Privacy Policy

Your Mac also keeps its own copy of every session, transcript and note in a database in your Application Support folder, along with the full-text search index. Deleting the app's data removes that copy.

Transcript text does leave. As a session runs, each transcribed line is sent to our servers and stored, so that the web dashboard can show you the session and so that answers and notes can be produced from it. This is more than a pass-through: the text is held in our database until you delete it.

What we store, by kind:

• Account. Your email address, the name you set, and when you agreed to the rules the app shows before the first session, with the version of that wording.
• Sessions. Type (interview or call), title, start and end times, and the context it started with: the name on your Profile page, copied onto every new session, and any role, company, description or resume text you attached.
• Transcripts. Each transcribed line, and whether it came from your microphone or from the meeting audio.
• Notes and scratchpad. What the model wrote at the end of a session, and anything you typed yourself.
• Documents. The title and text of anything you upload to use as context.
• Feedback. When you rate a session in the app or send a message from the feedback page: the rating, the reasons you picked, what you wrote, the session's type and length, the app version and whether its answers came through our servers.
• Usage. Which kind of request was made, which model answered, token counts, duration and the minutes charged. While a session runs, the app also tells our servers every 30 seconds or so that it is still running, and we keep when it last did: that is how a session's length is measured. This is what the credits ledger is built from.
• Purchases. The pack bought, the amount, any coupon, the payment status, and a phone number if the payment method asked for one. We never see or store card details.
• Devices. A hashed token per Mac you have signed in on, and the name it reported.

To run the service you asked for: transcribing, answering, writing notes, showing you your own history, metering minutes and taking payment. We read the feedback you send, to fix and improve Qavio. We also use aggregate usage figures to work out what the service costs to run. The legal basis is the performance of our contract with you, and our legitimate interest in keeping the service working and paid for.

We use a small number of providers, each for one job. Your content reaches only the first three.

• OpenAI. When you press the answer key, or when notes are written, the relevant transcript text and context are sent to OpenAI to be answered. OpenAI states that API content is not used to train its models.
• Supabase. The database and the sign-in system. Everything in section 2 is stored there.
• Vercel. Hosts this website and the API that sits in front of the database.
• Dodo Payments. Takes payment as merchant of record when you buy minutes. It receives your email and payment details directly and handles them as an independent controller, under its own privacy policy; we receive only the outcome and the amount.
• Slack. Carries short alerts to our team, such as a payment received or a thumbs down on a session with the reasons picked. An alert never carries a transcript, notes or anything you wrote, and never your name or email.
• Google Analytics. On the qavio.ai marketing page only, to count visits. It sees the page you loaded and standard browser information. It is not loaded inside the dashboard or the Mac app, and it never sees your sessions, transcripts or notes.
• Tally. Runs the Windows waitlist form on the qavio.ai homepage. The form loads only when you open it. If you join the waitlist, what you type in it, such as your email address, goes to Tally, and we use it only for the waitlist.

These providers are outside India, so storing your data involves an international transfer. We use them under their standard data processing terms.

A session captures speech from people who are not our users. We process it only to produce your transcript, your answers and your notes, on your instruction. Telling those people, and obtaining any consent the law or the platform where you are requires, is your responsibility as the account holder. This is set out in section 4 of the Terms. Because Qavio captures system audio through ScreenCaptureKit, macOS shows its own recording indicator in the menu bar throughout, and the app cannot turn it off.

Sessions, transcripts, notes and documents are kept until you delete them or close your account. Deleting a session removes its transcript, notes and feedback from our database; the copy on your Mac is separate and is removed by deleting the app's data. Feedback that is not about a session is kept until you close your account.

Usage and credit ledger rows outlive a deleted session, with the link to it broken, because they are the record of what you were charged. Payment records are kept as long as tax and accounting rules require.

Deleting your account, from Settings in the dashboard, removes all of the above at once and cannot be undone: your sessions, transcripts, notes, documents, profile, feedback, usage and credit ledger, any minutes you have left, and the sign-in itself. The one thing kept is the record of a payment you made, with the link to you removed, for as long as tax and accounting rules require. The copy on your Mac is not reached by this and is removed by deleting the app's data.

You can see and edit your sessions, notes, documents and profile from the dashboard, and delete any of them. You can delete your account and its contents yourself, at any time, from Settings in the dashboard. You can also ask for a copy of everything we hold or ask us to correct it. Write to info@qavio.ai and we will act within 30 days.

Traffic is encrypted in transit. Device tokens are stored hashed, never in the clear. Database access is restricted to the application, and the tables holding auth codes, device tokens and payment orders are closed to the browser entirely. No system is perfect, and we will tell affected account holders if we learn of a breach that puts their data at risk.

Qavio is not for anyone under 18. We do not knowingly collect data from children.

We will update this page when what we do changes, and the date at the top will say when. Where a change is material we will tell account holders by email.

Privacy questions and requests go to info@qavio.ai.