Legal

Privacy Policy

Last updated July 5, 2026. This policy explains how Tavallio collects, uses, stores, shares, protects, and deletes personal data, including Google user data accessed through Google APIs.

Plain-English summary

Tavallio is an AI assistant that connects to your accounts only when you authorize it. We use your data to provide the features you ask for: reading an email, drafting a reply, creating a calendar event, updating a spreadsheet, running an automation, or completing another task. We do not sell your Google user data, use it for ads, or use it to train generalized AI models.

Who We Are

Tavallio provides a managed AI assistant at tavallio.ai and app.tavallio.ai. You can contact us at hello@tavallio.com.

Information We Collect

Account and profile data

Name, email address, sign-in provider identifiers, locale, profile settings, and account preferences.

Billing and subscription data

Plan, checkout status, invoices, payment status, and Stripe customer identifiers. Tavallio does not store full card numbers.

Content and task data

Prompts, chat history, uploaded files, generated outputs, automations, memories, profiles, and workflow settings.

Connected service data

Data from services you connect, including Google, Slack, Notion, Stripe, browser sessions, local agent results, and other tools you authorize.

Device, security, and usage data

IP-derived location, browser and device information, logs, feature usage, error reports, abuse signals, and diagnostic events.

Support data

Messages, bug reports, screenshots or files you choose to send us, and related account context.

Google User Data

Tavallio accesses Google user data only after you choose to connect Google and approve Google's OAuth consent screen. The exact data depends on the scopes you authorize and the Tavallio features you use.

Google account

Name, profile picture, email address, account identifier, and consent details.

Account sign-in, account linking, consent records, and support for connected Google features.

Gmail

Message metadata, sender and recipient fields, subjects, message bodies, attachments selected by the user or needed for the requested task, draft content, and send results.

Search, summarize, draft, organize, and send email when a user asks Tavallio to work with Gmail.

Google Calendar

Calendar lists, event titles, descriptions, times, attendees, locations, conference links, availability, and event updates.

Check availability, create events, update meetings, prepare schedules, and run calendar workflows requested by the user.

Google Drive, Docs, and Sheets

File metadata and the content of files the user selects, creates, edits, uploads, or asks Tavallio to use.

Find relevant files, create or update documents and spreadsheets, summarize selected content, and prepare user-requested work artifacts.

Google Tasks

Task lists, task titles, notes, due dates, status, and task updates.

Create, read, update, and organize task lists when the user asks Tavallio to manage tasks.

How We Use Information

  • Provide the Tavallio app, including chat, actions, automations, browser tasks, connected account workflows, files, memories, profiles, and support.
  • Authenticate users, link accounts, maintain OAuth consent records, and keep connected services working.
  • Execute user-requested tasks, including reading, summarizing, drafting, creating, updating, or sending content through connected services.
  • Show task history, saved outputs, automation status, usage, billing state, and account settings.
  • Protect the service, detect abuse, debug failures, enforce rate limits, and keep audit records where needed.
  • Process payments, subscriptions, trials, credits, refunds, and billing support.
  • Improve reliability, safety, product quality, and user-facing features using privacy-protective methods.
  • Comply with legal obligations and respond to lawful requests.

Google API Limited Use Commitments

Tavallio's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

  • Tavallio only uses Google user data to provide or improve user-facing features that are visible in Tavallio and requested or enabled by the user.
  • Tavallio does not sell Google user data.
  • Tavallio does not use Google user data for advertising, retargeting, personalized ads, data-broker activity, surveillance, or credit-worthiness decisions.
  • Tavallio does not retain Google Workspace API data to develop, improve, or train non-personalized or generalized AI or ML models.
  • Tavallio does not allow humans to read Google user data unless the user gives affirmative permission for support or troubleshooting, access is necessary for security or abuse investigation, access is required by law, or the data is aggregated and used for internal operations under applicable privacy requirements.
  • Tavallio transfers Google user data only as needed to provide user-facing features, with user consent, for security, for legal compliance, or as part of a merger or sale of assets after any required notice or consent.

How We Share Information

We share data only as needed to provide, secure, support, and improve Tavallio; process payments; comply with law; or complete a transaction such as a merger or sale of assets where legally permitted. Service providers must process data for the services they provide to Tavallio.

Infrastructure and hosting

Supabase, Cloudflare, Hetzner, and related providers that host the app, database, edge functions, storage, networking, security, and logs.

AI and execution providers

AI model and routing providers, browser automation runtimes, and task execution services used only to complete user-requested workflows.

Payments

Stripe and payment processors used to manage checkout, subscriptions, invoices, taxes, and fraud controls.

Communications and support

Email, notification, support, and issue-reporting providers used to respond to users and send service messages.

Analytics and security tools

Analytics, monitoring, abuse-prevention, and reliability tools used to understand service health and protect Tavallio.

AI Processing

Tavallio uses AI providers and execution services to complete user-requested tasks. If you ask Tavallio to summarize Gmail, draft a reply, analyze a document, update a spreadsheet, or perform a similar workflow, Tavallio may send the minimum relevant content to those providers solely to complete that request. We do not use Google Workspace API data to train or improve generalized AI or ML models, and we do not permit service providers to sell Google user data or use it for advertising.

Security

  • OAuth tokens and integration credentials are stored encrypted at rest.
  • Traffic is protected in transit with HTTPS/TLS.
  • Access to production systems is limited to people and systems that need it to operate, secure, or support Tavallio.
  • Sensitive actions are scoped by account permissions and Tavallio uses additional application-level ownership checks where user data is queried or changed.
  • Logs and diagnostic data are limited where practical and used for reliability, security, billing, and support.

Retention And Deletion

We keep personal data only for as long as needed to provide Tavallio, maintain security and records, comply with legal obligations, resolve disputes, and enforce agreements. OAuth tokens and connected-service credentials are kept while your account or connection remains active and are deleted or made unusable when you disconnect the service, revoke access, delete your account, or when they are no longer needed. Some logs, billing records, security records, and backups may remain for a limited period where required for security, legal, tax, accounting, or operational reasons.

Your Choices And Rights

  • Disconnect Google or another connected service in Tavallio settings.
  • Revoke Tavallio access from your Google Account permissions page.
  • Delete chats, memories, files, automations, and other saved content where the app provides controls.
  • Request account deletion, data deletion, or help exporting account data by contacting us.
  • Opt out of non-essential communications where an unsubscribe or preference option is available.

To revoke Tavallio's Google access directly through Google, visit Google Account permissions.

International Transfers

Tavallio and its service providers may process data in countries other than where you live. Where required, we use appropriate safeguards for cross-border processing.

Children

Tavallio is not directed to children under 13 and should not be used by children under 13. If you believe a child has provided personal data to Tavallio, contact us so we can review and delete it where appropriate.

Changes To This Policy

We may update this policy when Tavallio changes, when legal requirements change, or when our data practices change. If we materially change how Tavallio uses Google user data or other personal data, we will provide notice where required and ask for renewed consent where required.

Contact

Questions, privacy requests, and deletion requests can be sent to hello@tavallio.com.