Privacy Policy

We are established in India, and all primary servers used for storing and processing your data are hosted in India.

We process account data to provide you access to the Service and process uploaded materials and chat conversations according to your instructions to operate your Digital Twin.

2.1 Account data (Users)

• Full name
• Email address
• Professional details you provide (profession, coaching focus, website, LinkedIn, and anything entered in our sign-up form)

Used to create and secure your account, communicate with you, and evaluate how Aiyou fits your practice.

2.2 Knowledge Material (Users)

To build your Twin, you upload material such as documents, transcripts, recordings, frameworks, notes, and written content - your Knowledge Material.

Your Knowledge Material belongs to you. We claim no ownership. We process it solely to build and operate your Digital Twin. Knowledge Material may contain personal data about other people (e.g., coaching transcripts). Your responsibilities regarding this data are outlined in Section 8.

2.3 Twin conversations and Lead Capture (Users and End Users)

When End Users interact with a Twin, we require them to provide their email address to initiate or continue the chat. We store these email addresses along with the conversation history.

The email addresses captured from End Users are made available to the User (the coach/business who created the Twin) on their account dashboard as business leads. We also store conversation messages so the Twin can maintain context and so you can review its performance.

2.4 Technical and usage data

IP address, browser and device type, pages visited, referring URL, timestamps, and in-platform actions - used strictly for security, abuse prevention, system diagnostics, and understanding platform usage.

2.5 Cookies

Strictly necessary cookies for authentication and session management, and Google Analytics for usage analytics. Where required, we request consent before setting non-essential cookies. You can control cookies through your browser settings.

2.6 Gmail integration (optional, Users only)

If you choose to connect your Gmail account via Email Assistant, we access your mailbox through Google’s OAuth APIs using the gmail.modify scope so we can read inbox messages and create or update draft replies. We do not send email on your behalf.

When Gmail is connected, we process:

• OAuth access and refresh tokens (encrypted at rest with AES-256-GCM)
• Message metadata needed for activity history (sender, subject, snippet, timestamps, Gmail message/thread IDs)
• Generated draft reply text and, where relevant, the Gmail draft ID
• A writing-style profile derived from a sample of your sent mail (greeting patterns, sign-off, formality notes) — not the full sent archive
• For emails our Twin cannot answer confidently: a temporary copy of the message body so you can review it in Aiyou and supply a suggested reply. That body is deleted as soon as you resolve or dismiss the item, and is otherwise auto-purged within 30 days
• Redacted question patterns and reply guidance you choose to save as reusable Email Assistant references (personal identifiers are stripped before storage)

Gmail data is used solely to draft replies in your voice from your Twin knowledge and your saved guidance. It is not sold, used for advertising, or used to train general-purpose AI models. You can pause syncing or remove the Gmail connection (which revokes tokens at Google) at any time from Email Assistant.

2.7 What we do not collect

We do not knowingly collect payment card details government identification numbers, or sensitive personal health or biometric data during account creation.

We use your data for the following straightforward reasons:

• To create, authenticate, and secure your account
• To build and operate your Digital Twin
• To capture leads (End User emails) and make them visible on your dashboard
• To operate optional integrations you enable (such as Gmail Email Assistant draft replies)
• To provide customer support
• To monitor for security incidents and prevent abuse
• To improve the reliability and quality of the Service
• To send essential service updates and administrative communications
• To comply with legal obligations

For Users in the EEA/UK: We process your data to fulfill our contract with you (providing the Service), based on your explicit instructions, to satisfy legal duties, or under our legitimate interest to keep our platform secure and running smoothly.

We do not use your Knowledge Material to train, fine-tune, or improve any public or general-purpose AI model. Your material is stored, indexed, and kept logically separate from other accounts. It is never pooled with other customers' data and is never sold, licensed, or shared for advertising.

Your Knowledge Material is securely indexed so that when an End User asks a question, your Twin retrieves the most relevant information from your uploaded files to compose an answer grounded entirely in your expertise. Because your Twin answers only from what you provide, it will decline or answer narrowly on topics your material does not cover.

We use a small number of trusted service providers to operate the Service. Each provider is contractually bound to protect your data and process it only on our instructions.

We do not sell personal data or share it with third-party advertisers. We never disclose your Knowledge Material to other customers.

We may disclose data if legally required to do so - for example, under a valid court order or government subpoena. Where permitted by law, we will notify you before making such a disclosure.

Business Transfers, Mergers, or Acquisition: If Aiyou is involved in a merger, acquisition, reorganization, bankruptcy, or sale of company assets, your personal data and uploaded materials may be transferred or acquired as part of that business transaction. If such an event occurs, we will notify you via email or a prominent notice on our platform, and this Privacy Policy will continue to govern how your data is handled.

• Encryption at Rest: Knowledge Material, conversation data, and captured lead information are encrypted at rest using AES-256.
• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.3.
• Access Control: Access to production systems is strictly restricted to authorized personnel on a least-privilege basis and protected by multi-factor authentication (MFA).
• Tenant Separation: Each User's Knowledge Material is logically separated. One User's Twin cannot access or retrieve another User's material.
• Secure Development: We build and review our platform against OWASP secure development guidelines (including OWASP Top 10 for LLM Applications).
• Breach Notification: While no system is 100% immune to risks, if we become aware of a security breach affecting your personal data, we will notify you and relevant regulatory authorities without undue delay as required by law.

When you delete Knowledge Material inside your dashboard, it is immediately removed from active systems and search indexes. Encrypted backups are purged on a rolling 7-day cycle.

Your Twin is only as lawful as the material you put into it. By uploading Knowledge Material, you confirm that:

• You own the material or have obtained all necessary permissions and rights to upload and process it.
• Where uploaded materials contain personal data about others (e.g., recorded client sessions or transcripts), you have obtained proper consent from those individuals.
• You will not upload material that is illegal, defamatory, or violates any professional confidentiality agreements.
• You will not upload sensitive category data (e.g., passwords, financial records, or government identification).

We reserve the right to suspend or remove content, or terminate accounts, if this section is violated.

Depending on where you are located, you have rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we fix inaccurate or incomplete data.
• Deletion: Request the deletion of your account, leads, or Knowledge Material at any time.
• Portability: Request a copy of your primary data in a standard, structured format.
• Withdraw Consent: Withdraw consent at any time where processing relies on your consent.

To exercise any of these rights, email us at hello@meetaiyou.com. Verified requests are actioned within 7 days.

Our primary operational infrastructure, databases, and application servers are located in India. If you access the Service from outside India (such as from the EEA, UK, or US), please be aware that your information will be transferred to, stored, and processed in India where our primary servers reside.

By using the Service, you consent to the transfer and processing of your data within India and any regions where our sub-processors operate as detailed in Section 5.

The Service is intended strictly for business professionals and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact hello@meetaiyou.com.

We may update this policy as our features and service offerings evolve. The "Last updated" date at the top of this document will reflect the latest revision date. For significant changes, we will notify you via email or a notice on your account dashboard before changes take effect.

Aiyou

Assetz Marq, Whitefield, Bangalore, India 560115

Privacy Contact:hello@meetaiyou.com

Grievance Officer: Nehal, nehal@meetaiyou.com