To operate the service: route messages, generate AI proposals, execute approved actions, send notifications, and build the audit history you can review at any time. We use aggregate, de-identified analytics to improve the product (find slow pages, find broken flows). We do not sell your personal data, ever.

We share the minimum data needed for each integration. Each provider is bound by their own data-processing agreement.

Conversations with the agent are sent to OpenAI to generate responses. Per our agreement with OpenAI, this traffic is not used to train their models. We never share your data with other AI providers.

You can request a copy of your data, ask us to correct it, or delete your account at any time from Settings → Account → Data export / Delete account. Deletion removes your profile and all user-scoped data within 30 days. We retain only what's required by law (e.g., tax records of past payments). EU and California residents have additional rights under GDPR and CCPA; reach out to privacy@aptoria.ai to exercise them.

We store a session token to keep you signed in and a small set of preferences locally (theme, last-viewed tab, dismissed banners). We do not use third-party advertising cookies and we do not track you across other sites. A minimal cookie banner appears for first-time visitors so you can confirm.

Data in transit is encrypted with TLS 1.2+. Data at rest is encrypted by Supabase (AES-256). Row-level security is enforced in the database — tenant A can never read tenant B's data, even if our application code has a bug. Full details on /security.

The service is not intended for users under 18 and we don't knowingly collect their data.

Material changes to this policy will be announced via in-app banner + email at least 30 days before they take effect. Continued use after the effective date constitutes acceptance.

Privacy questions: privacy@aptoria.ai. Account-specific support: open a ticket at /support.