Privacy Policy

This Privacy Policy explains how we handle personal information in connection with HYDN, available at hydn.ai (the Service). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are

The Service is provided by SOVIRA GROUP PTY LTD (ABN 44 701 510 545) of 16 Davenant Street, Banyo QLD 4014, Australia (Sovira, we, us, or our). You can contact us about privacy at admin@sovira.io.

2. What we collect

• Account details — such as your name, email address, and login information.
• Business context — information you provide during onboarding and setup about your business.
• Connected content — where you connect Google Gmail or Google Calendar, the email and calendar data needed to power the assistant, and the content you store in your HYDN vault.
• Payment metadata — billing information via Stripe, such as subscription status and the last digits/expiry of your card. We do not receive or store your full card number.
• Usage and log data — technical information generated when you use the Service, used for operation, security, and support.

3. Why we use it

• to provide and operate the Service and its assistant features;
• to process billing and manage your subscription;
• to provide support and communicate with you about the Service; and
• to maintain the security and integrity of the Service.

4. Google API Limited Use

HYDN's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google user data is:

• used only to provide or improve user-facing features that are prominent in the Service (reading your mail and calendar to power your own assistant);
• not used for advertising;
• not sold; and
• not used to train, develop, or improve generalised or non-personalised AI/ML models.

5. AI processing and how it works

Assistant features are powered by third-party large language model providers, routed via OpenRouter. To answer a request, content relevant to that request may be transmitted to those providers, which may be located in the United States. AI output can be inaccurate and is not professional advice; you are responsible for reviewing it and for approving any action, including every email send, before it takes effect.

6. Who we share it with (service providers)

We use the following service providers (subprocessors) to deliver the Service. Some of them process data overseas; where that is the case we note it, consistent with APP 8. We do not sell your personal information.

• DigitalOcean — hosting of your dedicated instance (Australia, Sydney region).
• Supabase — account database (hosted in Australia, Sydney).
• Stripe — payment processing (may process internationally).
• Composio — integration and OAuth token management for connected Google accounts (United States).
• OpenRouter and underlying model providers — AI processing (United States).
• Vercel — web hosting and content delivery (United States).
• Inngest — workflow orchestration (United States).
• Resend — transactional email (for example, account and billing notifications) (United States).
• Cloudflare — DNS and network services (global network).

7. Storage and security

Each customer runs on a dedicated, single-tenant instance, so your data is not commingled with other customers' data on shared application servers. We use encryption in transit and access controls to protect personal information. No method of transmission or storage is completely secure, and we do not claim to hold any security certification (such as SOC 2 or ISO 27001).

8. Data retention and offboarding

When your subscription ends or you offboard:

• your dedicated server instance is destroyed;
• access to your connected Google accounts is revoked at the provider;
• an export (an archive of your vault) is made available to you for 4 days, after which it is deleted; and
• operational update snapshots are retained for at most 30 days.

We do not maintain continuous backups of your instance — you are responsible for keeping your own copies of critical data, and the export is the data portability mechanism we provide. We keep account and billing records for as long as required to meet our legal and tax obligations.

9. Your rights — access, correction, and deletion

You may ask us to access or correct the personal information we hold about you, or to delete it, by emailing admin@sovira.io. We will respond within a reasonable time and in accordance with the Privacy Act. Some information may need to be retained where the law requires it.

10. Complaints

If you have a privacy concern, please contact us first at admin@sovira.io so we can try to resolve it. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

11. Cookies

We use only the cookies needed to run the Service — principally authentication and session cookies that keep you signed in. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics trackers.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make a material change, we will take reasonable steps to notify you. The "Last updated" date above shows when it was last revised.

13. Contact

For any privacy question, email admin@sovira.io.