Privacy Policy

This Privacy Policy explains how AUUVIO (“AUUVIO,” “we,” “us”) collects, uses, and shares information when you use the AUUVIO application — a business CRM, inbox, project, and finance workspace with AI-assisted features. It applies to workspace members who sign up for and use AUUVIO directly.

AUUVIO is currently operated by Alexander Hittle, as an individual — no separate legal entity has been formed yet. This will be updated once a formal business entity is established. You can reach us at support@auuvio.com.

Account information. When you create a workspace, we collect your name, email address, and password (stored as a salted Argon2 hash — we never store your password in plain text).

Workspace content. AUUVIO is a business records system — the companies, contacts, deals, projects, tasks, documents, invoices, and marketing content you or your teammates enter is stored so the product can work. This is your business data; we process it to provide the service, not for our own independent purposes.

Google account data. Only if you choose to connect a Google account. What AUUVIO accesses from Google, and the stricter rules that apply to it, are described separately in Google user data below.

Public site visitors. If you use AUUVIO's site-builder feature to publish a public page with a contact form, the name, email, and message a visitor submits through that form is stored as a contact record in your workspace, the same way any other contact would be.

Technical and security information. AUUVIO keeps a tamper-evident audit log of actions taken in your workspace (who did what, when). Depending on the action, this log may include your IP address and browser user agent — for example, failed sign-in attempts are recorded this way to detect and throttle repeated attempts against your account. When something goes wrong in the app, an error report is sent to our error-monitoring provider (see “Who we share information with”).

Cookies and local storage. AUUVIO uses a small number of strictly-necessary cookies to keep you signed in (session cookies, not readable by JavaScript) and a short-lived cookie while you connect a Google account to prevent cross-site request forgery. A first-party cookie also stores your browser's time zone (for example, “America/Detroit”) so dates and times are shown in your local time. Your browser's local storage holds only your display preferences (light/dark theme, layout density) — never account or business data. AUUVIO does not use third-party advertising or analytics tracking cookies.

We use the information above — other than Google user data, which is used only as described in Google user data — to:

• Provide, maintain, and secure the AUUVIO application for your workspace
• Authenticate you and keep your account and workspace data separated from other customers'
• Send transactional email that keeps your account working — invitations you send, password resets, and email verification
• Power AI features (Ada and Milo) that summarize or suggest actions based on your workspace's own records, when you use them
• Detect and prevent abuse, such as repeated failed sign-in attempts
• Process subscription payments, if your workspace is on a paid plan

Connecting a Google account is optional. You do it yourself from Settings → Connected Apps, Google asks for your consent, and you can disconnect at any time. Nothing in this section applies unless you connect.

What AUUVIO accesses and why.

• Your Google account email address — to identify which Google account is connected.
• Gmail — message headers (such as sender, recipients, subject, and date), message bodies, snippets, and labels, for your most recent conversations (excluding spam and trash) and new mail after that. Attachments are not downloaded. This lets you read and reply to your mail inside AUUVIO. AUUVIO also uses Gmail to send email you write, AI-drafted emails only after you approve them, and marketing campaigns you schedule (sent from your own Gmail account, with an unsubscribe link and an open-tracking image). Threads you open in AUUVIO are marked as read in Gmail so the two stay in sync.
• Google Calendar — events on your primary calendar from one week ago through the next 90 days: title, description, location, times, attendees and their responses, and the event link. This lets you see your agenda and your own scheduling conflicts in AUUVIO. AUUVIO creates calendar events only when you create one, or approve one an AI assistant proposed.

How it's stored and who can see it. Synced mail and calendar data is stored in AUUVIO's database so the app can display it, and is refreshed periodically while you stay connected. Your Google access tokens are encrypted at rest. Your mail and calendar are visible only to you — not to other members of your workspace. AUUVIO also keeps workspace activity entries noting that you connected or disconnected a Google account (including that account's email address), and audit entries recording that you sent an email through AUUVIO (for email you write in AUUVIO, its recipients and subject) or created a calendar event (for an event you create in AUUVIO, its title). Audit entries are visible to workspace owners and administrators.

AI features. AUUVIO's AI assistants do not send the contents of your Gmail messages or Google Calendar events to any AI provider. When an assistant drafts an email or proposes a calendar event, the draft is generated from your workspace's own records (such as deals, contacts, and invoices), and nothing is sent or created until a person approves it — then it goes out through the approving person's own connected Google account.

How Google user data is used — and not used. AUUVIO uses Google user data only to provide and improve the user-facing mail and calendar features described above. We do not:

• sell Google user data;
• use or transfer it for advertising, including personalized, retargeted, or interest-based advertising;
• use or transfer it to determine creditworthiness or for lending purposes;
• use it to develop, improve, or train generalized or non-personalized AI or machine-learning models;
• allow it to be used for any purpose unrelated to AUUVIO's mail and calendar features.

Sharing. We transfer Google user data only to the service providers that host and run AUUVIO on our behalf (Netlify for application hosting, Neon for the database, and Sentry for error monitoring), only as needed to provide and secure the features above; when necessary to comply with applicable law; or for security purposes, such as investigating abuse. Error reports sent to Sentry are not designed to contain the contents of your mail or calendar, though a report about a failed Google request can include technical details of that request.

Human access. No one at AUUVIO reads your Google user data unless you give us explicit permission for specific messages or events (for example, while helping with a support request), it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

Disconnecting and deletion. When you disconnect from Settings → Connected Apps, AUUVIO asks Google to revoke its access and deletes the mail and calendar data it synced from your account, along with any briefing recommendations derived from your calendar. The activity and audit entries described above are kept as part of your workspace's records (the audit log is tamper-evident by design and isn't edited after the fact) and are deleted with the workspace. Deleted data may remain in our database provider's backups for a limited period until those backups expire. If you instead remove AUUVIO's access from your Google Account settings, AUUVIO can no longer reach your Google account, but data already synced stays in AUUVIO until you click Disconnect or ask us to delete it.

AUUVIO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We don't sell your information. We share it only with the following service providers, only as needed to run AUUVIO on our behalf. Google user data is shared only as described in Google user data.

• Stripe — payment processing and subscription billing, if your workspace is on a paid plan. AUUVIO does not store your card details; Stripe does.
• Resend — delivery of AUUVIO's transactional email: workspace invitations, password resets, and email verification. (Email you send from AUUVIO, including marketing campaigns, goes out through your own connected Gmail account, not Resend.)
• Anthropic — AUUVIO's AI features (Ada and Milo) send the relevant workspace records — for example deals, companies, contacts, activity notes, tasks, invoices, documents, and site-builder content — to Anthropic's Claude API to generate summaries, briefings, drafts, and suggestions. Gmail and Google Calendar content is not sent to Anthropic.
• Sentry — error monitoring. When an error occurs, Sentry receives a technical error report (error message, stack trace, the page or request involved, and browser/device type). AUUVIO configures Sentry not to collect IP addresses or cookies, and does not record user sessions.
• Neon and Netlify — our database and application hosting providers, who store and run AUUVIO's infrastructure on our behalf.

We may also disclose information if required by law, or where necessary to protect the security of AUUVIO and its users, such as investigating abuse. For Google user data, only the narrower rules in Google user data apply.

AUUVIO implements the following technical safeguards:

• Passwords hashed with Argon2, never stored in plain text
• Session tokens are signed, expiring credentials stored in cookies your browser's JavaScript cannot read
• Connected Google account tokens are encrypted at rest
• All traffic to AUUVIO is served over HTTPS
• Database-level access controls that separate each workspace's data from every other workspace's
• A tamper-evident, hash-chained audit log of account and data changes

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. AUUVIO does not currently hold any third-party security certification (such as SOC 2 or ISO 27001) — we describe here only what is actually implemented today.

We retain workspace data for as long as your workspace remains active. Individual records (companies, contacts, deals, and similar) can be deleted from within the product by users with the appropriate permission; deleted records are marked as removed and hidden from the product rather than immediately erased. Google user data follows the disconnect-and-delete rules in Google user data.

AUUVIO does not currently offer a fully self-service “delete my entire account/workspace” action. If you would like your workspace and its data permanently deleted, contact us at support@auuvio.com and we will process your request.

• You can review and correct most of your account and workspace information directly within AUUVIO.
• You can disconnect a connected Google account at any time from Settings → Connected Apps, which deletes the mail and calendar data AUUVIO synced from it.
• You can request deletion of your account/workspace data by contacting us (see above).
• Recipients of marketing email sent through AUUVIO's campaign feature can unsubscribe via the link included in those emails.

AUUVIO is a business product, not directed at children, and is not intended for use by anyone under 18. We do not knowingly collect personal information from children.

AUUVIO's infrastructure providers may process and store data in regions other than your own. By using AUUVIO, you understand your information may be transferred to and processed in other countries, which may have data protection laws different from those of your own country.

We may update this Privacy Policy from time to time. If we make material changes, we'll update the “Last updated” date above and, where appropriate, notify workspace owners directly.

Questions about this policy or your data? Contact us at support@auuvio.com.