Privacy Policy
Last updated: May 11, 2026
The short version
We try to keep this simple: we collect what we need to run Bivy and give you a good experience, and nothing more. We don't sell your data. We don't use your prompts to train AI models for outside companies. The AI providers we work with don't train on your data either, because we've opted out on your behalf. You can review your data and delete your account at any time.
The rest of this page is the detailed version. If you have a specific question, the table of contents below will get you there.
1. Who we are
Bivy is operated by Bivy AI LLC, a Delaware limited liability company. We can be reached at:
Bivy AI LLC
c/o Northwest Registered Agent Service, Inc.
8 The Green, Suite B
Dover, DE 19901
Email: support@trybivy.ai
For purposes of GDPR and UK GDPR, Bivy AI LLC is the data controller for the personal data described in this policy.
2. What we collect
Account info, what you ask Bivy and what it gives back, files you upload and files we generate, and basic technical info about your device. That's it.
Information you give us directly
- Account information: your email address when you sign up. We use Supabase to handle authentication; passwords are stored as salted hashes by Supabase, not by us.
- Prompts and content you submit: the text of every prompt you send to Bivy, along with any history needed to maintain the conversation context.
- Files you upload: images, PDFs, Word documents, spreadsheets, presentations, and other supported files you attach to a prompt. These are stored in Supabase Storage.
- Payment information: if you subscribe to a paid plan, we use Stripe to process payments. Stripe — not Bivy — receives and stores your card details. We receive a customer identifier and basic billing metadata from Stripe.
Information generated by your use of Bivy
- AI responses: the text, images, and files Bivy produces in response to your prompts.
- Conversation history: the sequence of prompts and responses that make up a conversation, so you can return to it later.
- Preferences: your selected tier and other in-app settings.
- Usage metadata: which AI category your prompt fell into, response latency, token counts, and similar information we use to operate the service and improve quality.
Information collected automatically
- Server logs: our hosting provider (Vercel) and our database provider (Supabase) automatically log standard request information including IP address, browser/user-agent, request timestamps, and approximate location derived from IP. This is standard for any web service and is used for security, abuse prevention, and debugging.
- Marketing attribution data: when you create an account, we record information about how you arrived at Bivy. See Section 3 for the full details.
- Cookies and similar storage: see Section 8.
- Analytics (only with your consent): if you accept analytics cookies, Google Analytics collects anonymized usage data. See Section 8.
3. Marketing attribution
When you sign up, we record how you found Bivy. This helps us understand which channels actually bring in users so we can improve how we share Bivy with the world. You can opt out at any time.
At the moment you create an account, we capture a small amount of information about how you arrived. We do this so we can understand what helps people discover Bivy and make informed decisions about how we invest in growth.
What we capture
Tied to your new account, we store:
- Referrer URL: if your browser tells us the URL of the page you visited immediately before reaching Bivy (for example, a social media post or blog article that linked to us), we record that URL.
- Landing page: which Bivy page you first visited (such as our homepage, pricing page, or FAQ page).
- Country: the country your visit appeared to come from, derived from your IP address by our hosting provider.
- Device type: a high-level category of your device — mobile phone, tablet, or desktop — parsed from your browser's user-agent string.
- Marketing campaign tags: if you arrived through a tagged link (for example, a Bivy social media post that includes
utm_source=twitter), we record those tags so we know which campaign brought you in.
What we do NOT capture
This is not general visitor tracking. Specifically:
- If you visit Bivy and never sign up, none of this information reaches our servers. It lives temporarily in your browser only (in a storage mechanism called sessionStorage, which clears automatically when you close the tab).
- We do not record your full IP address, your precise location, your browsing history, or anything else beyond the items listed above.
- We do not share this information with advertising networks or third-party data brokers.
How long we keep it
Marketing attribution data is kept for as long as your account exists, and is deleted when you delete your account, alongside the rest of your profile data (see Section 9).
Your opt-out right
If you don't want your marketing attribution data retained, email us at support@trybivy.ai and we'll clear those fields from your account. Opting out doesn't affect anything else about how Bivy works for you.
Under GDPR, our legal basis for this processing is legitimate interest — understanding which channels bring users to Bivy is fundamental to running a sustainable service, and the data we collect is minimal and specifically tied to the moment of signup rather than ongoing tracking.
4. How we use your data
We use your data to run the service, answer your prompts, prevent abuse, communicate important account information, and — only with your permission — understand how Bivy is used.
- To deliver the service: route your prompts to AI providers, return the answers to you, store your conversations so you can come back to them.
- To process payments: if you subscribe, manage your subscription via Stripe.
- To prevent abuse and ensure security: detect and respond to fraud, abuse, and security incidents.
- To communicate with you: respond to support requests, send essential account notifications (such as security alerts or billing notices). We do not send marketing emails without your consent.
- To improve Bivy: analyze usage patterns to make the service better. See Section 6 for details and your opt-out rights.
- To understand growth channels: use marketing attribution data (Section 3) to understand which channels bring users to Bivy.
- To meet legal obligations: comply with valid legal requests and applicable law.
Under GDPR, our legal bases for processing are: contract (delivering the service you signed up for), legitimate interest (security, abuse prevention, service improvement, marketing attribution), consent (analytics cookies, marketing emails), and legal obligation (responding to lawful requests).
5. AI providers
To deliver answers, Bivy sends your prompts to leading AI providers. We've opted out of having your data used to train their models.
Bivy's job is to give you the best AI for every task. To do that, we send your prompts to leading AI providers including Anthropic, OpenAI, Google, Perplexity, and Leonardo.AI. We continuously evaluate and update our provider list to make sure you always get the best result.
Important: we have configured our accounts with each of these providers to opt out of having your prompts and responses used for training their models. As of the “last updated” date above, none of these providers train their models on data you send through Bivy.
However, your data does pass through these providers' systems in order to be processed. Each provider has its own privacy practices governing how they handle data temporarily. We pick providers that meet industry-standard security expectations.
6. Using data to improve Bivy
We may use information about how Bivy is used — like which kinds of prompts go to which AI categories, and how often answers get refined — to improve our service. You can opt out at any time by emailing us.
We may use anonymized and aggregated information about how people use Bivy to improve the service. Examples include patterns about which prompt categories perform best with which models, how often users refine answers, and which features get used most.
This is separate from the third-party AI providers in Section 5. We do not share your individual prompts or responses with anyone for training purposes. The improvements happen using aggregated patterns from across our user base, not by exposing your specific content.
Your opt-out right: if you don't want your usage data used for improving Bivy, email us at support@trybivy.ai and we'll exclude your account from this kind of analysis going forward. Opting out doesn't affect your ability to use Bivy.
9. How long we keep data
We keep your data until you delete it or close your account. Some data is kept longer if law requires.
- Conversations, prompts, and uploaded/generated files: kept until you delete the conversation, the file, or close your account.
- Account data (including marketing attribution data): kept while your account is active.
- Server logs: typically retained for 30 to 90 days for operational and security reasons, then deleted on rolling schedules by our infrastructure providers.
- Billing records: retained as long as required by tax and accounting law (typically 7 years), in line with Stripe's and our legal obligations.
Account deletion: when you delete your account, we close access to it. We retain backup copies of associated data for a limited operational window after deletion to allow account recovery and to meet our legal obligations. You can request earlier deletion of specific items by emailing us.
10. Security
We use industry-standard practices to protect your data, but no online service can guarantee perfect security.
We protect your data with measures including encrypted connections (HTTPS), encrypted storage at our infrastructure providers, authenticated database access, and access controls limiting who can view raw data. We use Supabase row-level security to make sure users can only access their own data.
That said: no internet service is 100% secure. If we discover a security incident affecting your data, we will notify you and the relevant authorities as required by law.
11. Your rights
You can access, correct, delete, or export your data. EU/UK users also have additional rights under GDPR.
You have the right to:
- Access: request a copy of the personal data we hold about you.
- Correct: ask us to update or fix inaccurate information.
- Delete: ask us to delete your personal data, by deleting your account or by emailing us. Some data may be retained when required by law.
- Export: receive a portable copy of your data.
- Object or restrict processing: ask us to stop or limit how we use your data. This includes the right to object to processing based on legitimate interest, such as marketing attribution (Section 3).
- Withdraw consent: if we're processing on the basis of consent (such as analytics), withdraw it at any time.
- Lodge a complaint: with your local data protection authority. EU users can find theirs at edpb.europa.eu.
To exercise any of these rights, email us at support@trybivy.ai. We'll respond within 30 days.
12. California residents (CCPA)
California residents have additional rights. We don't sell your data, and you can exercise all CCPA rights by emailing us.
If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to:
- Know what personal information we collect, use, and share about you.
- Request deletion of your personal information.
- Correct inaccurate personal information.
- Opt out of the “sale” or “sharing” of your personal information. Bivy does not sell or share your personal information for cross-context behavioral advertising.
- Limit the use of sensitive personal information. We do not process sensitive personal information for purposes that would trigger this right.
- Be free from discrimination for exercising your privacy rights.
To exercise any of these rights, email us at support@trybivy.ai. We may need to verify your identity before responding.
13. Children
Bivy is for adults. You must be at least 18 years old to use it.
Bivy is not directed to children under 18 and we do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a child under 18, email us at support@trybivy.ai and we will delete it.
14. International users
Bivy is operated from the United States. If you use Bivy from outside the U.S., your data is processed in the U.S.
Bivy AI LLC is based in the United States, and our infrastructure providers (Vercel, Supabase, Stripe, AWS) primarily process data in the United States. If you access Bivy from outside the United States, your data will be transferred to and processed in the U.S. and other countries where our providers operate.
For users in the European Economic Area, the United Kingdom, or Switzerland, these transfers are made under Standard Contractual Clauses or other valid transfer mechanisms required by GDPR.
15. Changes to this policy
If we change this policy, we'll update the date at the top. Material changes will get a more visible notice.
We may update this policy from time to time. The “last updated” date at the top of this page reflects the most recent version. For material changes that affect how we use your data, we'll notify you by email or through the Bivy app before they take effect.
16. Contact us
Questions about this policy or your data? Email support@trybivy.ai or write to:
Bivy AI LLC
c/o Northwest Registered Agent Service, Inc.
8 The Green, Suite B
Dover, DE 19901