Privacy and Customer Data

Two categories of data pass through Pinavia. Account data identifies the people using the workspace: name, work email, organisation membership, and role. It exists so access can be scoped and so an approval can be attributed to a named person, which the product's governance model depends on.

Workspace content is the evidence you connect or upload — documents, communications, and business context — together with what the product derives from it: extracted text, classifications, embeddings, citations, drafted recommendations, approval records, and audit events. It is processed to deliver the workspace you configured, and for no other purpose.

Pinavia does not sell customer data, does not use it for advertising, and does not use workspace content to train models — neither its own nor a provider's. Model providers operate under agreements that exclude customer content from training. Public marketing pages use cookieless analytics that record no workspace content and set no advertising cookies.

Evidence is stored in your workspace and retrieved to answer your questions. When generating an answer, the relevant passages are sent to the model provider configured for your deployment so that a response can be produced, then returned and stored with the citations attached.

Where a deployment requires that content never leave infrastructure you control, local model execution keeps retrieval and generation on a local endpoint. Where storage is local but the model is a cloud API, the product says exactly that rather than implying otherwise — overstating the boundary would be the most damaging thing a governance product could do.

Access is authenticated through Clerk and scoped to your organisation's workspace. Members see only what their workspace and role permit, restricted evidence stays restricted rather than silently reappearing in a summary, and agent access is issued as revocable scoped tokens. Pinavia staff do not access workspace content except where you request support and grant access for that purpose, and such access is logged.

Workspace content is kept for the term of your agreement so that decisions remain defensible over time — an audit trail that expires is not an audit trail. You can export evidence, decisions, approvals, and the audit trail at any point. On a written deletion request, content is removed from production systems within 30 days and from routine backups within a further 30 days as media rotate.

Where individuals named in your evidence exercise rights of access, correction, or erasure, you direct that request as the controller and Pinavia assists as processor. Requests reach us at hello@pinavia.io and we respond within 30 days. The subprocessors we use, and the notification commitments that apply if data is ever exposed, are set out in the data processing addendum.