Privacy Policy

We collect information you provide directly to us: • Account Information: Email address and password when you create an account. • Payment Information: Processed securely by Stripe. We do not store your full credit card number. • Conversations: The messages you send and receive through Aipa. • Your Nexus: the information Aipa keeps about you and your life, built from what you tell it and from what an AI you connect sends it. It includes people, places, events and preferences, and how they relate to each other. • Files you upload, and what Aipa reads from them. • Visits and sign-ins: your IP address and browser type for each page visit and each sign-in, and the approximate location and network that IP address belongs to. • Connected services: if you connect Spotify or Plex, your listening and watching history from that service. • Voice: if you correct how Aipa heard a word, the corrected word and a short audio clip of it. • Notifications: a token that lets us send notifications to your device. • Feedback you send us. • Device commands: if Aipa controls a device for you, the commands it sent and their results. • Connected AIs: if you connect your own AI assistant, the access tokens that let it reach your account. They are stored in hashed form. • API Keys (older accounts only): A small number of older accounts use their own API keys, an arrangement no longer offered. Those keys are stored encrypted and used only for that account.

We use your information to: • Provide, maintain, and improve Aipa's services • Build and maintain your Nexus • Process payments and send transaction confirmations • Send service-related communications (account updates, security alerts) • Respond to support requests We do not use your conversations or your Nexus to train AI models. Your data is yours.

All plans: Your conversations pass through our servers, where we build and maintain your Nexus. We store your conversation history and a search index made from it, so that Aipa can find what you said before. Aipa's own assistant (Free, Connect and Pro): We run the AI models. Their cost is part of your plan. Your own AI (Connect and Pro): When you connect an AI assistant you already use, it reads from and adds to your Nexus at your request. What it reads is sent to that assistant, and its provider handles it under your agreement with them. We receive only what your AI asks Aipa to save, change or look up, and Aipa's answers. We do not receive your conversation with it. What your AI sends to Aipa is processed by our systems and by the AI models we use, so that it can be indexed and found, and it is stored in your Nexus. We may also use our own AI to work out the answer to what your AI asks. Older accounts with their own API keys: AI requests are made with your keys, and you pay your provider directly. Your conversations still pass through our servers.

These companies receive some of your data so that Aipa can work. We may change them, and we update this list when we do. • Amazon Web Services: runs the AI models we use. They read your conversations, and what an AI you connect sends, to build and search your Nexus. AWS also stores your uploaded files and sends our email. • Stripe: your email address and your payments. See Stripe's Privacy Policy. • Cloudflare: a check on the sign-up and sign-in pages that you are not a bot. It sees your IP address. • ip-api.com: the IP address of a visit or a sign-in, to work out an approximate location and to spot abuse. • Search engines: when Aipa searches the web for you, the words of the search are sent to outside search engines, such as Bing, Google, Yahoo and DuckDuckGo. The set changes. • OpenStreetMap: place names and addresses you mention, to find them on a map. • Open-Meteo: a location, when you ask about the weather. • CARTO: map images, loaded by your browser when you look at a map. • Apple: the title and text of a notification, if you use the iOS app. Searches, place lookups and weather lookups are sent from our servers. Your name, your account and your IP address are not sent with them. Voice (speech to text, and text to speech) runs on services we operate ourselves. User-Connected Integrations (e.g., Spotify, Home Assistant): When you connect a third-party service, Aipa may send and receive data from that service on your behalf. These connections are controlled by you and can be revoked at any time. If you connect your own AI assistant, or your account uses your own API keys, what is sent to that provider is subject to that provider's privacy policy.

We implement industry-standard security measures to protect your data: • All data is encrypted in transit (TLS/HTTPS) • Your conversations, your Nexus and your uploaded files are stored encrypted at rest • API keys, and the tokens for services you connect, are encrypted a second time by the application • We regularly review and update our security practices No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

You have the right to: • Access: You can see what is in your Nexus at any time in the Atlas, in the app. You can correct or delete an entry there or by asking Aipa to, delete a conversation and what was learned from it, delete files you uploaded, or reset your Nexus entirely in Settings. Your account information is in Settings. • Delete: Delete your account yourself in Settings, or write to support@aipa.io. • Update: Modify your account information through your account settings. What happens to your data when an account is deleted, suspended or closed is set out under Data Retention.

When you delete your account, after you confirm the warnings shown, your conversations, your Nexus, your uploaded files and your account record are deleted from our live systems right away. So are the record of commands Aipa sent to your devices and the access tokens of any AI you connected. Deleting your account also cancels any subscription. Copies remain for a short time and are then removed. Database backups are kept for 7 days. The last stored copy of a deleted file is removed within 90 days. Two things are kept. Records of sign-ins (IP address and browser type) are kept for up to 12 months after the account is deleted, for security and fraud prevention, and longer only where a law requires it. Stripe keeps its own records of your payments. If we suspend or close your account, we keep its data for 180 days and may delete it after that. During those 180 days you can ask us to delete it or to send you a copy. Write to support@aipa.io. While your account is open, we keep your data so that Aipa can use it. Some records expire by themselves: page-visit records and usage records after 90 days, notifications after 30 days, and the approximate location we worked out for an IP address after 180 days.

We set two cookies: one keeps you signed in, and one protects forms from forgery. We count page visits ourselves, with your IP address and browser type. We use no outside analytics or advertising scripts. The sign-up and sign-in pages load a bot check from Cloudflare.

Aipa is not offered in mainland China, Cuba, Iran, North Korea or Syria.

Aipa is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the service. Your continued use of Aipa after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact us at support@aipa.io.