Privacy Policy

This policy covers you as an Asenvra account holder and visitors to asenvra.com. When you connect your business systems, we also process data about your customers on your behalf. For that data you are the controller and we act as your processor: we use it only to provide the service to you.

Account information. Your email address, password hash (handled by our authentication provider), GitHub profile details if you sign in with GitHub, your plan and billing status.

Credentials for systems you connect. The API keys, tokens or service-account files you give us for Stripe, Google Analytics, PostHog, Intercom, a CSV feed or error monitoring. They are stored server-side, used only to read from those systems for you, and never sent back to your browser. You can disconnect a system at any time, which deletes its stored credentials.

Business data the operator reads. Depending on what you connect: subscriptions, revenue, payments and failed charges; traffic and product-usage events; support conversations; errors and incidents. This can include your customers’ email addresses, names and usage.

Your website. If you add a website, we fetch its public pages and scripts each day, look for errors and security problems, and store the findings and a written brief. We only check a site after you prove you own it.

What you tell the operator. Goals, instructions, decisions you approve or reject, autonomy limits, and the plans and history the operator records about your company.

Usage and diagnostics. Pages you visit and features you use (PostHog and Google Analytics), and error reports from your browser (Sentry). Sentry may record a replay of a share of sessions and of sessions where an error occurs; text and inputs are masked in those recordings by default.

Payments. Card details go directly to Stripe and never reach our servers. We keep your Stripe customer ID and subscription status.

• Measure your company’s health and spot problems and opportunities.
• Write reasoning, plans and briefs for you, and file decisions for your approval.
• Run experiments and measure their results on your behaviour data.
• Act through connected systems within the limits you set, for example drafting or sending an email to one of your customers.
• Keep a history of decisions and outcomes so later decisions are better informed.

We also use account and usage data to run billing, send service emails (such as your daily website brief and weekly digest), provide support, and prevent abuse. We do not sell your data or your customers’ data, and we do not use it to train AI models.

The operator’s reasoning is produced by large language models hosted by NVIDIA (NVIDIA NIM). To answer an instruction, plan a goal or review your website, we send the relevant context to that model: summarised metrics, observations, and the text of your public web pages. We send only what the task needs. AI output can be wrong, which is why the product labels reasoning and proposals separately from measured facts and executed actions.

• Supabase: database and authentication.
• Railway: application hosting.
• NVIDIA: AI model inference.
• Stripe: payments and billing.
• Resend: transactional email.
• Sentry: error monitoring and session replay.
• PostHog and Google Analytics: product analytics. If we run advertising, Google’s tag may also measure sign-ups from ads.
• GitHub: sign-in, if you choose it.

We may also disclose information if the law requires it or to protect our rights and users.

• Every database table enforces row-level security, so accounts can only read their own data.
• All traffic uses HTTPS, and our site sends strict transport, framing and content security headers.
• Website checks only fetch public addresses, never private or internal networks.
• No method is perfectly secure. If we learn of a breach affecting your data, we will tell you without undue delay.

• Account and company data (goals, decisions, memory, website checks): while your account is active.
• Connected-system credentials: until you disconnect the system or delete your account.
• Payment records: as long as tax and accounting law requires.

When your account is deleted, we delete your account and company data within 30 days, except where the law requires us to keep records.

You can ask to access, correct, export or delete your data, or object to how we use it. Email support@asenvra.com from your account address. If your customers ask you about data the operator processes for you, contact us and we will help you respond.

We use essential cookies to keep you signed in, and analytics cookies from PostHog and Google Analytics to understand how the product is used. We do not sell data to advertising networks.

Asenvra is for businesses and is not intended for anyone under 18. We do not knowingly collect children’s data.

We will post changes here and update the date above. For material changes we will also email account holders.