchmark results, usage measurements, and similar telemetry.

Service Data does not include verbatim Customer Content or internal intermediate drafts, context expansions, intermediate results, or derived text generated directly from Customer Content where those materials reveal the substance of the Customer Content.

“Live Web Search” means a Service feature that retrieves current or external information from third-party search, retrieval, or web-content providers.

1.2 When Aivana Acts as a Controller or Processor

Aivana generally acts as a controller, business, or similar responsible party for Personal Data we collect and use for our own business purposes, including account registration, authentication, billing administration, product analytics, support, security, marketing, website operation, legal compliance, and management of the Services.

To the extent Aivana uses Playground Content for its own product-improvement purposes described in Section 4.2, Aivana acts as a controller for that separate processing.

When a developer or organization submits Personal Data through the MMI API on behalf of its own users, customers, employees, or other individuals, Aivana may act as a processor, service provider, or similar party on that customer’s behalf.

In those circumstances, the customer is responsible for determining the lawful basis for processing, providing required notices, obtaining required permissions or consents, honoring applicable individual rights, and ensuring that it is permitted to submit Personal Data to Aivana and the service providers necessary to provide the Services.

Where required by applicable law, Aivana may make data-processing terms available for processing performed on behalf of a customer.

2.1 Account and Profile Information

We may collect:

• Name and email address.
• Account identifiers.
• Organization, company, role, or professional information you provide.
• Authentication information and account-security information.
• Session information.
• Records showing acceptance of our Terms, Privacy Policy, Cookie Policy, or other applicable agreements or notices.
• Preferences and settings associated with your account.

If you sign in through a third-party identity provider, such as Google, LinkedIn, or GitHub, we may receive information that the provider makes available to us in accordance with your settings and the provider’s terms.

2.2 Customer Content

We process Customer Content to provide the Services.

Customer Content may include:

• Prompts and messages.
• System instructions.
• Code.
• Files and documents.
• Images.
• Structured data.
• Conversation context or history.
• Information included in API requests.
• Outputs generated by the Services.

Customer Content may contain Personal Data if you or an End User chooses to include it.

You should not submit Personal Data that you are not authorized to provide.

Unless Aivana expressly states that a particular Service supports a specialized compliance framework, you should not submit protected health information, full payment-card data, highly sensitive government identifiers, or other regulated information that requires contractual or technical safeguards that Aivana has not agreed to provide.

2.3 Usage, Device, and Service Data

We may collect:

• IP address.
• Browser type and version and operating system, as your browser reports them.
• Request and run identifiers.
• Timestamps.
• Endpoints or features used.
• Customer-visible token or billable-unit counts.
• Amounts charged.
• Credit balances and usage.
• Latency and performance information.
• Request status.
• Error information.
• Live Web Search indicators.
• Rate-limit events.
• API-key tracking identifiers.
• Security signals.
• Feature-use information.
• Other technical or operational telemetry.

We may also create aggregated, statistical, inferred, or de-identified information from use of the Services.

2.4 Billing and Transaction Information

When you purchase credits or other paid Services, we may collect transaction and billing information such as:

• Purchase amount.
• Date of purchase.
• Transaction status.
• Credit balance.
• Usage charges.
• Promotional credits.
• Refund information.
• Payment-processor references.

Payment-card information is generally collected and processed by our payment processor rather than stored directly by Aivana.

2.5 Support, Feedback, Research, and Evaluation Information

We collect information you provide when:

• Contacting support.
• Reporting a problem.
• Participating in a survey.
• Participating in a focus group.
• Participating in a pilot.
• Participating in an evaluation program.
• Participating in a benchmark exercise.
• Participating in beta testing.
• Participating in product research.
• Submitting ratings, comments, ideas, suggestions, examples, or other feedback.

Feedback may include Personal Data that you choose to provide.

When you rate an answer in the Playground with a thumbs up or thumbs down, we record your rating and, if you choose one, a reason from a fixed list. Rating is optional, and we do not ask for or record a comment with a rating.

We may also review Customer Content associated with a feedback submission where reasonably necessary to understand, investigate, evaluate, or act on that feedback.

Our contractual rights regarding feedback are described in our Terms of Service. Any use of associated Customer Content for artificial-intelligence or machine-learning model training remains subject to Section 4 of this Privacy Policy.

2.6 Cookies and Similar Technologies

We and our service providers may use cookies and similar browser technologies, such as local storage and session storage, to operate the Services, keep you signed in, and remember your preferences and choices.

Our Cookie Policy at aivana.ai/cookiepolicy provides additional information about the cookies and similar browser technologies we use, their purposes, typical durations where applicable, and available controls.

4.1 Keyed MMI API Traffic — No Training by Default

By default, Aivana does not use Customer Content from requests submitted through the MMI API using a Customer API key to train or fine-tune Aivana or third-party artificial-intelligence or machine-learning models.

This protection also applies to internal intermediate results, intermediate drafts, context expansions, and derived text generated directly from Customer Content during execution of a keyed API request.

Aivana may use Service Data and aggregated or de-identified operational information associated with keyed API traffic to operate, secure, evaluate, benchmark, and improve the Services.

These activities may include:

• Performance measurement.
• Evaluation-harness development.
• Quality analysis.
• Routing and decisioning improvements.
• Safety and abuse prevention.
• Reliability analysis.
• Operational optimization.
• Economic and cost analysis.
• Product analytics.

Service Data may include usage measurements, token or billable-unit counts, latency, request status, error information, feature-use signals, routing signals, and similar operational telemetry, provided that the information does not contain verbatim Customer Content or reveal the substance of protected Customer Content.

The restrictions in this Section do not prevent Aivana from accessing, reviewing, or processing Customer Content where reasonably necessary to:

• Provide requested support.
• Investigate security incidents.
• Investigate suspected fraud, abuse, or misuse.
• Enforce our Terms.
• Comply with law or legal process.
• Respond to a Customer request.

Aivana may use third-party AI and technology providers to process Keyed API Traffic.

We select and configure commercial services with the intent that Keyed API Customer Content is not used for general model training by those providers unless the customer has affirmatively authorized that use through an applicable Aivana data-sharing program and such use is legally and contractually permitted.

Third-party providers may nevertheless process or retain data as reasonably necessary for service delivery, security, abuse monitoring, troubleshooting, legal compliance, or similar limited purposes under their applicable contractual terms.

4.2 Playground, Evaluation, and Beta Content

Customer Content submitted through the Playground, evaluation programs, beta testing, or other features that Aivana clearly identifies as eligible for product-improvement use may be used to:

• Test the Services.
• Evaluate quality.
• Benchmark performance.
• Debug errors.
• Analyze results.
• Improve features.
• Improve Service performance.
• Improve evaluation systems.
• Improve routing and decisioning.
• Conduct research and product development.

Aivana may use such Customer Content to train or fine-tune artificial-intelligence or machine-learning models only after taking reasonable steps to de-identify the content and only where Aivana is legally and contractually permitted to do so.

AI Studio provides a setting in the Playground that controls whether your Playground content may be used for product improvement. Aivana honors the setting that applies when the content is submitted.

The setting is on by default for visitors who are not signed in and for accounts that have not purchased credit, and off by default once an account has purchased credit. You can change it at any time, and your choice takes precedence over the default. A visitor who is not signed in can change it in that browser.

Aivana may exclude particular content from training, evaluation, or other improvement activities where third-party contractual terms, technical restrictions, data characteristics, or legal requirements limit or prohibit such use.

Evaluation, benchmarking, quality analysis, and model training are different activities. Content that is not eligible for model training may still be used for another product-improvement activity where permitted under this Privacy Policy and applicable law.

4.3 Feedback Submissions

If you voluntarily provide ratings, comments, ideas, suggestions, evaluation observations, or other feedback, Aivana may use that feedback to operate, develop, evaluate, benchmark, market, and improve the Services and for other lawful business purposes. We will not publish or publicly attribute feedback in a way that identifies you without your permission.

Feedback may contain Personal Data, which we process in accordance with this Privacy Policy.

Where feedback relates to a particular request, Output, Playground interaction, or other Customer Content, Aivana may review the associated Customer Content where reasonably necessary to understand, investigate, evaluate, or act on the feedback.

Answer ratings work differently from other feedback. A thumbs-up or thumbs-down rating on a Playground answer is stored with the rating itself, any reason you select, and technical information about how that answer was produced, such as its intelligence level and whether Live Web Search was used. We do not store your question, the answer, or a comment with the rating, and we do not include your account identifier in the rating. Because of this, we cannot review the content of an answer from its rating. Authorized Aivana personnel see ratings only as totals, and we use them to evaluate and improve the Services. A rating does not authorize Aivana to use any Customer Content for model training.

Providing feedback does not, by itself, authorize Aivana to use associated Customer Content for model training.

Any use of Customer Content to train or fine-tune an artificial-intelligence or machine-learning model remains subject to Section 4.1, Section 4.2, or an applicable voluntary data-sharing program, as relevant.

4.4 Voluntary Data-Sharing Programs

Aivana may offer voluntary programs that allow users to affirmatively share eligible data for broader evaluation, research, product-improvement, or model-development purposes.

Such programs may include:

• Promotional credits.
• Increased usage allowances.
• Early access.
• Feature access.
• Other benefits.

Before you opt in, Aivana will describe the categories of data eligible for sharing and the material permitted uses applicable to the program.

An opt-in applies only as described in the applicable program terms.

Where Aivana provides a withdrawal mechanism, withdrawal applies prospectively.

Unless applicable law requires otherwise, withdrawal does not require Aivana to delete or reverse:

• De-identified datasets.
• Evaluation results.
• Benchmark results.
• Aggregated findings.
• Model parameters.
• Other derived information lawfully created before withdrawal became effective.

Any use of shared data for model training remains subject to Aivana’s legal and contractual rights to use the applicable data, including restrictions imposed by third-party technology providers.

4.5 De-Identified and Aggregated Data

Aivana may create and use aggregated or de-identified information for:

• Analytics.
• Benchmarking.
• Research.
• Security.
• Evaluation.
• Product development.
• Service improvement.
• Operational analysis.
• Other lawful business purposes.

Where required by applicable law, Aivana will maintain such information in de-identified form and will not attempt to re-identify it except where permitted by law, including where necessary to validate or improve de-identification techniques.

De-identified or aggregated information that can no longer reasonably be linked to an identifiable individual may be retained and used independently of the retention period applicable to the source Personal Data, subject to applicable law.

6.1 Infrastructure and Technology Providers

This may include providers of:

• Cloud computing.
• Hosting.
• Storage.
• Databases.
• Content delivery.
• Infrastructure.
• Security.
• Monitoring.
• Logging.
• AI inference.
• AI models.
• Search.
• Retrieval.
• Related technology services.

6.2 Payment and Billing Providers

We may disclose information to payment processors, fraud-prevention providers, tax providers, billing providers, or financial service providers necessary to process transactions and administer accounts.

6.3 Identity and Business Service Providers

We may use providers that support:

• Authentication.
• Identity verification.
• Email delivery.
• Customer support.
• Communications.
• Analytics.
• Productivity.
• Error monitoring.
• Software development.
• Business operations.

6.4 Personnel, Contractors, and Professional Advisors

Authorized personnel, contractors, professional advisors, auditors, insurers, accountants, lawyers, and consultants may access Personal Data where reasonably necessary to perform services for Aivana and subject to appropriate obligations.

6.5 Legal and Safety Disclosures

We may disclose Personal Data if we reasonably believe disclosure is necessary to:

• Comply with applicable law.
• Respond to lawful legal process.
• Respond to a court, regulator, or government authority.
• Protect Aivana’s rights or property.
• Protect the rights, safety, or security of users or others.
• Investigate fraud, abuse, or unlawful activity.
• Protect the security or integrity of the Services.

6.6 Corporate Transactions

Personal Data may be disclosed to or transferred to an investor, lender, buyer, successor, affiliate, advisor, or other relevant party in connection with:

• Financing.
• Investment.
• Due diligence.
• Merger.
• Acquisition.
• Reorganization.
• Bankruptcy.
• Sale of assets.
• Other corporate transactions.

Any such processing remains subject to applicable law.

6.7 Organization-Managed Accounts

If Aivana enables organization-managed accounts, authorized organization administrators may be able to access or manage information associated with that organization, including:

• Membership.
• User access.
• API keys.
• Billing.
• Credits.
• Usage.
• Settings.
• Security information.
• Other account information.

Your organization may have its own policies and privacy obligations governing its administration of the account.

8.1 Contract

Processing necessary to provide Services you request, administer your account, process transactions, or take steps requested before entering into a contract.

8.2 Legitimate Interests

Processing necessary for legitimate business interests such as:

• Operating the Services.
• Maintaining the Services.
• Securing the Services.
• Improving performance.
• Preventing fraud.
• Preventing abuse.
• Conducting analytics.
• Providing customer support.
• Improving products.
• Protecting legal rights.

We rely on legitimate interests only where those interests are not overridden by applicable privacy rights.

8.3 Consent

We may rely on consent for activities such as:

• Optional cookies.
• Certain marketing.
• Voluntary data-sharing programs.
• Other processing where consent is required.

8.4 Legal Obligations

We may process Personal Data where necessary to comply with applicable laws, regulations, legal processes, tax requirements, accounting requirements, or lawful government requests.

Where Aivana acts as a processor or service provider, the customer that controls the Personal Data is generally responsible for determining the applicable lawful basis.

9.1 Account Deletion

If you request deletion of your account, your account will generally enter a 14-day suspended deletion period.

During that period:

• Account access may be suspended.
• API keys may stop functioning.
• Use of the Services may be restricted.
• You may restore your account by signing back in through the restoration process made available by Aivana.

If the account is successfully restored during the 14-day period, the deletion request is cancelled and eligible balances, account information, and account access are restored in accordance with the Services.

If the account is not restored during the 14-day period, Aivana will proceed with deletion or de-identification of Personal Data associated with the account, subject to information we reasonably need to retain for:

• Legal obligations.
• Tax obligations.
• Accounting.
• Billing.
• Fraud prevention.
• Security.
• Dispute resolution.
• Enforcement of agreements.
• Other lawful purposes.

9.2 Customer Content

Aivana does not represent that all Customer Content is subject to zero data retention unless a particular Service or configuration expressly states otherwise.

Customer Content may be processed or retained as reasonably necessary to:

• Provide the Services.
• Complete requested processing.
• Operate requested features.
• Troubleshoot errors.
• Provide support.
• Protect security.
• Prevent abuse.
• Enforce our Terms.
• Comply with law or legal process.

Retention by third-party AI, inference, search, infrastructure, or other providers may vary depending on the provider, Service, feature, and configuration.

Aivana seeks to use commercial configurations appropriate for developer and API use, but provider-side security, abuse-monitoring, legal, or technical retention may still apply.

9.3 Service Data and Billing Records

Service Data, transaction records, account-security records, acceptance records, support records, and similar operational information may be retained for longer periods where reasonably necessary for:

• Billing.
• Analytics.
• Security.
• Audit.
• Tax.
• Accounting.
• Legal compliance.
• Dispute resolution.
• Service administration.

Answer ratings (Section 4.3) are retained as Service Data for up to 13 months. Because a rating does not include your account identifier, we generally cannot identify it later, and closing or deleting your account does not by itself delete ratings you previously submitted.

9.4 De-Identified and Aggregated Data

Aggregated or de-identified information may be retained for an extended period, including indefinitely where permitted by law, because it is no longer reasonably linked to an identifiable individual.