Privacy Policy

1. What Data We Collect

Account information: name, email address, and Google OAuth profile data (if using Google sign-in).

Payment information: processed entirely by Stripe. We do not store credit card numbers, bank account details, or other payment credentials.

Usage data: pages visited, features used, reports run, timestamps, and credit transactions.

Uploaded files: documents you upload for analysis, stored in your isolated tenant schema.

Device and browser information: IP address (hashed for anonymization), user agent, and browser type — collected for analytics, security, and abuse prevention.

2. How We Use Your Data

• To provide the intelligence service (running reports, generating outputs)
• To process payments via Stripe
• To improve the platform (anonymized, aggregated analytics)
• To communicate with you (account notifications, service updates)
• To detect and prevent abuse or unauthorized access

3. How AI Processes Your Data

When you run an intelligence report, your query and any uploaded documents are sent to AI model providers (Anthropic, xAI, OpenAI, Google) via their API for processing. These providers process your data under their respective API terms, which include zero-retention or limited-retention policies — they do not use API queries for model training. We do not use your data to train any AI models.

4. Data Sharing

We do NOT sell your personal data.

We share data only with the following service providers, solely for the purpose of operating the platform:

• Stripe — payment processing
• Anthropic, xAI, OpenAI, Google — AI inference (your queries are processed and not retained for training)
• DigitalOcean — cloud infrastructure hosting

We may disclose data if required by law, court order, or government regulation.

5. Data Retention

• Account data: retained while your account is active
• Uploaded files: retained until you delete them, then permanently removed within 30 days
• Intelligence reports: retained until you delete them
• Analytics data: retained in anonymized, aggregated form
• On account deletion: all personal data is removed within 30 days

6. Your Rights

Regardless of where you are located, you have the right to:

• Access your personal data
• Delete your account and data
• Export your data
• Correct inaccurate data
• Opt out of analytics tracking

California residents (CCPA/CPRA): You have the right to know what personal information we collect, the right to delete it, the right to opt out of sale (we do not sell data), and the right to non-discrimination for exercising your rights.

Florida residents (FDBR): Under the Florida Digital Bill of Rights, you have the right to access, correct, delete, and port your personal data. You may also opt out of the processing of your data for targeted advertising (we do not engage in targeted advertising).

7. Cookies

• Session cookies: required for authentication (Better Auth session cookies)
• Theme preference: stored in localStorage to persist your Light/Dark/System choice
• Analytics cookies: for platform improvement (anonymized usage tracking)
• UTM tracking cookies: to understand how users find us (30-day expiry)

We do not use third-party advertising cookies.

8. Security

• All data in transit is encrypted via TLS/HTTPS (managed by Caddy with auto-renewed Let's Encrypt certificates)
• Database is not accessible from the public internet
• Tenant isolation: your data is stored in a separate database schema and is never visible to other users
• Non-root containers with minimal attack surface
• Session-based authentication (no tokens stored in localStorage)

9. Children

This platform is not intended for use by anyone under 18 years of age. We do not knowingly collect personal data from minors. If we learn that we have collected data from a minor, we will delete it promptly.

10. Contact

For privacy questions, data access requests, or to exercise your rights:

Email: privacy@zyphv.com

Eraversa Inc., Florida, United States

11. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated via email or in-app notification. Your continued use of the platform after changes constitutes acceptance of the updated policy.