Privacy Policy

Sivient Technologies Private Limited ("Sivient", "Company", "we", "us", or "our"), based in Bengaluru, India, is committed to protecting your privacy and the security of your personal data.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our AI-powered email, calendar, and meeting management assistant (the "Platform"). It applies to all users located in the United States, Europe, and India.

Under global data protection frameworks:

• We act as a Data Fiduciary under India's Digital Personal Data Protection (DPDP) Act, 2023.
• We act as a Data Controller under the European Union's General Data Protection Regulation (GDPR) (Regulation EU 2016/679).

Where we process personal data on behalf of a Customer's organisation under a Team Plan, we act as a Data Processor/Processor and the organisation acts as the Data Controller/Fiduciary.

1. Information We Collect

We collect and process personal data to deliver, optimise, and secure the Platform. We categorise this data as follows.

1.1 Account Registration Information

When you create an account, we collect your first and last name, business email address, company name, billing address, telephone number, and payment credentials. All payment card data is tokenised and stored securely by our PCI-DSS compliant payment gateways; we do not store raw card numbers.

1.2 Connected Workspace and API Data

By linking your email and calendar clients using secure OAuth 2.0 authorisation, you grant us permission to programmatically access:

• Google Workspace (Gmail and Google Calendar): email body text, subject lines, header metadata, sender and recipient addresses, and calendar entries.
• Microsoft 365 (Outlook): email text, calendar appointments, video call links, and task logs.
• Third-party integrations: connection tokens and structured data from other tools you authorise us to connect with, including Slack, Teams, Notion, Granola, Zoom, HubSpot, and Salesforce.

1.3 Virtual Meeting Audio, Video, and Transcript Data

When you authorise our Notetaker Bot to join online meetings, we process:

• Audio and video recordings of the video conferences.
• Text transcripts automatically generated from the meeting audio.
• Meeting metadata, including participant names and emails, meeting titles, durations, and timestamps.

1.4 Technical and Device Data

To ensure system performance, prevent security incidents, and maintain reliability, we automatically collect technical logs, including IP addresses, device identifiers, browser types, operating systems, and platform interaction metrics.

2. Purposes and Legal Bases of Processing

We process personal data in compliance with the legal bases defined by the GDPR and the consent mandates of the Indian DPDP Act.

3. Third-Party API Compliance and Restrictions

3.1 Google API Limited Use Disclosure

Sivient's use and transfer of information received from Google APIs to any other application adheres to the Google API Services User Data Policy, including its Limited Use requirements:

• No model training. We do not use Gmail data or any Google API data to train, retrain, or improve generalised, non-personalised machine learning or AI models.
• No advertising. We do not use or transfer Google API data for serving advertisements, including retargeting, personalised, or interest-based ads.
• Limited transfer. We do not transfer Google API data to external parties unless necessary to deliver or improve prominent, user-facing features within the active application interface (including to the AI service providers described in section 3.3, which process it only on our behalf, and to an AI assistant you connect yourself as described in section 3.5), with your explicit consent, for security purposes, or to comply with applicable law.
• No human review. No human employee, contractor, or reviewer accesses your raw Google user data, unless we have secured your explicit, documented consent to access specific messages to resolve a documented technical support request, the access is required for security or legal compliance, or the data has been aggregated and anonymised.

3.2 Microsoft API Privacy Standards

Our integration with Microsoft Outlook and the Microsoft Graph API complies with Microsoft's developer security requirements. To protect email immutability, we do not modify, alter, or delete any received, non-draft email message (including its body text and recipient list). All generated responses are written as new, independent draft messages in your drafts folder.

3.3 Processing by AI Service Providers

To label and prioritise email, draft replies, summarise threads and meetings, transcribe meeting audio, and answer your questions in Sivient Chat, the Platform uses machine learning models provided by third-party AI service providers. These providers act as our processors and receive only the data needed for the feature you are using, which may include:

• Email data: subject lines, message body text, and sender and recipient details.
• Calendar data: event titles, dates, times, and attendees.
• Meeting data: audio from meetings you record, the resulting transcripts, and participant names. Before you record a meeting, make sure you have any permission or consent the other participants are entitled to under applicable law.
• Connected tools: content from integrations you have authorised, when a feature you use needs it.

We require our AI service providers to process this data solely to provide the Platform to you. They are not permitted to use your data to train or improve their models, and they may retain it only for as long as needed to return a result, subject to any short, limited retention their terms require for abuse monitoring.

AI outputs are assistance, not decisions. Labels, drafts, summaries, and suggestions can be reviewed, edited, or undone, and Sivient does not make solely automated decisions that produce legal or similarly significant effects for you.

3.4 Service Providers

Apart from AI assistants you choose to connect (section 3.5), we share personal data only with service providers that process it on our behalf, under written obligations of confidentiality and security, in these categories: cloud hosting and databases, content delivery and network security, AI model services, meeting recording and transcription, transactional email delivery, payment processing (our payment provider acts as merchant of record), and privacy-friendly product analytics. Some of these providers may process data outside your country of residence; where they do, we rely on appropriate safeguards such as Standard Contractual Clauses. We do not sell personal data. We may also disclose data where required by law, or to a successor in a merger or acquisition that continues to be bound by this policy.

3.5 AI Assistants You Connect

You can connect Sivient to an AI assistant you use, such as ChatGPT or Claude, so that you can ask that assistant about your email and meetings. This happens only when you start it from the assistant and approve it on a Sivient consent page, which shows the assistant's name, where it will send you back to, and what it will be able to do.

• What is shared. When the assistant uses a Sivient tool at your request, we send it the result: for example the emails that matched a search, the messages in a thread, a meeting summary, or your upcoming meetings. This can include email subjects, body text, sender and recipient details, and meeting content. We send only what the request needs, and only from data you can already see in Sivient.
• Read only. A connected assistant cannot send, delete, label, or change anything in your mailbox, calendar, or Sivient.
• Who is responsible. The assistant is not our service provider. Once it receives data, its provider handles it under that provider's own terms and privacy policy and your settings with it, including whether your conversations are retained or used to improve its models. Please review those before connecting.
• What we keep. We store the connection (the assistant's name, when it was connected and last used), and the access credentials as one-way hashes. We do not store your conversations with the assistant.
• Your control. You can disconnect an assistant at any time in Settings, then Integrations. Its access stops immediately, and a connection unused for 30 days expires on its own.

4. Privacy Boundaries for Team Workspaces

Under Team plans, the Platform implements strict technical controls to prevent internal data exposure and unauthorised administrative access:

• Admins have zero inbox visibility. Organisation administrators manage billing, configure licences, and view aggregate usage metrics. Admins cannot access, read, search, or review your private email messages, generated drafts, private meeting summaries, or inbox folders.
• Meeting privacy by default. Meeting summaries, transcripts, and recordings are private by default and visible only to the individual who scheduled or authorised the Notetaker Bot. Other team members and administrators cannot browse or play your meeting recordings unless you explicitly share a link.

5. Data Security and Retention

5.1 Security Controls

We implement appropriate technical, physical, and organisational security measures to protect your data, including:

• Encryption of personal data, email bodies, and meeting transcripts at rest using AES-256.
• Transmission of all data over secure, modern protocols using HTTPS and TLS.
• Storage of all OAuth access tokens and database records using strict row-level tenant isolation.
• Regular external security reviews and penetration testing.

5.2 Data Retention

We retain personal data only as long as necessary to fulfil the purposes outlined in this policy or to comply with statutory legal requirements:

• Active subscriptions. Data is retained during the term of your subscription.
• Meeting files. Meeting audio/video recordings and text transcripts are stored for thirty (30) days by default, after which they are permanently deleted from our active servers unless you adjust your account configuration.
• Account deletion. If you cancel your subscription or request account deletion, all personal data is permanently deleted from primary production databases within thirty (30) days.
• Backups. We keep encrypted database backups for disaster recovery only. Each backup is deleted automatically thirty (30) days after it is taken, so data deleted from production leaves our backups within a further thirty (30) days. If we ever restore from a backup, we re-apply every deletion made since that backup was taken.

6. Your Data Privacy Rights

Depending on your jurisdiction, you have the following enforceable rights regarding your personal data.

6.1 Rights under the GDPR (European Union users)

• Access and portability. Request a copy of all personal data we process, delivered in a structured, machine-readable format.
• Erasure (right to be forgotten). Request the permanent deletion of your personal data.
• Rectification. Request corrections to inaccurate or incomplete personal data.
• Objection and restriction. Request that we stop processing your data, or restrict processing, under certain conditions.
• Withdraw consent. Withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal.

6.2 Rights under the DPDP Act, 2023 (Indian users)

• Access summary. Request a summary of the personal data we hold, the processing activities performed, and the identity of other parties with whom data has been shared.
• Correction and erasure. Request correction of inaccurate data, completion of incomplete data, or erasure of data no longer necessary.
• Grievance redressal. Resolve any data privacy concern through our Grievance Officer before escalating to the Data Protection Board of India.
• Nomination. Nominate another individual to exercise your data privacy rights in the event of death or incapacity.

To exercise any of these rights, email us at admin@sivient.com. You may also revoke our access at any time through your email or integration provider's account settings.

7. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in our AI architecture, security practices, or legal developments. We will notify you of material changes by:

• Posting the updated policy on our website with a revised effective date.
• Displaying a prominent in-app notification when you access the Platform.
• Sending a direct email notification to the address registered with your account.

For any questions about this Privacy Policy, or about how we handle your data, contact us at admin@sivient.com.