Privacy policy

Welcome to Aparavi! Your privacy is important to us. This Privacy Policy outlines how we collect, use, disclose, and protect your personal information when you visit our website https://aparavi.com/ and use our services.

• Personal Identification Information: Name, email address, phone number, and company details when you register or contact us.
• Usage Data: Information on how you access and use our website, including IP addresses, browser type, pages visited, and time spent.
• Cookies and Tracking Technologies: We use cookies to enhance user experience, analyze website traffic, and personalize content.

To enable the core functionalities of the Data Toolchain for AI and provide you with seamless integration with your existing data ecosystems, we may request access to certain user data from third-party services, including Google. We only request the minimum necessary access to deliver the described features.

Here's a detailed explanation of the specific data we may access from these services and the precise purpose for such access:

Google Drive Access (Read-Only to Files and Folders)

• Purpose: The Data Toolchain for AI requests read-only access to your Google Drive files and folders. This allows you to seamlessly select and import your existing documents, images, audio, video, and other data types directly from your Google Drive into our platform.
• User Benefit: This enables you to leverage our powerful data processing capabilities on your cloud-stored content, transforming it into AI-ready assets for your customized workflows (e.g., for advanced RAG pipelines, sensitive data detection, or format normalization).
• Our Use: We only access data that you explicitly choose to import within the application. We do not modify, delete, or store your original Google Drive files on our servers after they have been processed and utilized for your defined workflows within the Data Toolchain for AI. Your original files remain in your Google Drive. We do not use this data for serving ads.

Google Calendar Access (Read-Only to Events and Schedules)

• Purpose: We may request read-only access to your Google Calendar events and schedules. This functionality is utilized for automating your data processing workflows.
• User Benefit: It allows you to configure specific triggers for your data pipelines based on your calendar events or to schedule regular data updates, ensuring your AI knowledge bases remain current with automatic updates and continuous data freshness without manual intervention.
• Our Use: We only read event information (e.g., event title, date, time) that is relevant to your configured automation rules. We do not modify, create, or delete any events on your Google Calendar. We do not use this data for serving ads.

Google Contacts Access (Read-Only to Your Contacts List)

• Purpose: In certain collaborative features (e.g., inviting team members to projects or sharing processed data outputs), the Data Toolchain for AI may request read-only access to your Google Contacts list.
• User Benefit: This provides a convenient way for you to quickly select contacts from your existing address book for collaboration or sharing, streamlining your workflow and eliminating the need for manual entry of contact details.
• Our Use: Your contact information is used solely for the immediate purpose of facilitating your selection within these features. We do not store your contacts beyond the temporary use for selection during an active session, nor do we share them with any third parties. We do not use this data for serving ads.

When registering for two factor authentication or mobile security features, a phone number (which may be a mobile number) is collected and used solely to send authentication codes and security notifications. Before any SMS is sent, explicit user opt-in is required. Users consent to receive these security messages by actively submitting their phone number during the registration process and agreeing to receive authentication texts. This mobile number is isolated from other contact information and is not used for marketing, promotional outreach, or communications unrelated to account security.

No mobile information provided for this purpose will be shared with third parties or affiliates. Message and data rates may apply. Users may opt out at any time by replying STOP to any message. For questions regarding mobile number privacy, contact us at [email protected].

• To Provide and Maintain Services: Ensuring our services function as intended, which includes processing and transforming data ingested from Google Drive, automating workflows based on Google Calendar events, and facilitating user collaboration via Google Contacts.
• To Improve Our Services: Analyzing usage patterns (often in an aggregated or anonymized form) to enhance performance and user experience, including how users interact with integrated third-party data sources to refine our data processing and workflow automation features.
• To Communicate: Sending updates, newsletters, and responding to inquiries.
• For Marketing: Providing information about promotions, events, or other news that may interest you.
• To Comply with Legal Obligations: Ensuring adherence to applicable laws and regulations, including data protection laws related to information sourced from third parties.

We do not sell your personal information. Specifically, we do not sell any Google user data, nor do we use Google user data for serving advertisements.

We may share your data with:

• Service Providers: Third-party vendors assisting in service delivery, under strict confidentiality agreements. This includes services for cloud hosting, data storage, analytics, payment processing, and customer support. These providers are only authorized to use your data as necessary to provide their services to us and are contractually bound to protect its confidentiality and security. Our advertising partners Google Ads and LinkedIn (see 7.6 and 7.7) also use the data for their own purposes as independent controllers.
• Legal Authorities: When required by law, subpoena, or valid legal process, or to protect our rights, safety, or the safety of others.
• Business Transfers: In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.

We will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

7.1 Hosting and CDN

Our website is hosted by Strato AG (Otto-Ostrowski-Strasse 7, 10249 Berlin, Germany) in Germany and served through Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) for content delivery, DDoS protection, and performance optimization. Both providers process technical request data (IP address, browser User-Agent, requested URL) as data processors on our behalf under written Data Processing Agreements. Standard web-server access logs are retained for a maximum of 14 days for security and abuse-prevention purposes (Art. 6(1)(f) GDPR — legitimate interest in operational security).

Cloudflare may process traffic data in the USA. We rely on the EU-US Data Privacy Framework and Standard Contractual Clauses (Art. 46 GDPR). Cloudflare's privacy notice: cloudflare.com/privacypolicy/.

7.2 Google Analytics 4

We use Google Analytics 4, provided by Google Ireland Limited (Ireland). Google Analytics uses cookies to collect information about your interactions with our website, including pages visited, time spent, and general navigation behavior. Google Analytics 4 does not log or store IP addresses. Where data is transferred to the USA, Google LLC relies on the EU-US Data Privacy Framework; additionally, Standard Contractual Clauses (Art. 46 GDPR) are in place. Google Analytics sets the cookies _ga (distinguishes users) and _ga_<ID> (keeps the session state); they expire after up to two years.

For visitors in the European Economic Area, the United Kingdom, Switzerland, China and Canada, Google Analytics is only activated after you have given your explicit consent to analytics cookies via our cookie banner. Without your consent, no Google Analytics cookies are set.

For visitors in all other countries, Google Analytics is activated when the page loads. The cookie banner remains visible, and you can decline at any time; declining stops the analysis and removes the analytics cookies already set. It is not activated if your browser sends a Global Privacy Control signal. To decide which of these applies, we determine your country from the network location that Cloudflare already processes (see 7.1). If your country cannot be determined, you are treated like a visitor from the European Economic Area.

Legal basis for all analytics: for visitors in the European Economic Area, the United Kingdom and Switzerland, your consent (Art. 6(1)(a) GDPR); for visitors in China and Canada, your consent. For visitors in all other countries, analytics is used on an opt-out basis as described above; you can object at any time via the cookie banner or by sending a Global Privacy Control signal.

7.3 Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited (Ireland). Google Tag Manager is a container service that allows us to manage other tracking and marketing tags (such as Google Analytics) without modifying our website code directly. Tag Manager itself may set technical cookies and process IP addresses when triggered. Where data is transferred to the USA, Google LLC relies on the EU-US Data Privacy Framework; additionally, Standard Contractual Clauses (Art. 46 GDPR) are in place.

For visitors in the European Economic Area, the United Kingdom, Switzerland, China and Canada, and when your country cannot be determined, Google Tag Manager is only loaded after you consent to analytics or marketing cookies.

For visitors in all other countries, Google Tag Manager and the Google tag are loaded for every visitor, unless your browser sends a Global Privacy Control signal. Until you consent, they run in a restricted mode: they set and read no cookies, but they send cookieless signals to Google (such as your consent status and the page you visit) so that visits and ad conversions can be measured in aggregate. Once you consent, Google Analytics and Google Ads work as described in 7.2 and 7.6.

Legal basis: for visitors in the European Economic Area, the United Kingdom and Switzerland, your consent (Art. 6(1)(a) GDPR). Otherwise as described in 7.2.

7.4 HubSpot (Forms, Meetings, Visit Tracking and Advertising)

With your consent, we use HubSpot, Inc. (2 Canal Park, Cambridge, MA 02141, USA) for our contact form (/company/contact/) and our discovery-call booking widget (/get-started/demo/). When you submit a form or schedule a call, the data you provide (name, email, company, message) is transmitted to HubSpot, who acts as our CRM provider and data processor.

We also use the HubSpot tracking code to record which pages you visit and to recognize returning visitors. It follows the same rules as Google Analytics (see 7.2): in the European Economic Area, the United Kingdom, Switzerland, China and Canada it only runs after you consent to analytics cookies; in all other countries it runs when the page loads, unless you decline or your browser sends a Global Privacy Control signal. HubSpot may derive an identifier from characteristics of your browser (browser fingerprint). If you submit a form, HubSpot links your earlier page views to your contact record. HubSpot's advertising features (ad pixels) only run after you consent to marketing cookies.

HubSpot processes data in the USA. We rely on the EU-US Data Privacy Framework and Standard Contractual Clauses (Art. 46 GDPR). A Data Processing Agreement is in place.

Cookies set by HubSpot:

• hubspotutk: visitor identifier (six months). Recognizes returning visitors and allows form pre-fill on subsequent visits. You can delete this cookie at any time via your browser settings.
• __hstc: main visitor tracking cookie (visitor ID, visit timestamps, visit count). Six months.
• __hssc — session counter. 30 minutes.
• __hssrc — session restart indicator. Browser session only.
• __hs_cookie_cat_pref: records your cookie choice for HubSpot (analytics, advertising). Deleted when you close your browser.

Hidden form fields transmitted with each submission: when you submit a form, your browser additionally sends the marketing-attribution parameters present in your landing URL (utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_id, gclid, fbclid) to HubSpot so we can identify which marketing channel referred you. These fields are not shown in the visible form but are part of the submission payload. So that a form opened on a later page can still send them, these parameters are kept in your browser's session storage until you close the browser tab, once analytics is active for you as described in 7.2.

HubSpot forms and meeting widgets are blocked by default and only load after you grant marketing consent via our cookie banner. If you prefer not to use HubSpot, you can contact us directly by email at [email protected].

Legal basis: for forms, meetings and advertising, your consent (Art. 6(1)(a) GDPR); for visit tracking, as described in 7.2. HubSpot's privacy notice: legal.hubspot.com/privacy-policy.

7.5 Google Maps

With your consent, we embed maps from Google Maps, provided by Google Ireland Limited (Ireland), on our About page to show where our offices are located. When a map loads, your browser connects to Google's servers, which receive your IP address. Where data is transferred to the USA, Google LLC relies on the EU-US Data Privacy Framework; additionally, Standard Contractual Clauses (Art. 46 GDPR) are in place.

The maps are only loaded after you have given your consent to marketing cookies via our cookie banner. Without your consent, no connection to Google Maps is made.

Legal basis: your consent (Art. 6(1)(a) GDPR).

7.6 Google Ads

With your consent to marketing cookies, we use Google Ads conversion tracking and remarketing, provided by Google (see 7.2). Google receives information about your visit (for example the pages you view and whether you book a demo) to measure our ads and may use it to show our ads on other websites. Google acts as an independent controller. Google sets the cookie _gcl_au on our domain (90 days) and its own advertising cookies such as IDE, which Google can read on other websites (13 months in the EEA, Switzerland and the UK, 24 months elsewhere). Legal basis: your consent (Art. 6(1)(a) GDPR).

7.7 LinkedIn Insight Tag

With your consent to marketing cookies, we use the LinkedIn Insight Tag. It sends information about your visit (page URL, IP address, browser data, time) to LinkedIn so we can measure our LinkedIn ads. LinkedIn also uses this data for its own purposes as an independent controller. Provider: LinkedIn Ireland Unlimited Company for visitors in the EU, the EEA and Switzerland, LinkedIn Corporation elsewhere, as stated in LinkedIn's privacy policy. LinkedIn and the providers it works with set cookies on our domain and on their own domains, listed in LinkedIn's cookie table under "Cookies LinkedIn drops on third party sites" (linkedin.com/legal/l/cookie-table). They last from the end of the browser session up to two years; a cookie that records an opt-out lasts ten years. LinkedIn privacy policy: linkedin.com/legal/privacy-policy. Legal basis: your consent (Art. 6(1)(a) GDPR).

7.8 Tracking Across Websites

When you use our website, third parties (Google and LinkedIn) may collect information about your online activities over time and across different websites.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Specific retention periods:

• Server-log data (Cloudflare/Strato): Maximum 14 days, then automatically deleted.
• Google Analytics 4 data (see 7.2): Retained per GA4 default (14 months) or until consent is withdrawn.
• CRM data: Duration of the business relationship and thereafter as required by law; deleted upon verified request subject to legal retention obligations.
• HubSpot visit data: Kept with your contact record for the duration of the business relationship; deleted upon verified request.
• Cookie consent preferences: Stored as a cookie in your browser for 365 days, or until you withdraw consent.

Depending on your jurisdiction, you may have the right to:

• Access: Request copies of your personal data.
• Rectify: Correct inaccurate or incomplete data.
• Erase: Request deletion of your data under certain conditions.
• Restrict: Ask us to restrict the processing of your data.
• Object: Oppose processing of your data.
• Data Portability: Receive your data in a structured, commonly used format. You can also manage and revoke permissions for Google and other third-party applications directly through your respective account settings (e.g., your Google Account Security Settings page).
• Withdraw consent: Withdraw your consent at any time via "Cookie Settings" at the bottom of every page; this does not affect processing before the withdrawal.

To exercise these rights, please contact us at [email protected].

If you believe our processing of your personal data violates data protection law, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

We implement appropriate technical and organizational measures to protect your data, including data sourced from third parties, against unauthorized access, alteration, disclosure, or destruction. These measures include data encryption (at rest and in transit), robust access controls, and regular security audits. We regularly review and update our security practices to adapt to new threats and technologies.

Your information, including data sourced from third parties, may be transferred to and maintained on servers located outside your state, province, country, or other governmental jurisdiction, where data protection laws may differ. We ensure appropriate safeguards are in place to protect your data, such as standard contractual clauses (SCCs) approved by the European Commission, where applicable, or by relying on other legally recognized transfer mechanisms.

Our website may contain links to external sites. We are not responsible for the privacy practices or content of these third-party sites.

Our services are not directed to individuals under 16. We do not knowingly collect personal information from children under 16.

We may update our Privacy Policy periodically. We will notify you of any changes by posting the new Privacy Policy on this page with an updated effective date.

15.1 Data Controller and EU Representative

The data controller for this website is:

Aparavi Software Corp.
1351 3rd Street Promenade #300
Santa Monica, CA 90401, USA
Email: [email protected]

Our representative in the European Union under Art. 27 GDPR is:

APARAVI Software Europe GmbH
Seidlstr. 8
80335 Munich, Germany
Email: [email protected]

15.2 Data Protection Officer

We have not appointed a Data Protection Officer (DPO) as we do not meet the mandatory designation criteria of Art. 37(1) GDPR (we are not a public authority, our core activities do not consist of large-scale systematic monitoring, and we do not process special categories of data on a large scale). For data-protection questions, please contact [email protected].

15.3 Supervisory Authority

If you believe our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live, where you work or where the alleged infringement took place (Art. 77 GDPR).