Privacy Policy

This policy explains how Ayoh ("Ayoh", "we") handles personal information when you use our website, sign-up and the other parts of Ayoh we run. We are the controller of the information described in section 3.

It doesn't cover the content of your Ayoh, meaning your mail and everything else stored in your Cloudflare account, because we don't receive it (section 2). Cloudflare's own privacy policy covers what Cloudflare processes for you. If you use an Ayoh that someone else runs, such as your employer's, they control the data in it: ask them about it.

These are stored and processed in your own Cloudflare account (in D1, Durable Objects and R2, and by Workers AI), not by us. We keep no copy of them and don't access them (the Cloudflare token you give us is used only to install Ayoh, connect domains and apply updates, and you can revoke it once setup is done):

• messages, attachments and the original copies of them;
• contacts, calendar events, notes and boards;
• digests, the lists they go to, who each one reached and who unsubscribed, entries from any sign-up forms you published, and the logos and pictures in your digests;
• summaries, drafted replies, and your conversations with the copilot and Ayoh Agent, including files you give it and what you say to it by voice;
• your settings, filters and the instructions you give the AI;
• keys you add for connected services, such as a Composio or Resend key, which are stored encrypted.

You, or your organization, decide what happens to this information. When the agent uses a connected app or searches the web, the request goes to that service as described in section 5. A letter goes to the people on its list through your own Resend account, under your agreement with Resend, and Resend's reports of deliveries, bounces and complaints come back to your Ayoh, not to us.

We don't ask for your real name, and we don't build profiles of you.

Where the GDPR or UK GDPR applies, we rely on: contract, to provide the account and the Ayoh you asked for; legitimate interests, to keep the Service secure, prevent abuse and improve it, weighed against your rights; legal obligation, for records the law requires us to keep; and consent, where we ask for it, which you can withdraw at any time.

We don't sell or rent personal information, and we don't share it for advertising. We share it only with:

• Cloudflare, which hosts our website and the services we run (separately from your own Cloudflare account) and delivers our sign-in emails;
• TinyFish, where web search runs on our key: the search terms and page addresses your agent asks for, never anything from your mailbox;
• Composio, where connected apps run on our shared connector key rather than your own: the requests your agent makes to the apps you've connected. With your own key, those requests go from your Ayoh to Composio under your agreement with it, not through us;
• anyone the law requires us to, or where it's needed to protect the rights, safety or security of people or the Service; and a buyer or successor, if Ayoh is merged or sold, under the protections of this policy.

We use one essential cookie, to keep you signed in. Your browser also keeps your display preferences (theme, accent and text size) and, if you add the app to your home screen or dock, the app's own code so it opens without a connection. It never keeps your mail. We count visits to this website with Cloudflare Web Analytics, which sets no cookie and doesn't follow you to other sites; add ?notrack=1 to any address here and this browser is left out of the count from then on. We don't use advertising cookies or third-party pixels.

Sign-in uses passkeys, which never leave your device; one-time codes are stored only as keyed hashes; API tokens are stored encrypted; the app is served with a strict content security policy; and every request is checked against your workspace. No system is perfectly secure, and much of Ayoh's security rests on your Cloudflare account, so protect it with strong sign-in and two-factor authentication. See Privacy and security in the user guide for the detail.

The services we run are hosted on Cloudflare's global network, so information we hold may be processed outside your country. Where the law requires it, we rely on appropriate safeguards for those transfers, such as the standard contractual clauses in our providers' data processing terms.

Depending on where you live, you may have the right to access, correct, delete or export the personal information we hold about you, to object to or restrict how we use it, and to withdraw consent. Write to us at the address below and we'll respond within the time the law requires, after checking it's really you. You can also complain to your data protection authority.

Closing your account deletes the account information we hold, apart from what the law requires us to keep. It doesn't touch your Ayoh in Cloudflare, which you remove yourself. We don't sell or share personal information as California law defines those terms.

Ayoh isn't meant for children under 16, and we don't knowingly collect their personal information. If you think we have, tell us and we'll delete it.

We'll post any changes here with a new date, and tell you in the app or by email before a material change takes effect.