Privacy Policy

• Apavin connects your business email, WhatsApp Business number and LinkedIn profile to AI agents you choose, such as Claude, ChatGPT or Cursor, through Apavin MCP (Model Context Protocol).
• Your own AI app or your own model key does the thinking. Apavin does not train AI models on your data, and the AI providers Apavin itself calls do not train on API data by default.
• Nothing an agent writes reaches a customer or goes public on LinkedIn until a person approves it, unless your workspace admin turns on automatic sending for replies on a plan that includes it.
• We do not sell personal data, and we do not use it for advertising.
• Credentials for connected accounts are encrypted at rest. OAuth tokens are stored only as hashes.

Apavin ("Apavin", "we", "us") is a software company based in India. This policy covers apavin.com, mcp.apavin.com, the Apavin web app, the Apavin MCP server and OAuth endpoints, the Apavin plugin for Claude and ChatGPT, and the emails we send.

Two kinds of people have data in Apavin. Members of a workspace (you, your team) use Apavin directly, and for their account data Apavin is the controller, or Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act). Your customers and contacts appear in the email, WhatsApp and LinkedIn data your workspace connects. For that data the business that owns the workspace is the controller, and Apavin acts as its processor, or Data Processor, processing it only to provide the service on the business's instructions.

• Account details: your name, work email, password (stored only as a bcrypt hash), role, workspace name, website, time zone, and the answers you give during onboarding (how you heard about us, your role, what you want your AI to work on).
• Google sign-in: if you choose Continue with Google, Google shares your name, email address and profile picture, and whether Google has verified the email.
• Connected email: messages synced from the inboxes you connect over IMAP, and the SMTP details used to send. App passwords are encrypted with AES-256-GCM.
• Connected WhatsApp Business: messages, contact names and numbers, delivery receipts and template details from Meta's WhatsApp Cloud API, and the access token, encrypted at rest.
• Connected LinkedIn: your LinkedIn member id, name, profile picture and email from LinkedIn's OpenID Connect sign-in, the posts you publish through Apavin, and the post statistics you or your agent record. We do not read your connections, messages or feed.
• Content you and your agents create: drafts, replies, LinkedIn posts, images you upload or generate (with location, camera and other metadata removed before they are saved), notes, follow-up tasks, knowledge documents, your price list and your voice profile.
• Agent activity: every MCP tool call, with the tool, the connection, the outcome and the time, but not message bodies; approvals, sends, failures and revocations in the audit log; background agent runs and their short reports.
• Billing: plan, order ids and payment status from Cashfree or PayPal. Card and bank details go directly to the payment provider and never reach Apavin.
• Website visits: on apavin.com, our own visitor analytics (IntellQ, an Apavin product) records pages viewed, referrer, approximate location from IP address, device and browser, and anything you type into forms such as the contact form or the live demo box.
• Support and feedback: what you send us by email, chat or the in-app feedback form.

• To run the service: sync mail, show conversations to your AI agent through the tools you allow, hold outbound messages for approval, send approved messages on time, publish approved LinkedIn posts, and run the background agents you set up.
• To keep it safe: authenticate members and AI clients, enforce permissions, plan limits and rate limits, stop abuse and spam, investigate incidents, and keep the audit log.
• To bill you and send service emails: receipts, plan changes, password resets, security alerts, and the morning brief if you turn it on.
• To improve Apavin, using aggregated usage such as which tools are called and where errors happen.
• To meet legal obligations, such as tax records and lawful requests.

We do not sell personal data, rent it, share it for cross-context advertising, or build advertising profiles. We do not use your workspace content to train any AI model.

Apavin is built so that your own AI does the work. There are three ways data reaches an AI model, and you control each one.

• Your AI app over MCP. When you connect Claude, ChatGPT, Cursor or another MCP client and approve its access, that app can call the Apavin tools you allowed, and the results (for example an email thread or a customer's context) go to that app. Its provider handles that data under your agreement with them.
• Your own model key. If an admin saves an Anthropic (Claude) or OpenAI API key for background agents, Apavin sends the agent's instructions and tool results to that provider under your account. The key is checked with the provider before saving, encrypted at rest and never shown again.
• Apavin's own AI features. Generated LinkedIn banner images send your prompt to OpenAI's image API, and the live demo box on our website sends the text you type to OpenAI. Both run under API terms in which the provider does not train on the data by default.

Text from customers, emails and web pages reaches an agent marked as untrusted data, so an instruction hidden in a message cannot change what the agent is allowed to do. Permissions are never decided by reading message content.

Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you (running the service); legitimate interests (security, fraud prevention, improving Apavin, and business-to-business communication, balanced against your rights); consent (optional analytics and marketing emails, which you can withdraw at any time); and legal obligation (tax and lawful requests).

Under India's DPDP Act, we process the personal data of members for the purposes you consent to when you create an account and for the legitimate uses the Act permits. For your customers' data, the business that owns the workspace is responsible for having a valid basis, including WhatsApp opt-in and honouring opt-outs. Apavin enforces STOP requests on WhatsApp automatically.

We share data only with the providers that run Apavin, and with the platforms you connect, for the purpose shown:

We may also disclose data when the law requires it, to protect people from harm, or as part of a merger or acquisition, in which case this policy continues to apply to it.

Apavin's database is hosted in Singapore (AWS ap-southeast-1, through Neon). The application runs on Vercel, which may process requests in other regions. Where data moves across borders, we rely on our providers' contractual safeguards, including Standard Contractual Clauses where the GDPR requires them, and we transfer data out of India only as the DPDP Act permits.

• Account and workspace data: for as long as the workspace is active.
• MCP call records: 7 days on Free, 30 days on Standard, 90 days on Growth, and as agreed on Enterprise. The current month is always kept so usage counts stay correct.
• Messages and conversations: until you delete them, or for the period your workspace's data retention setting chooses.
• Sign-in sessions: up to 30 days, extended while you keep using Apavin, or 12 hours if you untick Remember me. Access tokens for AI clients last one hour; refresh tokens rotate on every use.
• Background agent run reports: the last 50 runs per agent.
• When a workspace is closed, we delete its data within 30 days, except what we must keep for legal or tax reasons. Copies in backups expire on the backup cycle.

Credentials are encrypted with AES-256-GCM using a key held outside the database. Apavin is its own OAuth 2.1 server with PKCE; access tokens are opaque, short-lived and stored as SHA-256 hashes; refresh-token reuse revokes the whole connection. Every query is scoped to its workspace, and automated tests try to cross workspaces. Two-factor authentication is available for every member.

Apavin does not hold SOC 2 or ISO 27001 certification yet. The full list of what is and is not in place is on our Security page.

• Essential cookies keep you signed in and protect forms from cross-site request forgery. Apavin does not work without them.
• Your light or dark theme choice is saved in your browser's local storage.
• On apavin.com, a first-party identifier lets our visitor analytics recognise a returning visitor. It is not shared with advertising networks.
• We use no advertising or cross-site tracking cookies.

Depending on where you live, you can ask us to access, correct, update, export or delete your personal data, to restrict or object to processing, and to withdraw consent. Under the DPDP Act you can also nominate someone to exercise your rights and seek grievance redressal. California residents can ask what we collect and ask us to delete it; we do not sell or share personal information as the CCPA defines it.

Email sales@apavin.com from the address on your account. We answer within 30 days. If your data is in a workspace another business owns, we will pass your request to that business, because they decide what happens to it.

You can also complain to your data protection authority, such as the Data Protection Board of India or your local supervisory authority in the EU or UK.

Google: Apavin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only basic profile and email for sign-in.

LinkedIn: Apavin posts only to your own profile, only after you approve each post, and within limits stricter than LinkedIn's own. It does not like, comment, connect, message or scrape. Disconnecting LinkedIn in Apavin deletes the stored token.

WhatsApp: messaging runs through Meta's WhatsApp Business Platform and is also subject to Meta's terms. Free-form replies are refused outside Meta's 24 hour window, and every message is refused to a customer who has sent STOP.

Apavin is a business service for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

When we change this policy in a way that matters, we will tell workspace owners by email or in the app before the change takes effect, and update the date at the top.

Questions, requests and complaints: sales@apavin.com. Grievance officer: Vinayak Kaushal, Cofounder and CEO, at the same address. We acknowledge complaints within 48 hours and resolve them within 30 days.