Pavri Privacy Policy
Effective Date: 2026-03-26 Last Updated: 2026-03-26
1. Who We Are
Pavri, Inc. ("Pavri," "we," "us," or "our") operates the Pavri AI agent security platform. This Privacy Policy describes how we collect, use, store, and share information about you when you use our services, including our SDK, web dashboard, APIs, and documentation.
Contact: privacy@pavri.ai
2. What Data We Collect
2.1 Account Data
When you create an account, we collect:
- Email address and name
- Organization name
- Billing information (processed by our payment processor; we do not store full card numbers)
- Account preferences
2.2 Agent Telemetry Data
When you instrument an AI agent with the Pavri SDK, the SDK sends:
- Agent identifiers (name, framework, version, environment)
- Session metadata (session ID, start/end timestamps, outcome)
- Tool call metadata (tool names, input/output summaries)
- Model invocation metadata (model name, token counts, estimated cost)
- Policy evaluation decisions (policy ID, decision, action taken)
- Threat detection signals (detection type, confidence, no raw prompt content by default)
We do not store raw prompt content or model outputs unless the operator explicitly enables log forwarding.
2.3 Usage Data
We collect information about how you use the dashboard:
- Page views and navigation patterns
- API endpoint usage and response times
- Feature usage statistics
2.4 Technical Data
- IP addresses (for rate limiting and audit logging)
- Browser type and version (for dashboard compatibility)
- Session cookies (for authentication)
3. How We Use Your Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Providing the service (agent monitoring, policy enforcement, threat detection) | Contract performance |
| Security monitoring and anomaly detection | Legitimate interest |
| Billing and invoicing | Contract performance |
| Customer support | Contract performance |
| Product improvement and analytics | Legitimate interest |
| Legal compliance | Legal obligation |
| Marketing (only with consent) | Consent |
4. How Long We Retain Your Data
| Data Type | Retention Period |
|---|---|
| Agent telemetry events | 90 days (ClickHouse TTL) |
| Audit logs | 1 year |
| Account data | Duration of contract + 30 days |
| Billing records | 7 years (tax/legal requirement) |
| Encrypted backups | 30 days after backup creation |
5. Who We Share Data With
We share data with the following categories of third parties:
| Category | Purpose | Examples |
|---|---|---|
| Infrastructure providers | Hosting, storage, CDN | Cloud providers (see DPA for current list) |
| Authentication | SSO and user management | WorkOS |
| Monitoring | Uptime and error tracking | To be disclosed in subprocessor list |
| Payment processing | Billing | Stripe |
We do not sell personal data to third parties.
6. Your Rights
Under GDPR and CCPA, you have the right to:
- Access: Request a copy of your personal data
- Correction: Correct inaccurate personal data
- Erasure: Request deletion of your data (see our deletion procedure)
- Portability: Receive your data in a machine-readable format
- Object: Object to processing based on legitimate interest
- Restriction: Request we limit processing of your data
- Opt-out of sale: Pavri does not sell data; this right is automatically satisfied
To exercise your rights, contact privacy@pavri.ai. We respond within 30 days.
7. Cookies
The Pavri dashboard uses:
- Session cookies (required): for authentication, deleted on browser close
- Preference cookies (required): theme (light/dark mode), session timeout preference
We do not use advertising or third-party tracking cookies.
8. Security
We protect your data using:
- TLS 1.2+ for all data in transit
- AES-256 encryption for data at rest
- Access controls enforced by our access control policy
- Regular security assessments (see our Information Security Policy)
9. International Data Transfers
Pavri operates in the United States. If you are located in the EU/EEA, your data may be transferred to the US. We use Standard Contractual Clauses (SCCs) as the transfer mechanism.
10. Children
Pavri is a B2B platform not intended for use by individuals under 16. We do not knowingly collect data from minors.
11. Changes to This Policy
We will notify account holders by email and dashboard notice at least 30 days before material changes take effect.
12. Contact
Data Protection Inquiries: privacy@pavri.ai Address: [To be added upon company formation] EU Representative: [To be designated upon EU market entry]