Privacy Policy

1. Introduction

cvlSoft, LLC (“cvlSoft,” “we,” “our”) operates the AIOS platform and the cvlsoft.net, cvlsoft.com, and cvlsoft.ai websites (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, request a demo, or use our platform.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

2. Information We Collect

Personal Information: When you request a demo, contact us, or create an account, we may collect your name, email address, phone number, company name, job title, and mailing address.

Usage Data: We automatically collect information about how you interact with our website, including IP address, browser type and version, operating system, device identifiers, referring URLs, pages visited, time spent on pages, and clickstream data.

Platform Data: For AIOS platform customers, we process workflow definitions, execution logs, configuration data, and usage metrics as defined in your service agreement. Customer data processed by AIOS workflows is governed by your Data Processing Agreement (DPA).

Communications: When you contact us via email, phone, or our website forms, we retain the content of those communications along with your contact information to respond and maintain records.

Eva, our website assistant: The chat on our website is answered by Eva, an AI assistant that runs on the AIOS platform, not by a person. We record and store your conversations with Eva so that we can answer you, follow up on your request, and maintain and improve the Services. Please do not share passwords, payment details, or other sensitive information with Eva. When you use Eva:

• Chat: What you type, Eva’s replies, and the page you are on are sent to an AI model provider to write Eva’s replies. Depending on the model in use, that provider is OpenAI, Anthropic, or OpenRouter, which passes the request to the company that hosts the model.
• Voice: If you talk to Eva by voice in your browser, your voice and Eva’s spoken replies are processed by OpenAI. Your audio may go directly from your browser to OpenAI, in which case OpenAI also receives your IP address and browser type.
• Calls and texts: If you ask Eva to call or text you, the call or text is placed through Twilio, our telephone provider. During a call, your voice is also processed by OpenAI so that Eva can hear and answer you.
• Contact record: If you tell Eva who you are, for example your name, email address, or phone number, we keep a contact record so that Eva can remember you across conversations in the chat, by phone, or by text. The record holds the details you gave and notes the AI writes from your conversations, such as your role, your preferences, and open questions. If you share details about yourself without saying who you are, the conversation may be saved as a website visitor record.
• Safety checks: What you type or say and Eva’s replies may be checked by an automated safety service, TypeSafe, for harmful content and attempts to misuse Eva.
• Hosting and monitoring: Eva’s data is hosted on Amazon Web Services and stored in MongoDB Atlas. Technical logs, including your IP address and browser type, are sent to Grafana Labs so that we can monitor the service.
• How long we keep it: A website chat is deleted 7 days after your last visit. A chat handed to a person on our team is kept until they have handled it, then deleted 7 days later. A log of chat activity, such as when a chat started and which page you were on, is kept for 90 days. Phone calls and texts, including their transcripts and your phone number, are deleted 90 days after the conversation’s last activity. A contact record, with a short summary of each conversation, is kept until it is deleted, and you can ask us to delete yours at any time. If you reply STOP to a text, we keep your number and that request permanently so that we can keep honoring it.

Idea Engine: When you use the Idea Engine, the team, industry, and systems you choose and anything you write about how your work gets done are sent to OpenAI to write your ideas, with OpenAI’s storage of the request turned off. We do not save them on our side unless you submit the contact form. If you do, your answers, including what you wrote, and the ideas you kept are saved with your request and emailed to our sales team and to you. Your IP address is used briefly to limit how often the tool can be called and is not saved.

Health information: AIOS is not designed to receive health information protected by HIPAA (“PHI”). Do not send us PHI, through the Services or our websites, unless cvlSoft has signed a Business Associate Agreement with you.

3. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Contract Performance: Processing necessary to provide the Services you have requested or to take steps at your request before entering into an agreement.
• Legitimate Interest: Processing necessary for our legitimate business interests, such as improving the Services, preventing fraud, and ensuring platform security, where those interests are not overridden by your rights.
• Consent: Where you have given explicit consent for a specific processing activity, such as receiving marketing communications.
• Legal Obligation: Processing necessary to comply with applicable laws, regulations, or legal proceedings.

4. How We Use Your Information

• To provide, maintain, operate, and improve our platform and Services
• To process demo requests and communicate with you about our products and services
• To send you technical notices, security alerts, and support messages
• To respond to your inquiries and provide customer support
• To comply with legal obligations and enforce our Terms of Service
• To detect, investigate, and prevent fraudulent, unauthorized, or illegal activity
• To monitor and analyze trends, usage, and activities in connection with the Services
• To personalize and improve your experience with the Services

cvlSoft does not use Customer Data, or what you enter in Eva or the Idea Engine, to train or fine-tune AI models.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information in the following circumstances:

• Service Providers: We share information with trusted third-party service providers that assist us in operating and delivering the Services, including cloud infrastructure, analytics, email and SMS delivery, telecommunications, customer support, and payment processing providers. These providers may use personal information only to perform services on our behalf.
• Legal Requirements: We may disclose information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control.
• With Your Consent: We may share your information with third parties when you have given us explicit consent to do so.

6. Sub-Processors

We use a limited number of third-party sub-processors to help deliver the Services. These may include cloud hosting providers, AI model providers, telephone and text message providers, monitoring and analytics services, email delivery platforms, and payment processors. A current list of sub-processors is available upon request to platform customers.

For this website specifically, we use Vercel (hosting and cookieless page analytics), MongoDB (storage of contact and demo requests), OpenAI (writing Idea Engine ideas from what you enter), and an email delivery provider (sending confirmations and notifying our team). Eva runs on the AIOS platform and uses the providers named under “Eva, our website assistant” in section 2.

7. Data Security

We implement robust, industry-standard security measures to protect your information, including:

• Encryption in transit: AIOS encrypts data in transit with TLS 1.2 or later. Connections to addresses you set up in your own connectors use whatever encryption those addresses support.
• Encryption at rest: AIOS encrypts important data at rest, such as credentials, secrets, and other sensitive data, with AES-256-GCM.
• Per-tenant data isolation ensuring strict separation between customers
• Role-based access controls (RBAC) and principle of least privilege
• Compliance-grade audit logging of all platform actions
• Regular security assessments and vulnerability testing

Despite these measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information using commercially reasonable safeguards.

8. Data Breach Notification

In the event of a data breach that affects your personal information, cvlSoft will notify affected individuals and relevant regulatory authorities as required by applicable law. We will provide notification without unreasonable delay and no later than seventy-two (72) hours after becoming aware of a breach where feasible. Notification will include the nature of the breach, the types of data affected, steps taken to address the breach, and recommended actions for affected individuals.

9. Data Retention

We retain personal information for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Account data: Retained for the duration of your account and for a reasonable period thereafter for legal and audit purposes.
• history and conversations: Deleted after 90 days by default.
• System logs: Kept for up to 12 months.
• Platform data: Retained in accordance with your service agreement and DPA.
• Communication records: Retained for up to thirty-six (36) months for support and compliance purposes.

You can ask us to export or erase your own personal data at any time. When your agreement ends, you have at least 30 days to export your data. We then delete it when you ask, or as your agreement says. Billing and audit records are kept after deletion, with personal details removed. Backups are deleted within 12 months.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request a machine-readable copy of your data for transfer to another service.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interest or for direct marketing purposes.
• Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time.

To exercise any of these rights, contact us at support@cvlsoft.net. We will respond to verified requests within thirty (30) days. We will not discriminate against you for exercising your privacy rights.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected, the sources of collection, the business purposes, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising purposes.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of sensitive personal information to what is necessary to provide the Services.
• Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To submit a request, email support@cvlsoft.net with the subject line “California Privacy Request.” We may need to verify your identity before processing your request.

12. International Data Transfers

cvlSoft is headquartered in the United States. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from those of your jurisdiction.

Where required by applicable law, we implement appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms.

13. Automated Decision-Making

The AIOS platform may use automated processing, including artificial intelligence and machine learning, to execute workflows and make operational decisions on behalf of customers. These automated processes operate under customer-defined policies and approval gates.

We do not use automated decision-making that produces legal or similarly significant effects on individuals without human oversight. Platform customers maintain control over approval gates and can configure human-in-the-loop requirements for any workflow.

14. Children’s Privacy

The Services are not intended for individuals under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without appropriate consent, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a child, please contact us at support@cvlsoft.net.

15. Cookies and Browser Storage

Our website does not use advertising cookies, analytics cookies, or cross-site tracking of any kind. What it does keep in your browser is limited to the following:

• Sign-in cookie: If you sign in to a password-protected area of the website, one cookie keeps you signed in for up to 30 days. Visitors who do not sign in receive no cookies from us.
• Chat: The chat keeps a session reference, whether the chat is open, and your recent conversation in your browser’s local storage, so the conversation continues as you move between pages. If the chat asks you to accept its terms, it also remembers that you did.
• Idea Engine: Your answers, ideas, and shortlist are kept in your browser’s session storage so a reload does not lose them. They are removed when you close the tab.

We measure page views with a privacy-focused analytics service that does not set cookies and does not follow you across other websites. You can remove anything stored in your browser at any time by clearing this site’s data in your browser settings; the chat and the Idea Engine will then start fresh.

16. Do Not Track Signals

Some browsers transmit “Do Not Track” (DNT) signals. As there is no industry-standard interpretation of DNT signals, our website does not currently respond to DNT signals. However, we do not engage in cross-site tracking of our users.

17. SMS Marketing Communications

When you voluntarily provide your mobile phone number and expressly opt in, cvlSoft may send you recurring automated marketing text messages (SMS or MMS) about our products and services — such as promotions, product news and updates, special offers, and event invitations. This is a marketing program; your consent applies only to these marketing messages and to cvlSoft as the sender.

Consent to receive marketing text messages is not a condition of purchasing or using any cvlSoft product or service. Any transactional or service messages we may send (for example, a direct reply to a request you initiate) are handled separately and are not part of this marketing consent. Message frequency varies. Message and data rates may apply.

You may opt out of receiving text messages at any time by replying STOP to any message. After submitting an opt-out request, you may receive one final message confirming that you have been unsubscribed. For assistance, reply HELP or contact support@cvlsoft.net.

Mobile phone numbers, SMS consent records, and mobile opt-in information will not be sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes. We may share this information with service providers that help us deliver text messages, such as telecommunications carriers and messaging-platform providers, solely as necessary to provide the messaging service.

You may withdraw your SMS consent at any time without affecting other services or communications you receive from cvlSoft.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on this page, updating the “Last updated” date, and where required by law, providing direct notification via email. Your continued use of the Services after any changes constitutes acceptance of the updated policy.

19. Outside AI Agents Connected to AIOS

Platform customers can offer chosen workflows to outside AI agents, including AI assistants (ChatGPT, Claude, etc.). Nothing is offered until a tenant administrator exposes a workflow. A person connects an agent by signing in to AIOS and approving it on a consent screen (OAuth 2.1):

• What a connected agent can do: Through the AIOS Model Context Protocol (MCP) connector, or the agent-to-agent (A2A) connection for agents built on other platforms, an agent can run only the workflows a tenant administrator has exposed, and read the results of those runs. Where an administrator has allowed it for an exposed workflow, it can also read and approve or reject that workflow’s approval requests. Workflows that are not exposed stay invisible to it. It acts on behalf of the person who connected it and can never do more than that person’s own account can.
• API keys: A customer can also give an agent an AIOS API key. An API key is a general credential: it carries the permissions an administrator gave it and is not limited to exposed workflows.
• Data sent to the AI provider: When you use such a connection, the inputs and results exchanged with the outside agent are also processed by that agent’s provider (Anthropic, OpenAI, etc.) under their privacy policy, which you should review. cvlSoft does not control how that provider handles the data.
• Records & control: AIOS keeps a record of each call an outside agent makes, for audit and billing. The inputs the agent sent are removed from that record when the run itself is deleted, 90 days after it finishes by default; billing and audit records are kept. An administrator can stop offering a workflow at any time. A person can revoke a connection they made, and an administrator can revoke anyone’s. A revoked connection stops working within 15 minutes, when its current access expires.

20. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, contact us at:

cvlSoft, LLC
Email: support@cvlsoft.net
General: sales@cvlsoft.net
516 Huntington Dr, Ball Ground, GA 30107

If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.