Privacy Policy

01. Overview

We designed Paavya so your proposal content stays yours. We collect the information needed to run the Services, improve your drafting experience, and keep your account secure — and nothing more. We do not sell your personal information, and we do not use the content you upload to train models for other customers.

02. Information we collect

Information you provide

• Account details — name, work email, company, and password when you create an account.
• Billing information — plan selection and payment details, processed by our payment provider. We do not store full card numbers.
• Content — past proposals, RFP documents, answer libraries, and any text you upload or generate within Paavya.
• Communications — messages you send us through support, sales, or our contact form.

Information collected automatically

• Usage data — features used, drafts generated, and general activity that helps us improve the product.
• Device & log data — IP address, browser type, and timestamps, collected for security and diagnostics.

03. How we use your information

We use the information we collect to:

• Provide, maintain, and improve the Services, including generating proposal drafts from your content.
• Authenticate users, secure accounts, and prevent fraud or abuse.
• Process payments and manage subscriptions.
• Respond to your requests and provide support.
• Send service-related notices and, where permitted, product updates you can opt out of at any time.

04. Your content & AI processing

Paavya uses AI to read RFPs and generate responses grounded in your own materials. When you upload documents, they are processed to build a private, account-scoped knowledge base used only to draft your responses.

• We do not use your uploaded content to train shared or foundation models.
• Your content is logically isolated to your workspace and is not accessible to other customers.
• Where we rely on third-party AI providers to process requests, content is handled under agreements that prohibit using it to train their models.
• If our primary AI provider is unavailable, a request to Scribble may be sent through a backup route, the OpenUI Gateway operated by Thesys, which retries it on another host of the same model. The backup route is used only during an outage, is configured for zero data retention, and excludes providers that store or train on prompts.

05. Google user data

You can connect a Google account to Paavya, or choose files from Google Drive. This section describes exactly what Paavya accesses from Google, what it does with it, and what it never does.

What we access

• Your Google account email address — to show which Google account is connected to your workspace.
• Google Drive files you choose — Paavya uses Google's drive.file permission. It can open only the files you select in Google's own file picker, and the documents Paavya itself creates in your Drive. It cannot see, list, or search the rest of your Drive.
• Google Calendar events, only if you turn on calendar sync — Paavya creates and updates events for the deadlines and milestones of your pursuits. Each event Paavya creates is marked as Paavya's, and Paavya changes or removes only events it marked. It does not read your other events.

How we use it

• Files you choose are imported into your workspace: into your knowledge library, or as the solicitation for a new project. Paavya reads them to extract requirements, dates, and reusable answers for your workspace.
• For files chosen by the Google account connected to your workspace, Paavya checks for newer versions and re-imports a file when it changes, so your library does not go stale.
• Calendar access is used only to keep the pursuit events Paavya created in step with your plan.

Sharing

We do not sell Google user data, and we do not use it for advertising. We transfer it only to provide and improve the features you use in Paavya — for example, to the AI service providers that read an imported document on your behalf, under agreements that prohibit them from training on it — or when required by law. People at Paavya do not read your Google data unless you ask us to (for example, in a support request), it is needed for security or to comply with law, or it has been aggregated and anonymized.

We do not use data obtained through Google Workspace APIs to develop, improve, or train generalized artificial intelligence or machine learning models.

Storage, retention & deletion

• When your workspace connects Google, the access tokens Google issues are stored on our servers and are never sent to your browser. When you choose files in the picker, the short-lived permission Google gives your browser is held in memory for that session only and is not stored.
• Disconnecting Google in Paavya (Connectors → Google Drive → Disconnect) deletes the stored tokens and asks Google to revoke Paavya's access. You can also remove Paavya at any time from your Google account's third-party access page.
• Files you imported stay in your workspace until you delete them from the Library or close your account, as described in Data retention.

06. Sharing & disclosure

We do not sell your personal information. We share information only in these limited situations:

• Service providers — vendors who help us operate Paavya (hosting, payments, analytics, AI processing) under confidentiality and data-protection obligations.
• Within your workspace — content and activity may be visible to other members of your organization's workspace.
• Legal reasons — when required by law, or to protect the rights, safety, and security of Paavya, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

07. Data security

We protect your data with encryption in transit and at rest, role-based access controls, and regular security reviews. No system is perfectly secure, but we work continuously to safeguard your information and will notify you of any breach affecting your data as required by law.

08. Data retention

We retain your information for as long as your account is active or as needed to provide the Services. When you delete content or close your account, we delete or de-identify the associated data within a reasonable period, except where retention is required for legal, accounting, or security purposes.

09. Your rights & choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can manage most data directly in your account settings, or contact us to exercise these rights. We will not discriminate against you for exercising them.

10. Cookies & tracking

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Services are used. You can control cookies through your browser settings; disabling some cookies may affect functionality.

11. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the Services or by email. Your continued use of Paavya after changes take effect constitutes acceptance of the revised Policy.

12. Contact us

If you have questions about this Privacy Policy or how we handle your data, we're here to help.