Privacy Policy

1. Who we are

Convira is operated by Convira OÜ, a private limited company registered in Estonia (registry code 17268095), with its registered office at Järvevana tee 9, Kesklinn, 11314 Tallinn, Harju County, Estonia.

For anything relating to this policy or your personal data, contact us at support@convira.ai. Privacy questions are handled directly by our team at that address.

For the purposes of the EU General Data Protection Regulation (GDPR), Convira OÜ is the “controller” of the personal data described here. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

2. Scope and the short version

This policy applies to the Convira website, the Convira desktop app, and the Convira cloud service. It does not apply to third-party services we merely link to, or to AI model providers' own handling of data (covered below).

The short version:

• Local and Private Box runs stay on your hardware. When you run Convira locally or on a self-hosted Private Box, the agent runs on your machine against models you host. Prompts, responses, and the session record stay on your hardware unless you deliberately invoke a managed online tool, or arm a task to run while your computer is off - both described below.
• We don't store the contents of your cloud runs. To run a cloud task, your prompt and the content it needs pass through our infrastructure to the AI model provider handling the request, and the response streams back to your device, where it is stored. We keep only operational details about the run - timing, status, which model was used, and how many tokens and credits it consumed. The one exception is a chat you choose to share when you rate an answer: we keep that chat for up to 90 days to help improve Convira, and it is deleted sooner if you remove the rating.
• The AI model providers see your cloud prompts. Cloud runs are fulfilled by Anthropic, OpenAI, Google, xAI or Meta. They receive the content needed to generate a response and process it under their own terms.
• We collect the data we need to run an account. Your email, your plan and billing status (via Stripe), and the technical records needed to keep the service secure.
• We don't sell your data. We advertise on Meta, Google and Microsoft, and we measure those ads with your consent where the law requires it, and with a one-click opt-out everywhere else.
• You have rights over your data - access, correction, deletion, and more - described in “Your rights” below.

The rest of this policy is the detail.

3. The data we collect and why

Below is each category of personal data we process, why we process it, and our legal basis under the GDPR.

Account data

When you create a Convira account we store your email address, an optional first and last name, and a record of whether your email has been verified. A Convira account has no password, so there is none for us to store. If you sign in with Google or GitHub, we also store the identifier that provider gives your account, described in “Signing in with Google or GitHub” below. If you belong to a team or organization, we store your membership and role. Legal basis: performance of our contract with you (providing the service).

Billing data

Payments are processed by Stripe. We do not see or store your card details - those go directly to Stripe. We store the identifiers and metadata needed to manage your subscription: your Stripe customer and subscription IDs, your plan, your billing currency and amount, your seat count (for teams), your billing period dates, and a ledger of credit consumption and top-ups. Legal basis: performance of our contract with you, and compliance with our legal obligations (accounting and tax law).

Authentication and security data

To keep your account secure we store hashed session tokens, hashed one-time codes for signing in and for email verification, a limited audit log of administrative actions on our side, and security event records. Our error-monitoring tooling (see “How we share data”) may incidentally process technical request data; it is configured to exclude authentication credentials and other sensitive values. Legal basis: our legitimate interest in securing the service and preventing abuse, and performance of our contract with you.

If you add a passkey, we store its public key, the credential's own identifier, the name you give it, the dates it was added and last used, and whether it syncs to your other devices. A public key cannot sign anything, so it is of no use to anybody who takes it. We also keep the technical details that come with a passkey: how it reaches your device (built in, a phone nearby, USB, NFC or Bluetooth), the signature counter your device reports, which is how a copied credential is spotted, whether it is the kind that can be backed up to your other devices, the site address it was registered for, and which of our sign-in doors it was made for. No biometric data of any kind is ever sent to Convira or stored by us. Your fingerprint and your face stay on your own device and never leave it.

Cloud runs

When you run an agent task on the cloud runtime, the prompt, files, and context the task needs are sent from your device to our cloud service and on to the AI model provider that handles the request; the response is returned to your device, which keeps the record of the run locally.

We do not store the contents of cloud runs. We retain only operational metadata about each run - such as its status, timestamps, the runtime and AI model and provider used, durations, and token and credit usage. The text you entered, the files involved, the tool inputs and outputs, and the model's responses are not stored on our systems; that record lives on your device. The one exception is a chat you choose to share when you rate an answer: we keep that chat for up to 90 days to help improve Convira, and it is deleted sooner if you remove the rating. Legal basis: performance of our contract with you.

Although we do not store cloud run content, it passes through our infrastructure in transit and is sent to the AI model provider handling the request. On the local runtime or a Private Box, your prompts, files, memory, and AI inference stay on hardware you control, with two exceptions that are always your choice. The first is a billed tool you choose to run - web and X research, image and video generation, and connector actions - which needs managed provider keys we hold, so that single tool call (its input, plus the run, session, and device identifiers used to route and bill it) is sent to Convira to execute and returned to your device. A tool's input can include a URL, query, document value, or reference media needed for that action, plus the permission rules and approved-URL list that decide whether the call is allowed, but it does not include the rest of the conversation or unrelated run content. These tools run only while you are online. The second is a task you arm to run while your computer is off: arming means we run it for you, so Convira's servers assemble that task's prompt and send it to your box or the model provider on your behalf, and that task's prompts and answers pass through our infrastructure. Tasks you start yourself never do.

AI model providers

Cloud runs are fulfilled by third-party AI model providers, currently Anthropic, OpenAI, Google, xAI and Meta. To generate a response, the provider receives the content of your request. Each provider processes that data under its own privacy policy and data-retention practices, which we do not control. We pass requests through to the routed provider; we do not retain the request or response content ourselves. The one exception is a chat you choose to share when you rate an answer, which we keep for up to 90 days, or until you remove the rating. Legal basis: performance of our contract with you.

Team Hub

If your workspace uses Team Hub, the messages, bulletins, conversation names and attachments your team creates are encrypted on your own devices before they reach us. Our servers store that ciphertext and hold no key that opens it, so we cannot read what your team writes, and neither can anyone who obtains a copy of our database.

We do store the routing metadata that delivery needs, and it is worth being specific about it: which workspace and conversation each item belongs to, its position in that conversation's sequence, the encryption epoch it was sealed under, its content type, byte size and hash, which member device sent it, and when. For a direct message or a group we store the account identifiers of the people in it, and which of them run that group. We also store which member reacted to which message, and which member acknowledged which announcement and at what time - that is how delivery, membership and read receipts work at all. Encrypted attachment objects are held in the file storage of our database provider. Legal basis: performance of our contract with you.

Two choices you make on this computer can send Team Hub words to a third party. With voice typing set to cloud, what you dictate is sent to our voice provider to turn into text; with read aloud set to cloud, the text of the message you play is sent there to make the audio. Nothing is sent for either one unless you have chosen the cloud engine and continued past the notice the app shows you first. We do not store the recording, the text or the audio on our servers, and Settings offers an on-device engine for both, which sends nothing anywhere. Legal basis: your consent (Article 6(1)(a) GDPR).

Local and Private Box runs

When you use the local runtime or a self-hosted Private Box, the agent runs on your own machine or your own server, against AI models you host. Run content is stored on that hardware and is not transmitted to Convira as a run. Aside from authenticating your licence or account, the only run-linked data sent to Convira is the input and routing identifiers for a managed online tool you deliberately invoke - and, if you arm a task to run while your computer is off, that task, because Convira has to assemble its prompt and send it to your box for you. A Private Box also tells us its address and its TLS fingerprints once, at pairing, and we keep those in the clear so your teammates' devices can check they are connecting to the right machine; the box's own credential never reaches us in plaintext, because the installer prints a transfer code on the box's own console for a settings manager to type in, and the envelopes we relay and store afterwards are each sealed to one named device.

The website

When you use convira.ai:

• Contact and enterprise-inquiry forms. If you submit the help page contact form or the enterprise inquiry form on the pricing page, we receive the name, email address, and message you provide (plus, for enterprise inquiries, your company and optional team size). We store what you send as a support ticket, together with the replies, so that we can answer you and keep the whole conversation in one place. The emails about it are sent and received through Resend. A ticket that has been closed is deleted two years after its last message. We briefly hold your IP address in memory to rate-limit submissions, and the forms are protected by a Cloudflare Turnstile bot check. Legal basis: our legitimate interest in responding to your enquiry and preventing spam.
• Newsletter sign-up. If you sign up for product updates in the site footer, or ask us for a template or a guide, we store your email address, which page the sign-up came from, which consent wording you were shown and in which language, and the date, IP address, and browser of the sign-up. Nothing is sent to you until you press the confirm link in the first email, and that press is the record of your consent. Our marketing email is sent by Resend, which holds the address and the delivery record for us in the United States under the European Commission's standard contractual clauses and its certification under the EU-US Data Privacy Framework. Every message carries an unsubscribe link and a one-click unsubscribe header, and one press stops all of it. A sign-up form may also offer a separate, optional tick asking whether we may share your email address with Meta, Google and Microsoft so that the ads you are shown there are ours. It is never ticked for you, the sign-up works the same without it, and we act on it only after you press the confirm link. The unsubscribe link in any message stops this as well, and you can write to us to take back this tick on its own. Legal basis: your consent - withdraw any time via the unsubscribe link in any message we send, or by emailing us.
• Preview access cookie. If you sign in to a preview of this site with an access password, a strictly necessary cookie remembers that you did. Legal basis: strictly necessary to provide the page you requested.
• Currency preference cookie. A functional cookie remembers whether to show prices in EUR or USD, set from the country your IP address resolves to. Legal basis: our legitimate interest in showing you relevant pricing and keeping that display consistent across visits.
• Aggregate analytics. We use Vercel Analytics, which is cookieless. We collect page views and selected marketing interactions such as a plan, tab, or call-to-action click using static labels, the page path, and aggregate context such as referrer, country, and device type. We do not send form values, email addresses, search parameters, or auth-page activity to analytics. It does not set cookies, build a cross-site profile, or track you across sites. Legal basis: our legitimate interest in understanding how the site is used.
• Advertising measurement (consent where required, opt-out elsewhere). In the EEA, the UK, Switzerland, California and the other places where we ask first, nothing from Meta loads and no ad click identifier is stored until you accept in the privacy bar. Elsewhere, including the rest of the United States, measurement is on by default; the “Do not sell or share my personal information” link in the footer switches it off, and we honour the Global Privacy Control browser signal as an opt-out. If you accept in the privacy prompt, we load the Meta Pixel and also send the same events from our server to Meta through the Conversions API: page views, download clicks, checkout starts, purchases, and account creation, together with your IP address, browser identifier, the ad click identifier, and a hashed form of your email at signup and purchase. Meta uses this to attribute our ads and to build audiences for us. Nothing is loaded or sent before you accept, and you can withdraw at any time via the privacy link in the footer. If you arrived through one of our Google or Microsoft ads, the click identifier that ad put on the address (gclid or msclkid) is kept in a first-party cookie, and we report views of the download and pricing pages, checkout starts, purchases, and account creation from our server to Google Ads or Microsoft Advertising together with that identifier and, for a purchase, the amount paid. No Google or Microsoft script is loaded in the page, and no email address, IP address or other data about you is sent to them. Legal basis: your consent (Article 6(1)(a) GDPR).

Support communications

If you email us or otherwise contact support, we keep that correspondence so we can help you and keep a record of the issue. Legal basis: our legitimate interest in providing support and the performance of our contract with you.

4. Signing in with Google or GitHub

You can sign in to Convira with a Google account or a GitHub account. They are two of the four doors: the other two are a one-time code we email you and a passkey you add to the account yourself. This section says exactly what those providers give us, what we do with it, and how to take it away.

What we receive

• Your email address at that provider, and whether the provider has confirmed that it is yours. From GitHub we read the primary verified address on the account, because GitHub does not put an address in the sign-in answer itself.
• Your name, as the provider spells it.
• The account's own identifier at that provider, which is a value that does not change. It is what lets you sign in again after you change your name or your address there.

What we use it for

Two things, and nothing else: to sign you in, and to keep one Convira account per email address, so that signing in with Google today and with GitHub tomorrow on the same address reaches the same account instead of making a second one. We do not use it to build a profile of you, to train a model, or to target advertising. Legal basis: the performance of our contract with you (Article 6(1)(b) GDPR): an account needs a way to sign in to it.

What we never receive

We never receive your password at the provider, your contacts, your files, your repositories, or your email. We ask each provider for the smallest permission it offers for signing somebody in, and that permission gives us no other access to your Google or GitHub account.

Where it is kept, and who else sees it

The address and the provider's identifier are stored with the rest of your account record in our database in the European Union, for as long as the account exists. We never sell them, and we never share them with anyone outside the processors listed in “How we share data” below. We do not store the name: it is only read while you sign in.

Convira's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to take it away

Open How you sign in in your account and remove Google or GitHub. The link to that provider is deleted at once and every other way in that you have still works. Deleting your Convira account removes it with everything else.

5. Cookies and similar technologies

We keep our use of cookies and device storage to a minimum. The only third-party technology we use is the Meta Pixel for advertising measurement, and it is loaded only after you accept it in the privacy prompt. We use the following cookies and browser storage:

Our aggregate analytics (Vercel Analytics) is cookieless and does not store anything on your device. The only technology on this site that requires consent under EU and Estonian law is advertising measurement, so where that consent is required, and in California, a privacy bar asks for that one choice before anything from Meta is loaded, and the footer link reopens it at any time. That link reads “Do not sell or share my personal information” in the United States, California included, and in the other places where measurement is on by default, and “Cookie settings” everywhere else.

Support chat. The assistant in the chat widget sends the messages you type to Anthropic to generate a reply, and applies short-lived rate limits keyed to your IP address to prevent abuse. Please do not enter sensitive personal data in the chat; for account-specific help, email support@convira.ai.

6. How we share data

We do not sell personal data. We share it only with the service providers (“processors”) we rely on to run Convira, and only as needed. The main ones are:

The providers we rely on to run Convira, and what each one does, are listed on our subprocessors page.

We will also disclose personal data if we are legally required to (for example, a valid court order), where necessary to protect the rights, safety, or property of Convira, our users, or others, or as part of a merger, acquisition, or sale of assets - in which case we will require the recipient to honour this policy or notify you of any change.

7. International data transfers

Convira OÜ is based in Estonia, in the EU. Some of the providers listed above are located in, or process data in, countries outside the European Economic Area, in particular the United States. Where that happens, the transfer is covered by an adequacy decision of the European Commission, by the EU Standard Contractual Clauses, or by another lawful transfer mechanism. You can ask us for more detail using the contact details below.

8. How long we keep data

• Account data - for as long as your account exists, and for a short wind-down period after you close it.
• Accounts that never bought a plan - if you make an account and never buy a plan, we remove it after 180 days with nothing happening on it. We email you at 150 days to say so, and signing in once is enough to keep it. An account that ever paid is never removed automatically, because its invoices are records we have to keep.
• Billing and accounting records - for as long as required by Estonian accounting and tax law (generally seven years).
• Authentication tokens and session records - until they expire or are revoked, then they are removed in routine cleanup.
• Security and administrative audit logs - for a limited period proportionate to security needs.
• Marketing email list - while you are subscribed. If you unsubscribe we keep the record that this address asked not to be mailed, so that a later sign-up somewhere else cannot put it back by mistake. A sign-up nobody confirms is never mailed anything further and its confirmation link stops working after three days.
• Cloud run content - not retained by us, except a chat you choose to share when you rate an answer, which we keep for up to 90 days (or until you remove the rating). The record lives on your device. Operational run metadata is retained while your account is active.
• Team Hub messages, bulletins and attachments - kept while your workspace is active, with one timer: our servers delete their copy of a message's contents, and of a file, after 30 days, and after 365 days on a bulletin board. A message's 30 days run from when it was sent and a file's from when it was uploaded. The record of when each message was sent, the accounts that sent them and the history of who was in a workspace are not on that timer. This is our copy only. The computers that received a message keep it, and the file with it, and we never ask them to delete anything. We hold the sealed copy and no key that opens it.
• Armed task content - the sealed copy of an armed task's instructions and the access it needs is held while the task stays armed, and is deleted when you disarm the task or change it. If you turned recovery on, an encrypted copy of that run's in-progress conversation and completed tool results is held while the run is unfinished, for up to 24 hours after it ends, and up to 7 days if it never settles.
• “Help improve Convira” data (if you ever opt in) - a limited period, currently 90 days in our active systems, with a purge-on-request path.
• Contact-form and support correspondence - a message you send us through the website becomes a support ticket, with our replies and yours kept on it. Once the ticket is closed we delete it, and everything on it, two years after its last message.

When we no longer need personal data, we delete it or irreversibly anonymize it.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you, and get a copy of it.
• Rectify data that is inaccurate or incomplete.
• Erase your data (the “right to be forgotten”) in the circumstances the law allows.
• Restrict or object to certain processing, including processing based on our legitimate interests.
• Data portability - receive data you gave us in a portable format.
• Withdraw consent at any time, where we rely on consent (this doesn’t affect processing already carried out).

To exercise any of these, email support@convira.ai. We will respond within the time limits the law sets (normally one month).

If you think we’ve mishandled your data, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee/en), or to the supervisory authority in your country of residence. We'd appreciate the chance to put things right first, though.

10. Children

Convira is not directed to children. The service is intended for users aged 16 or older (or older where local law requires). We do not knowingly collect personal data from children; if you believe a child has provided us with personal data, contact us and we will delete it.

11. How we protect data

We apply appropriate technical and organizational measures to protect personal data, including encryption of data in transit and at rest, hashed storage of the secrets that sign you in, encryption of sensitive stored credentials, and access controls that limit production data to the people who need it. As described above, the cloud runtime is also designed so that the contents of your runs are not stored on our systems. The one exception is a chat you choose to share when you rate an answer, which we keep for up to 90 days, or until you remove the rating. No system can be perfectly secure, but we work to keep risks low and to respond promptly if something goes wrong.

Read the full security model →

12. Changes to this policy

We may update this policy as the product and the law evolve. When we do, we will change the “last updated” date at the top, and for significant changes we will give you a more prominent notice (for example, by email or an in-product notice). Continuing to use Convira after a change takes effect means the updated policy applies to you.

13. How to contact us

Convira OÜ
Järvevana tee 9, Kesklinn, 11314 Tallinn, Harju County, Estonia
Registry code 17268095
support@convira.ai