Privacy Policy

1. Scope

Tavi provides organization-scoped community intelligence and content workflow features. This policy applies to visitors and registered users of the Service. It does not govern third-party websites that we may link to.

2. Information we collect

Account and authentication. If you create an account or sign in, we process your email address and credentials. Passwords are handled by our authentication provider using industry-standard hashing — we do not store plaintext passwords in application code. If you use Google sign-in, Google shares profile details with us according to your Google settings.

Sessions. We use secure, HTTP-only cookies so you can stay signed in. These tokens identify your session to our servers.

Cookies and consent preferences. We use cookies that are strictly necessary to operate the Service (including authentication sessions). We store a consent record cookie so we can remember your choices about optional analytics or experimentation features offered through the cookie banner. You can update those choices when the banner is shown or by clearing site cookies for heytavi.ca.

Operational and security logs. Our hosting and database providers may process technical data such as IP addresses, timestamps, and request metadata for security and reliability. The application is designed to scope data by organization and to record certain actions in an append-only audit trail for accountability (for example, who approved or changed content), using internal identifiers rather than displaying personal data unnecessarily in logs.

Content you process in Tavi. Signals, drafts, and workflow metadata are stored to deliver the Service. That content is intended to describe community and market topics for your organization — not to collect sensitive personal data about private individuals. You should not input regulated sensitive categories of personal data into the Service unless your organization has a lawful basis and appropriate controls.

3. How we use information

• Provide, operate, and improve the Service
• Authenticate users and enforce organization boundaries
• Maintain security, prevent abuse, and protect integrity of accounts and content
• Comply with law and respond to lawful requests, where applicable

4. AI and automated processing

Parts of the workflow may send organizational content prompts (such as drafts derived from public or configured signals) to external inference providers — including large language models and embedding models — to generate text, score relevance, or support semantic search. We design these flows to avoid sending unnecessary personal data. Do not paste personal information into prompts, brand voice fields, or signal text unless your organization accepts that risk.

For a detailed description of which features call external models, what categories of data may appear in prompts, retention practices, and human oversight, see our AI Use Disclosure.

5. Where and how data is stored

The Service runs as a modern web application deployed to a managed edge platform (for example, Vercel for application hosting). Your account data and application records are stored in a managed PostgreSQL database with authentication services provided by Supabase. Data is encrypted in transit using TLS. Encryption at rest is provided by our subprocessors according to their standards.

Abuse prevention. To limit automated abuse of our APIs, we may process a short-lived rate-limiting key derived from your network address or request characteristics. When configured, those counters are stored in a managed Redis service (Upstash) for a limited sliding window; they are used only for security and reliability, not for marketing or profiling.

We do not sell your personal information. We use subprocessors strictly to operate the Service (for example, hosting, database, authentication, optional AI inference, and rate limiting). We do not use your data for third-party advertising.

6. Data sovereignty

Under our vendor agreements, personal information and organizational content that we store for the Service are kept in Canada — including application hosting, database, authentication, and supporting operational services (such as rate limiting and security logging infrastructure) configured for Canadian data residency.

We select and contract with subprocessors to maintain this posture. If you need residency details for procurement or assurance, contact us at privacy@heytavi.ca or through the Contact page.

Certain features send organizational prompts to external AI inference providers as described in Section 4; that involves transmission and ephemeral processing on those providers' systems, not replacement of our Canadian storage of your Service records.

7. Retention

We retain your account information for as long as your account is active or as needed to provide the Service. Security and administrative audit records (such as approvals, settings changes, and access events) are retained for up to 365 days. Routine operational records are retained for up to 90 days. Expired records are automatically purged. You may request deletion of your account and associated data at any time (see Section 10).

8. Accountability

In accordance with PIPEDA Principle 4.1, the person responsible for privacy compliance at Tavi can be reached at privacy@heytavi.ca. We are committed to protecting your personal information and will respond to inquiries within 30 days.

9. Breach notification

In the event of a data breach involving your personal information that creates a real risk of significant harm, we will notify affected individuals and report to the relevant privacy commissioner as required by Canadian law (PIPEDA and Alberta PIPA). We maintain internal procedures to detect, assess, and respond to breaches promptly.

10. Your choices and rights

Under Canadian privacy law (PIPEDA and Alberta PIPA), you have the right to access, correct, and request deletion of your personal information. You may also request a copy of your data in a portable format. To exercise these rights, contact us at privacy@heytavi.ca or through the Contact page. We may need to verify your identity before processing your request.

If you believe your privacy rights have been violated, you may file a complaint with the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.

11. Children

The Service is not directed at children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children.

12. International access and processing

The systems where we store your Service data are located in Canada, as described in Section 6. If you access the Service from outside Canada, your device still connects to those Canadian-hosted systems; local laws where you are located may also apply to you.

Separately, when you use features that call external AI inference providers (Section 4), prompts may be transmitted and processed outside Canada under those providers' terms; we use contractual and technical measures appropriate to the risk for those flows.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and revise the “Last updated” date. Continued use of the Service after changes means you accept the updated policy, to the extent permitted by law.

14. Contact

For privacy questions, use the Contact page. For a deeper technical breakdown maintained for our team (not a substitute for this notice), we maintain an internal privacy guide separate from public marketing materials.