Privacy Policy

Your data is yours, not ours. This policy says what we collect and why, where it goes, how long we keep it, and what you can ask us to do with it. We never sell it, and we never use it to train an AI model.

It's written to the standard of the EU General Data Protection Regulation (GDPR), and it also covers the UK GDPR, India's Digital Personal Data Protection Act, 2023 (DPDP Act), and California's privacy laws (CalOPPA and the CCPA). Wherever you live, you get the same rights.

The short version

• We collect what Sylvii needs to work: your account, what you tell her about your business, what you ask her to do, and what she writes and sends for you.
• Sylvii writes with Claude models from Anthropic, reached through OpenRouter with zero data retention, so your requests go only to model providers that commit not to keep them or train on them. We keep a record of Sylvii's work to fix mistakes, and we never train on your data.
• Your published site is public. Everything else is private to you and your company.
• Sylvii only emails people you add yourself, and only after you approve each email. Anyone she writes to can opt out, and that user can't email them through Sylvii again. If they ask, no Sylvii user can.
• Our analytics use no cookies. The only cookies we set keep you signed in.
• Write to support@sylvii.app to see, correct, export or delete your data. We answer within a month.

Who we are

Sylvii is operated by Ishant Kolipaka, an individual (a sole proprietor) in Hyderabad, Telangana, India ("Sylvii", "we", "us"). "Sylvii" is also the name of the AI that works for you in the app; where we mean her, we say "she".

For the personal data in this policy, we are the controller (under the DPDP Act, the Data Fiduciary): we decide why and how it's used. The exception is personal data about other people that you give us, such as your contacts. For that, you're in charge and we act on your behalf, except for the few things we decide ourselves, such as the Sylvii-wide do-not-email list (see Other people's data).

Contact and grievance officer. One address covers privacy questions, requests and complaints: support@sylvii.app. Our grievance officer under India's IT Rules, 2021 and the DPDP Act is Ishant Kolipaka, at that address. We acknowledge a complaint within 24 hours and resolve it within 7 days. The Contact page has the details.

If you'd like this notice in Hindi, Telugu or another language listed in the Eighth Schedule to the Constitution of India, ask us.

What we collect and why

Our rule is to collect only what we need. Here's what that means, part by part.

You don't have to give us any of this, but without your account details and what you tell Sylvii about your business, she can't work for you. Everything else is optional.

Your account

• When you sign up, by email or with GitHub, we get your email address and your name. If you use GitHub, GitHub shares your public profile basics (username, name, avatar and email) with our sign-in provider, Clerk.
• Clerk runs sign-in for us. It stores your sign-in details, sends your verification codes, and keeps a record of your sessions (such as the browser, device, IP address and approximate location of each sign-in) to keep your account secure. If you set a password, Clerk stores it hashed; we never see it.
• We keep a copy of your name, email address and the company you belong to, so Sylvii knows who you are.
• We record which version of our Terms and this Privacy Policy you accepted, and when.

Why: to create your account, sign you in, keep it secure, and contact you about it.

Your business

• What you tell Sylvii about your business: its name, what you offer, who it's for, your prices, your story, where you work, how people book you, and the answers you give on the onboarding cards and in her questions.
• Your website, if you give us its address. Sylvii reads its public pages to suggest details for your profile, and you decide what to keep.
• Writing samples, if you paste some, so Sylvii can write in your voice.
• Your time zone and language, so your briefing arrives in your morning.
• A contact address you choose to publish on your site, and, if you use outreach, the mailing address you give for the footer of your emails (the law requires one).

Why: so Sylvii can write your site, your emails and your briefings, and do the work you ask for.

What you and Sylvii do

We store the content of your company's work in Sylvii, so it's there when you come back:

• Chat: your conversations with Sylvii. You can delete a conversation at any time, and it's deleted at once. Copies in our AI records and backups go within 30 days.
• Your site: every version Sylvii writes or you edit, and the instructions you gave for each.
• Sylvii's email address (yourname-xxxx@sylvii.app): the emails she sends to you and your team, the emails sent to that address, and the original copy of each one we receive. Sylvii only ever writes to members of your company from this address. If someone outside your company emails it, we store their message with your company's mail, but Sylvii doesn't act on it.
• Briefings: the summaries Sylvii writes and emails to you.
• Activity: a log of what Sylvii did and when, shown to you in the app, and an audit record of every change, so we can tell what happened and who did it.
• Auto mode, if it's on for your account: the tasks you give Sylvii, the commands she runs, the files she exports for you, a copy of her workspace, and the settings you choose. You can also store API keys for her to use there. They're encrypted, never shown again, and never given to the AI model. You can delete them at any time.
• Records of Sylvii's work: what she was asked, the information she looked at, what she wrote back, and what it cost, so we can show you her work, fix mistakes and keep AI costs in check.

Why: this is the service. Sylvii can't work for you without it.

Outreach email

When outreach is on, Sylvii drafts emails to people you know and add yourself. You approve each one before it goes. They're sent in your name from your own address at sylvii.site (such as firstname.lastname@sylvii.site) through Amazon SES. For this we store:

• The contacts you add: their name, email address, how you know them, and your notes.
• The emails: each draft, the exact text you approved and when, what was sent, delivery results, and the replies that come back (with the original copy of each reply).
• Your consent to Sylvii emailing your contacts in your name, with its time and wording.
• Opt-outs: anyone who replies "no thanks", clicks unsubscribe or asks us goes on a do-not-contact list (see Other people's data).

Every email says it was sent with Sylvii and that it's a marketing email from your business, and carries a one-click unsubscribe. Sylvii sends at most 15 a day, at most 2 follow-ups, and never to anyone on do-not-contact.

Why: to send the emails you approve, bring the replies back to you, and keep everyone's choice to opt out.

Payments

Paid plans are sold through Dodo Payments, our merchant of record: Dodo is the seller, charges your card, collects any sales tax or VAT and sends your receipts. You give your card details to Dodo, not to us, and Dodo handles them under its own privacy policy. We receive from Dodo what we need to run your subscription: your name, email address, country, plan, payment status and dates, and Dodo's reference numbers. We never see your full card number.

Why: to give you the plan you paid for, and to keep the records tax law asks for.

Using the website and the app

• Product analytics. We use PostHog to learn which parts of Sylvii people use and where they get stuck: pages viewed, and steps such as "started onboarding" or "published a site". These events carry internal ids, counts and the kind of business (an idea or an existing one), never your name, your email, or the text of what you clicked or wrote. PostHog keeps its state in memory only, with no cookies and no browser storage, so it can't recognise you from one page load to the next, and we don't tell it who you are. It sees your IP address when your browser connects; we've set it to discard it.
• Screen recordings. PostHog can record how a page was used (clicks, scrolling and layout) so we can find what's confusing. On every page, all text and everything you type is masked, so a recording shows the shape of the page, not its words.
• Error reports. When something breaks, Sentry gets a report of the error with our internal ids for you and your company, your browser type, and a short masked replay of the moments before it, with every word hidden and every image blocked. It doesn't get request contents, cookies or your IP address.
• Server logs. Our servers log requests and what the app did, with internal ids. Before a line is stored, we strip tokens, passwords, cookies, message bodies and page text. Our hosting and network providers also see your IP address when you connect, as any website's do.

Why: to keep Sylvii running, secure and getting better.

When you write to us

If you email us for help, to report a site, with a copyright notice, or with a privacy request, we keep the correspondence and your email address, so we have the history if you write again. A copyright notice may be passed on to the person it's about; our Contact page explains.

Before you sign up

The first answers you give on our start page stay in your own browser until you create an account. Then they're sent to us once and cleared from your browser.

How Sylvii uses AI

Sylvii is an AI. She writes your onboarding cards, your site's wording, your briefings and your email drafts, and she answers you in chat. To do that, she sends what the task needs (such as your business profile, your instructions and the relevant messages) to an AI model.

• The models are Claude Haiku and Claude Sonnet, made by Anthropic. We reach them through OpenRouter, which serves them from Anthropic, Google Cloud (Vertex AI) or Amazon Bedrock, whichever it routes the request to under zero data retention.
• Zero data retention. Every request is sent with OpenRouter's zero data retention setting and with data collection refused, so OpenRouter routes it only to model providers that commit not to store it or train on it. The provider processes each request to answer it. It may hold part of a prompt in a short-lived cache, for up to an hour, so repeat requests are faster.
• We don't train on your data either. We don't use it to build or train any AI model, ours or anyone else's.
• We keep our own record of each request and answer, in our database and in Langfuse, a service that helps us find and fix Sylvii's mistakes. Langfuse records the full prompt and answer, so it can hold your business details and your email content. We keep these traces for 30 days.
• You stay in charge. Sylvii drafts; you decide. No outreach email goes out without your approval, and your site isn't published until you publish it.

Why we're allowed to use it

The GDPR and the UK GDPR ask us to name a lawful basis for each use:

In India, under the DPDP Act, we use the personal data you give us for the purposes you gave it for, which the Act allows without separate consent (section 7(a)). Where we need your consent for anything else, we'll ask for it, and you can withdraw it at any time by writing to us. Withdrawing stops future processing but doesn't undo what was done before.

Other people's data

Using Sylvii means giving us some data about other people: the contacts you add for outreach, the people who reply to your emails or write to Sylvii's address, the people you mention in chat, the members of your team, and anyone named in the writing samples you paste.

• For that data, you're the controller and we're your processor. We use it only to do what you ask in Sylvii, on your instructions and under our Terms. You're responsible for having a lawful basis to give it to us and to email the people you add, and for telling them about it where the law requires. Sylvii only uses contact data as you've consented; she doesn't scrape or buy contacts. A few things we decide ourselves, such as the Sylvii-wide do-not-email list below, and for those we're the controller, as our Terms explain.
• If you're someone a Sylvii user emailed, the user is the sender, and their own privacy notice applies to them. You can opt out at any time: reply "no thanks", click unsubscribe in the email, or write to us at support@sylvii.app. You can also ask us directly to delete what we hold about you. We'll do it, and tell the user where the law allows.
• Never again, if you ask. Opting out puts you on that user's do-not-contact list, which stops them emailing you through Sylvii. That list is kept inside their company's data and holds your address as written; if their account closes, we keep only a keyed hash of it, so they still can't email you if they come back. We also keep a second list, across all of Sylvii, of addresses that asked never to be emailed through Sylvii, bounced or complained, so that no Sylvii user can email them. For this list we keep only a keyed hash of the address: a code we can use to recognise your address, but not to read it. We keep it for as long as Sylvii sends email, because deleting it would let the emails start again.

Published sites are public

Your site is published at yourname.sylvii.site and at sylvii.app/yourname. Anything on it, including any contact details you choose to show, can be seen by anyone, found by search engines and read by AI crawlers. Don't put anything on it you wouldn't want public.

For visitors to a site we host:

• No cookies and no tracking. Sites run no scripts and set no cookies, and we run no analytics on them.
• Our servers see a visitor's IP address when they load a page, as any website's do, in our hosting provider's request logs.
• Fonts and images. A site loads its fonts from Google Fonts, and may show images from other websites, so the visitor's browser connects to those services, which see its IP address.
• Report this site. Every site has a link to report it to us.

When we look at your data

No person at Sylvii reads your content as a matter of routine. We look only:

• when you ask us to, for example to help with a support request;
• to fix something, when an error or a bad answer from Sylvii needs a person. That can mean reading the error report, the logs or the AI trace involved;
• to investigate abuse or a report about a site or an email, and to keep the service and other people safe; or
• when the law requires it (below).

We may use aggregated or de-identified data, which can't identify you, to understand and improve Sylvii.

When the law requires it. We disclose personal data to authorities only when compelled by valid legal process, such as a court order or a lawful request under Indian law, or in an emergency to protect someone's life or safety. We disclose only what's required, and we tell you first unless the law forbids it or it's an emergency.

If Sylvii changes hands. We plan to move Sylvii into a company we form, and it could one day be sold or merged. If that happens, your data moves with the service, under this policy, and we'll tell you before it becomes subject to a different one.

Who helps us run Sylvii

We use these companies to run Sylvii. Each sees only what its job needs, and each works under a contract that limits what it can do with it. All but one are our processors (or service providers). The exception is Dodo Payments: as merchant of record it sells you the subscription, so it decides for itself how it handles your payment details, under its own privacy policy.

Our uptime checks (Better Stack and Checkly) only check that Sylvii is up; they don't see personal data. If we add or replace a company on this list, we'll update it at least 14 days before.

Where your data is stored

Sylvii is run from India, and our servers and nearly all of our providers are in the United States. Whatever country you're in, your data is stored and processed in the US, and may be reached from India to run the service.

When personal data from the EU, the UK or Switzerland goes to one of our providers in a country without an adequacy decision, it's protected by that provider's data processing terms, which include the EU Standard Contractual Clauses (with the UK Addendum for UK data), or by the provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. Ask us for a copy of the safeguards that apply. Transfers from India follow the DPDP Act, which allows them except to countries the Government of India restricts.

How long we keep it

We keep data only as long as we need it for the reasons above, then delete it or make it anonymous.

We may keep something longer if the law requires it, or to deal with a legal claim, and only for that purpose.

How we keep it safe

• In transit. Everything between you and us is encrypted with HTTPS (TLS), and our app tells browsers to use nothing else.
• Your sign-in. Clerk handles sign-in and passwords; we never see your password.
• Secrets. API keys you store for auto mode are encrypted (AES-256-GCM), tied to your company, and opened only for the single command that needs them. They're never shown again or given to the AI model.
• Separation. Every company's data is kept apart, and every request checks which company it belongs to. Published sites are served from their own domain, sylvii.site, in a sandbox that can't run scripts or read our cookies.
• Less in our records. Error reports and logs are stripped of message content, cookies and passwords before they leave our servers. Only the operator can see Sylvii's data and our providers' dashboards.

No service is perfectly secure. If a breach affects your personal data, we'll tell you without undue delay, along with the regulators the law requires (such as an EU or UK supervisory authority within 72 hours, and the Data Protection Board of India).

To report a security problem, write to support@sylvii.app with "Security" in the subject line.

Cookies and similar technology

We keep this short because we use very little:

• Sign-in cookies. Clerk sets cookies on sylvii.app that keep you signed in and protect your account. They're essential: Sylvii can't work without them. Clerk may also run a bot check when you sign up.
• Your browser's storage, for features you use. The app saves a few things in your own browser: whether the sidebar is open, when you last looked at a page (so new items can be marked), text you haven't sent yet, and your first answers before you sign up. They stay on your device and aren't used to track you.
• Error reports. When an error replay is recorded, Sentry keeps a session id in your browser's session storage, which clears when you close the tab.
• Analytics. PostHog keeps its state in memory only: no cookies, no browser storage.
• Published sites set no cookies at all.

We don't use advertising cookies or trackers, so there's no cookie banner. Our analytics, screen recordings and error replays, described above, help us find what's broken or confusing. If you'd rather we didn't use analytics or screen recordings for your visits, write to us and we'll help you block them. You can block or delete cookies in your browser, but you won't be able to sign in.

Do Not Track. We don't track you across other websites, and we don't let anyone else do so on ours, so we treat every visitor the same way whatever their browser's Do Not Track or Global Privacy Control setting says.

Your rights

Wherever you live, you can ask us to:

• Tell you what personal data we have about you, what we do with it, and who we share it with.
• Give you a copy of it, in a common machine-readable format you can take elsewhere.
• Correct it if it's wrong or incomplete. You can change most of it yourself in the app.
• Delete it. We'll delete your data, and close your account if Sylvii can't work without it, except what the law makes us keep (see How long we keep it).
• Restrict how we use it while a question about it is sorted out.
• Object to our using it on the basis of our legitimate interests. We'll stop unless we have compelling grounds, and we'll always stop for direct marketing.
• Withdraw your consent where we rely on it, at any time. That doesn't affect what was done before.
• Not be subject to a decision with legal or similarly significant effects made only by automated means (see Automated decisions).
• Name a nominee. Under India's DPDP Act, you can name another person to exercise your rights if you die or can no longer act yourself.
• Complain to us through our grievance officer, and to a regulator: your local data protection authority in the EU, the Information Commissioner's Office in the UK, the Data Protection Board of India (once you've come to us first), or the California Attorney General or the California Privacy Protection Agency.

How to ask. Write to support@sylvii.app with "Privacy" in the subject line, from the email address on your account if you have one. Tell us what you'd like. It's free.

Checking it's you. Before we act, we confirm the request came from you, usually by writing back to the email address on your account. If you're not a Sylvii user, such as someone a user emailed, we confirm by writing to the address the request is about. We may ask for a little more if a request is about sensitive data. Someone can ask on your behalf with your signed permission, and we may still check with you.

When. We acknowledge your request within 24 hours and answer it within a month. If a request is complex, we may need up to two more months where the law allows; if so, we'll tell you why within the first month. If we can't do what you ask, we'll explain why and how you can challenge it.

We won't treat you differently, charge you more or give you a worse service for using your rights.

Children

Sylvii is for people aged 18 or over. We don't knowingly collect data from anyone younger. If we learn we have, we'll delete it. If you think a child has given us their data, tell us.

We don't sell your data

We don't sell your personal data, and we don't "share" it for targeted advertising in the sense California law uses. We've never done either. We don't show ads, and we don't use your data to profile you for anyone else.

Automated decisions

Sylvii is automated: she suggests answers about your business, picks a layout for your site, writes its wording and your briefings, drafts emails, sorts replies (a person, an out-of-office, a bounce or an opt-out) and stops follow-ups when someone replies or opts out. A daily limit also caps how much AI work an account can use.

None of this makes a decision with legal or similarly significant effects on you or anyone else. Sylvii doesn't decide on credit, jobs, prices or access to anything. You review her work, you approve every outreach email, and you can ask a person at Sylvii to look at anything she did.

California residents

California law asks for a few details in a set form. In the last 12 months we have collected:

• Identifiers: your name, email address, internal ids and, through our providers, IP address.
• Commercial information: your plan and payment history (through Dodo).
• Internet activity: how you use the app, through analytics, logs and error reports.
• Professional information: what you tell us about your business.
• Account sign-in details, which California treats as sensitive. We use them only to sign you in and keep your account secure.

They come from you, from Sylvii's work for you, from GitHub if you sign in with it, and from Dodo. We use them for the purposes in What we collect and why, keep them as How long we keep it says, and disclose them only to the providers in Who helps us run Sylvii. You have the rights to know, delete and correct, and to not be treated differently for using them, as Your rights describes. We don't sell or share personal data, so there's nothing to opt out of.

Features we haven't built yet

We plan to add more to Sylvii: connecting your Gmail, connecting LinkedIn (through Unipile), your customers paying you through Sylvii, and our team working in your account on your behalf when you ask. None of these exist yet. Before we add any of them, we'll update this policy to say what they collect and why, and ask for your consent where the law requires it.

Changes to this policy

We may update this policy as Sylvii and the law change. Each version shows its date at the top. If we make a material change, we'll tell you by email or with a notice in the app before it takes effect. If a change needs your consent, we'll ask for it.

Questions

Questions, concerns or requests about this policy, your data or your rights: write to support@sylvii.app. A person reads every email.

Adapted from the Basecamp open-source policies / CC BY 4.0.