Your data, plainly.

What Cavi collects

When you sign in

You sign in with Google. Google shares your name, email address, profile picture and an account identifier with us, and tells us whether your email address is verified. We never see your Google password. Signing in does not grant access to your calendar or spreadsheets; those connections require separate permission.

About your business

• What you tell Cavi: your website, what you sell, where your customers are, your goals and your budget.
• The public pages of the website you ask Cavi to read: text, images such as your logo and product photos, colors and fonts. Cavi uses them to build your brand kit.
• Business profile details, posts and photos from the Facebook Page you authorize, and profile details from its linked professional Instagram account when you grant access. Cavi identifies imported sources and uses this information to prepare your business context and advertising.

Your conversations and approvals

Your messages to Cavi, Cavi’s replies, the steps it took, and every approval: what was approved, by whom, when and through which channel. We keep this record so that nothing Cavi does is hidden and every action can be traced.

What Cavi makes for you

Campaign plans, ad copy, ad images and videos, including the result of the check that reads the text in each image back.

Accounts you choose to connect

Nothing here is collected unless you connect it.

• Google Calendar: when this connection is available and you enable it, Cavi reads busy times to avoid booking conflicts and creates, updates and deletes events for your bookings. It checks those events for changes made in Google Calendar. We store connection credentials, busy times, event identifiers and booking details needed to keep your schedule in sync.
• Google Sheets: when this connection is available and you enable it, Cavi creates a leads spreadsheet in your Google Drive and adds the contact details and lead information you choose to sync. It reads that spreadsheet to find and clear a contact’s rows when you approve their deletion. This uses permission for files created or opened with Cavi, rather than access to your whole Drive. We store connection credentials, the spreadsheet identifier and sync records.
• Meta (Facebook and Instagram): your Meta user identifier and name, granted permissions and their expiry, accessible business portfolios, ad accounts and Pages, available pixels and catalogs, linked Instagram details when authorized, and the access token Meta issues to Cavi. Account details include currency, time zone, status and permitted tasks. Enabled features read advertising objects and performance, Page content, catalogs and products, audience information, pixel activity and lead-form submissions. We record your selected assets, signed notifications, approvals and provider results. Supported publishing, management and catalog changes use the assets and settings you approve. Available features depend on your grants, asset access and Meta's requirements.
• Messaging channels (WhatsApp, SMS, Telegram, email): your phone number, chat ID or email address, the messages you exchange with Cavi, and their delivery status.

Connecting Meta does not by itself enable messaging channels or authorize contacting your leads. Messaging descriptions apply to the channels you separately enable.

Your leads

When Cavi handles leads for your business, it processes their contact details, messages and consent records on your behalf and under your instructions. Your business remains responsible for having the right to contact them.

For an authorized Meta Page, Cavi can subscribe to lead notifications and retrieve the associated form submissions into your customer workspace. These can include names, email addresses, phone numbers, answers and disclaimer responses. Cavi records their source and prevents duplicate imports. Receiving a submission does not itself give your business consent for every form of follow-up.

When one of them asks to have their details deleted, in your page’s chat or to you, Cavi records the request and stops sending them messages right away. Once you approve the deletion, their details are deleted from Cavi, and Cavi has the systems you connected to it delete them too (your CRM, your Cavi leads spreadsheet, the bookings in your team’s calendars and Cavi’s customer lists on Meta). Cavi keeps what the law requires a business to keep, such as invoices, signed documents and the record of payments (without the payer’s details), and keeps their email and phone on a do-not-contact list so they aren’t contacted or imported again. Copies kept elsewhere that Cavi can’t reach, such as the answers Meta keeps from its lead forms, have to be deleted in those services.

Optional website measurement and customer audiences

When you enable Meta measurement on a Cavi campaign page, its browser pixel loads after the visitor allows advertising measurement. Website server events also require advertising consent. Events can include their name, time and identifier, source page, purchase value and currency, browser information and hashed matching identifiers. Cavi sends accepted events to Meta and keeps delivery and duplicate-prevention records. Browser and server copies of the same event use matching identifiers. When a visitor’s browser sends a Global Privacy Control signal, their events go with Meta’s Limited Data Use setting, which Meta applies where state law requires it, such as California. An external website needs its own installation and consent controls.

For leads received through Meta's own forms, Cavi can report supported lead and deal outcomes back to Meta using the originating lead identifier. This is separate from website measurement and does not itself authorize messaging or customer-list audience uploads. A recorded refusal of advertising measurement blocks this reporting.

Customer-list audience operations require recorded Meta audience consent and your approval of the specific contact snapshot. Cavi sends hashed matching information to Meta and keeps private membership records to support later removals. Hashing does not make those identifiers anonymous. Removing an audience member requires access to the relevant Meta account; an unconfirmed removal remains pending or requires review.

Technical data

Our hosting provider records technical logs (IP address, browser type, pages requested and times) to keep the service secure and working. We record the cost of each AI request so we can apply usage limits. The Cavi application uses cookies for sign-in and connection security and stores display preferences such as light or dark mode on your device. Optional Meta measurement on customer campaign pages is separate and may use Meta cookies after the visitor gives consent.

How we use it

• To provide Cavi: sign you in, learn your brand, plan campaigns, make ads, and do what you approve.
• To ask for your approval before anything that spends money or changes a live ad, and to keep the record of what was approved.
• To keep Cavi secure, prevent abuse, and fix problems.
• To apply usage limits, including the daily limit on AI use.
• To write to you about your account and the service.

We do not sell your personal information, share it for cross-context behavioral advertising, or use it to train AI models.

AI processing

To answer your requests, prepare campaigns and create content, Cavi sends relevant messages, business details, website content and images to AI services. This can include authorized Meta Page and Instagram information, advertising reports and lead information used in your request or business context. Your Meta access token stays on the server and is not sent to the AI models.

• Assistance, knowledge embeddings, audio and the video studio’s editing and presenter models go through OpenRouter. The selected models include Claude by Anthropic for assistance and OpenAI models for embeddings. The provider serving a model can depend on OpenRouter’s routing. When OpenRouter can’t serve a Claude request, the same request can go to Anthropic directly.
• Ad images (OpenAI’s GPT Image models) and video generation with Seedance by ByteDance go through PiAPI.
• Photos and logos from your Facebook Page, and pictures made from them, are not sent to PiAPI. A picture made from them is drawn only through OpenRouter, and they are not used to make AI videos.

AI providers process this content under their service terms and applicable retention and data-use settings. Their processing locations can differ from Cavi’s hosting location. OpenRouter publishes its provider information. Cavi does not use your content to train its own models.

AI can be wrong. Cavi checks its own numbers against real data and reads the text in every image back before showing it to you, and nothing that spends money happens without your approval. Please review what you approve.

Who helps us run Cavi

We share data only with service providers that process it for us, and only what each one needs:

• Vercel hosts the app (United States).
• Neon stores our database, including sign-in (United States).
• Google signs you in and, when separately connected, hosts your calendar events and leads spreadsheet.
• OpenRouter and the providers serving the selected AI models, including Anthropic and OpenAI, process assistance, embeddings, audio, some video requests and pictures made from your Facebook Page, as described above.
• PiAPI makes ad images and Seedance videos.
• Anthropic answers a Claude request directly when OpenRouter can’t serve it.
• Meta, when you connect Facebook or Instagram, or talk to Cavi on WhatsApp.
• Twilio (SMS), Telegram and our email provider, when you use those channels.

We may also disclose information when the law requires it, to protect people’s safety or rights, or as part of a merger or sale of our business, in which case this policy continues to apply to it.

Data from Meta

We use the Meta data you authorize to connect your business assets, provide reports and business context, process your Page's lead submissions, and carry out supported advertising, catalog and measurement operations. Customer-list audiences require separate recorded consent and approval. We do not sell Meta data or use it to build unrelated advertising profiles. Relevant content can be processed by the service providers described above to provide Cavi.

Disconnecting in Cavi, or receiving Meta's signed removal or deletion notification, removes the covered credentials and imported data, including affected reports, Page imports, Meta lead records and notification content. Affected conversation history is removed from its first Meta import onward, together with derived knowledge; work already in progress is prevented from restoring it. Earlier unrelated history and independently maintained business content remain. A non-content fingerprint prevents repeated notifications from restoring deleted content.

Minimal approval and execution receipts, unresolved-operation records and deletion audit information remain for accountability and duplicate prevention. Historical hashed customer-audience membership records may remain to complete pending removals when authorized Meta access is available. Disconnecting does not stop or delete campaigns at Meta, confirm deletion of copies held by another service, or delete your whole Cavi account. See Data deletion for the account-wide request process.

Data from Google

Cavi uses Google data to sign you in and provide the calendar and spreadsheet connections you choose. Cavi’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data, use it for advertising, or use it to train generalized AI models. Connection credentials stay on the server. You can disconnect Calendar or Sheets in Connections and revoke Cavi’s access in your Google Account. Disconnecting stops further sync; events and spreadsheets already created in Google remain there until you delete them.

Text messages

If you choose to text Cavi or receive updates by SMS, message frequency depends on how you use Cavi. Message and data rates may apply. Reply STOP to stop and HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

How long we keep it

We keep your data while your account is open. When you delete your account in Settings, it’s deleted at once; when you ask us by email, within 30 days. Either way we keep only what the law requires. Database backups expire on their own within 30 days. When you disconnect an account, we delete its access token right away.

Security

Data travels encrypted (HTTPS). Access tokens from connected accounts are encrypted in our database. Each business’s data is separated in the database itself, so one business can never read another’s. Only the people who run Cavi can reach the systems behind it, and only when needed.

Your choices and rights

You can ask us to show you, correct, export or delete your data, and you can disconnect any connected account at any time. Depending on where you live (for example California or Canada) you have these rights by law; we give them to everyone. We won’t treat you differently for using them.

You can delete your account yourself in Settings. For the rest, write to trtech1337@gmail.com from the email address you sign in with. See Data deletion for step-by-step instructions.

Where your data is

Cavi's primary application hosting and database are in the United States. Our service providers may also process data in other countries, including through global infrastructure and support or AI processing. Using Cavi from another country can therefore involve international transfers. A provider's company address does not necessarily identify every place it processes data.

Children

Cavi is for businesses and is not meant for anyone under 18. We don’t knowingly collect data from children.

Changes

When this policy changes, we update the date at the top. If a change is significant, we’ll tell you in Cavi or by email before it applies.

Contact

TRTech, the maker of Cavi: trtech1337@gmail.com