Privacy Policy

AMVY is responsible for the personal data we collect to run our business: your account, sign-in, beta access requests, billing, support, and the security of the Service.

Inside an organization, the content its members create (messages, files, knowledge bases, memories, and integration data) is processed on behalf of that organization, which decides how it is used. If you are a member of an organization, contact its administrators about that content; we will help them respond to your request. Business customers can request a data processing agreement at support@amvy.ai.

• Account data: name, email address, profile photo, job title and work area you choose to add, your sign-in method, and, if you use email and password, a password hash. If you sign in with Google, Microsoft, or another identity provider, we receive your name, email, and profile picture from it.
• Organization data: organizations you belong to, your role, invitations, and settings.
• Customer content: messages and prompts, files, knowledge bases, memories, skills, instructions, artifacts, feedback, and the results agents produce, plus data agents read from integrations you connect.
• Integration credentials: tokens that let AMVY act in tools you connect. They are encrypted at rest.
• Usage and technical data: actions you take, usage counts and costs, security and audit logs (including your IP address in the organization's audit log), and device and browser information. Sign-in security records keep IP address and browser information only in hashed form.
• Billing data: billing name, email, country, postal code, subscription status, and the brand, last four digits, and expiry of your card. Full card numbers are handled only by our payment partners.
• Communications: beta access requests, support messages, and emails you send us.

Website visits: when you visit https://amvy.ai, our hosting provider records technical data such as your IP address, browser, and the pages requested, to deliver and secure the site. The website uses no analytics or advertising cookies.

• To provide the Service you asked for: create your account, run agents on your requests, sync integrations, and deliver results (performance of our contract with you or your organization).
• To bill subscriptions, manage plans and limits, and keep accounting and tax records (contract and legal obligations).
• To secure the Service: authentication, fraud and abuse prevention, rate limiting, audit logs, and incident investigation (legitimate interests and legal obligations).
• To support you and send service emails such as invitations, verification, billing notices, and changes to these policies (contract and legitimate interests).
• To understand and improve the product with aggregated, pseudonymized usage analytics, only where your organization has it enabled; owners and members can turn it off (legitimate interests or consent, as applicable).
• To comply with the law and respond to lawful requests from authorities.

We do not sell personal data, use it for advertising, or use customer content to train AI models. The optional learning features (memories and skills proposed from completed work) are off by default, stay inside your organization, and require a person's approval.

To complete a request, AMVY sends the relevant prompt, context, and files to an AI model provider. The built-in models are provided by Z.ai, Google, OpenAI, and Anthropic. Your organization can also connect model providers with its own credentials (for example its own OpenAI or Anthropic account, Microsoft Azure, or AWS Bedrock); data sent through those connections is governed by your organization's agreement with each provider.

Knowledge base content is converted into embeddings to make it searchable. Web search queries an agent makes are sent to DuckDuckGo. AI outputs are generated automatically; important actions can require human approval, and you can always ask for a person to review a decision that affects you. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

If you connect Google services such as Gmail, Google Drive, Google Docs, Sheets, Slides, or Google Calendar, AMVY accesses the data those permissions allow (for example emails, files, and calendar events) only to provide the features you use: letting agents read, search, create, or change that data when you or your organization ask them to.

• AMVY's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
• We transfer Google user data to others only as needed to provide those features, such as sending it to the AI model that completes your request, for security, or to comply with the law.
• We do not use Google user data for advertising, do not sell it, and do not use it to develop, improve, or train generalized AI or machine learning models.
• People at AMVY do not read Google user data unless you give us permission for a specific request, it is needed for security or to investigate abuse, or the law requires it.

You can disconnect a Google integration at any time from AMVY's settings or revoke AMVY's access in your Google Account permissions. Data AMVY obtained from Google is deleted together with the conversations and files that hold it, or when you ask us at support@amvy.ai.

AMVY can also connect to other services, such as Microsoft 365 (Outlook, Teams, OneDrive, SharePoint, and Power BI), Slack, GitHub, GitLab, Atlassian, Notion, Linear, Asana, HubSpot, Salesforce, and Figma, among others listed in the product, as well as MCP servers your organization adds. For these integrations:

• A member or administrator connects each one with OAuth or an access token. AMVY receives only the permissions granted, stores the credentials encrypted, and your organization decides which members and agents can use them.
• AMVY reads and changes data in the connected service only to complete the tasks you or your organization ask for. Data it reads is handled like the rest of your content: it can be sent to the AI model working on the request and kept in the conversation, and it is deleted with it.
• Actions that change data in a connected service follow your organization's approval policies and remain visible in the conversation where they happened.
• We do not use data from integrations for advertising, do not sell it, and do not use it to train AI models.
• Each connected service is responsible for the data it holds under its own terms and privacy policy. What an agent creates or changes there stays in that service; deleting it from AMVY does not delete it from the service.

You can disconnect an integration at any time from AMVY's settings, and deleting the connected account removes the credentials AMVY stored. You can also revoke AMVY's access from the connected service's own settings.

We share personal data only with service providers that process it for us under contract, with the integrations and model providers you or your organization choose, and when required by law. Our current providers:

If we form a company to operate AMVY, or AMVY is involved in a merger or acquisition, personal data may be transferred as part of that transaction under this policy.

Some providers process data outside Argentina, including in the United States and in other countries that may not offer the same level of protection. We rely on contractual safeguards with those providers, and on the other mechanisms the applicable law allows, to protect transferred data.

The web application uses cookies that are strictly necessary to sign you in and protect your session: a session cookie (up to 24 hours), an authentication cookie (up to 30 days), CSRF protection cookies, and short-lived cookies during sign-in. It also stores preferences such as theme and layout in your browser's local storage.

If your organization enables product analytics, PostHog sets its own cookies or local storage to measure usage. Session recording is off. The landing website sets no analytics cookies.

You can ask to access, rectify, update, or delete your personal data, object to its processing, withdraw consent, or receive a copy of your data. Account settings let you edit your profile, export data, and delete your account. For anything else, write to support@amvy.ai from your account email. We answer access requests within 10 calendar days and rectification, update, or deletion requests within 5 business days, as Law 25,326 requires.

If you are in the European Economic Area, the United Kingdom, or another region with similar laws, you also have the rights those laws grant, including complaining to your local supervisory authority.

The owner of personal data has the right to access it free of charge at intervals of no less than six months, unless a legitimate interest is shown (section 14, paragraph 3, Law 25,326). The AGENCY FOR ACCESS TO PUBLIC INFORMATION (Agencia de Acceso a la Información Pública), as the supervisory authority of Law 25,326, has the power to hear complaints and claims filed by anyone whose rights are affected by non-compliance with personal data protection rules.

We protect data with encryption in transit (TLS) and encryption of credentials and sensitive data at rest, separate database schemas per organization, role-based access control, re-authentication for sensitive actions, audit logs, rate limiting, and isolated environments for code execution. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

The Service is not intended for anyone under 18, and we do not knowingly collect their personal data. If you believe a minor gave us personal data, contact support@amvy.ai and we will delete it.

We may update this policy. We will post the new version here with its effective date and, for material changes, notify you by email or in the product before they take effect.

Questions or requests: support@amvy.ai.