Privacy Policy

1. Information we collect

• Account information. When you register, we collect identifiers such as email address and name you provide. Authentication may be handled via Supabase Auth.
• Business and product data. You may enter or connect financial and operational data (for example revenue, expenses, MRR, runway-related inputs, invoices, marketing channel metrics, and similar fields). This data is used to power AI CFO and AI CMO features.
• Usage data. With your consent, we use analytics (e.g. PostHog) to understand feature usage, funnels, and product performance. You can limit this via our cookie banner and PostHog opt-out mechanisms where available.
• Payment data. Paid plans are processed by Stripe. We do not store full payment card numbers on our servers; Stripe handles card data subject to its policies.
• Technical data. Our hosting and CDN providers (e.g. Vercel, Cloudflare) may process IP address, device and browser metadata, and similar signals necessary to deliver the service securely and reliably.

2. How we use your information

• Provide, operate, and improve the Envirt.ai platform and AI-powered insights.
• Process subscriptions, invoices, and billing through Stripe.
• Send transactional and service-related emails (e.g. sign-in, billing, security) via providers such as Resend, in line with your requests and our legitimate interests.
• Measure product usage and reliability using analytics and error monitoring where permitted (e.g. PostHog with consent, Sentry for errors).
• Comply with law, enforce our terms, and protect users and the service.

3. AI data processing

To generate insights, summaries, and recommendations, portions of your business data you submit or that the product derives may be sent to the Anthropic Claude API (or successor models we configure) as part of a request-response flow.

• Under Anthropic’s standard commercial API terms, customer content is not used to train their models. Prompts and outputs are processed to fulfill each request; review Anthropic’s documentation for the latest commitments.
• We do not sell your personal or business data to advertisers. AI outputs are produced to serve your account and are not intended for unrelated third-party marketing.
• AI-generated content may be stored in your workspace (for example briefs or dashboards) as part of normal product functionality, subject to your account settings and retention below.

4. Third-party services

We rely on subprocessors to run Envirt.ai. Their privacy policies govern their practices:

• Supabase — database, authentication, and related infrastructure.
• Stripe — payments and billing.
• Anthropic — AI inference (Claude).
• Resend — transactional email delivery.
• PostHog — product analytics (where you consent).
• Sentry — error monitoring and diagnostics.
• Vercel — hosting and deployment.
• Cloudflare — CDN and edge security where used.

5. Data security

• Data is transmitted over TLS (HTTPS). Data at rest is protected using industry-standard measures provided by our infrastructure vendors (including Supabase).
• The product is designed for organization-scoped access controls (including database row-level security patterns) so your workspace data is isolated from other customers.

• Our infrastructure vendors maintain industry-recognized compliance certifications:

  • Supabase: SOC 2 Type 2 certified
  • Vercel: SOC 2 Type 2 certified
  • Cloudflare: SOC 2 Type II certified
  • Stripe: PCI DSS Level 1 certified

  Envirt.ai itself is not independently SOC 2 certified. We rely on these certified vendors for infrastructure security, combined with our own application-level controls including organization-scoped Row Level Security (RLS), TLS encryption in transit, and least-privilege access patterns.

  No security practice eliminates all risk; you use the service at your own risk subject to the Terms of Service.

For comprehensive details on our security practices, visit our Security page at envirt.ai/security.

6. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, export, or restrict processing of your personal data, and to object to certain processing.

• Access & correction. You can update many account fields in-product; contact us for other requests.
• Deletion & export. You may request deletion or export of personal data subject to legal retention needs.
• Analytics opt-out. Use the cookie banner (“Essential only”) and, where applicable, PostHog’s opt-out tooling to limit analytics tracking.
• EU / UK (GDPR-style). If the GDPR applies, you may lodge a complaint with a supervisory authority and may have additional rights such as data portability.
• California (CCPA/CPRA). California residents may have rights to know, delete, and opt out of certain “sales” or “sharing” (we do not sell personal information for money as traditionally understood; analytics cookies may constitute sharing under some interpretations— you may limit via our banner).

This section is a general description and not legal advice. Laws vary by country and state.

7. Data retention

• Account data: retained while your account is active and for a short wind-down period thereafter.
• Business/financial inputs: retained while the account is active; after closure, deleted or anonymized within a reasonable period, typically up to 30 days unless law requires longer retention.
• Analytics: aggregated or anonymized where possible; raw analytics identifiers may be rotated or purged according to vendor settings (often on the order of months; we target anonymization or deletion policies aligned with a 12-month horizon where feasible).
• Backups: may persist for a limited period after deletion before automatic expiry.

8. Contact

Questions about this Privacy Policy or your data: support@envirt.ai