Privacy Policy

What we collect

Account details: your name, email address, password (stored only as a hash) and language preference.

What you give the agent: the tasks and messages you write, the files you upload, and the results the agent produces for you.

Connected apps: when you connect an app, we store the access tokens that app issues, encrypted, together with the account label (such as an email address) so you can tell your accounts apart. We never store the app's password.

Usage and security records: the time and network address of sign-ins, which actions were taken in connected apps, credits used, and errors. These keep your account safe and let us support you.

How we use it

To run your tasks, to keep your account secure, to charge credits correctly, to answer your support requests and to improve the service using aggregate numbers. We do not sell personal data and do not show advertising.

AI models and other processors

To run a task, the relevant parts of your messages and files are sent to third-party AI model providers and, when a task uses one, to the connected app. These providers process the data only to return a result; we use their API services under terms that do not permit them to use your data to train or improve their models. Tasks that need a computer run in an isolated sandbox that is discarded afterwards.

The processors we use are: OpenRouter (AI model gateway) routing every request to OpenAI models only, with each request restricted to model hosts that neither store nor train on it; E2B for the isolated sandbox; Amazon Web Services (Mumbai region) for our servers and database; Resend for email delivery; and Stripe for payments. Stripe and Resend never receive the content of your tasks, files or connected apps.

Google user data

When you connect a Google account, Akilira asks only for the scopes it needs: the Drive files you pick for a task (drive.file), your calendar events (calendar.readonly and calendar.events), and your basic profile (openid, email, profile). We access that data only to carry out the task you ask for, in the conversation where you chose that account.

Sharing, transfer and disclosure: Google user data is shared only with the AI model providers named above, limited to the parts of a file or event the task needs, so that they can return the result to you; with E2B when a task opens the file in the sandbox; and with Amazon Web Services, which hosts our servers. It is never shared with Stripe, Resend, advertisers, data brokers or any other third party, and it is never sold. We disclose it to nobody else unless the law requires it.

We do not use Google user data to train or improve any artificial intelligence or machine learning model, whether ours or a third party's, and we do not allow our processors to do so. We never transfer Google user data to any service that would use it for training.

Humans at Akilira read Google user data only with your explicit permission for support, when needed for security or to comply with the law, or after it has been aggregated and anonymised. Disconnecting Google revokes the token and deletes it from Akilira.

Akilira's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect your data

Sensitive data, which includes Google user data, connected-app tokens, your files and your conversations, is protected in transit and at rest. Every connection to akilira.ai and to Google's APIs uses HTTPS (TLS); plain HTTP is redirected. Access tokens for Google and every other connected app are encrypted at rest with AES-256-GCM using envelope encryption: each secret has its own data key, and the master key that wraps it is stored separately from the database, so a copy of the database alone cannot reveal a token.

Tokens are used only by Akilira's own servers to call the app on your behalf. They are never sent to the browser, never shown to the agent or to AI model providers, and never written to logs. Passwords are stored only as argon2id hashes and session tokens only as SHA-256 hashes; neither can be read back.

Access is limited: our servers run in Amazon Web Services (Mumbai region) behind a firewall that admits only HTTPS and administrator SSH from named addresses, production credentials live only on those servers, and every read or write of a connected app, every file upload, download and delete, and every approval is written to an audit log. Any action that changes, sends or deletes something in a connected app asks for your approval first. Tasks that need a computer run in an isolated sandbox that is discarded when the task ends.

Google user data is processed only for the task that needs it and is not copied into any other system. Disconnecting Google revokes the token with Google and deletes it from Akilira at once; deleting your account removes your content and connected apps. Database backups are kept for 14 days and then deleted. If we ever learn of a breach affecting your data, we will notify you and the relevant authorities as the law requires.

Connected apps

Tokens for connected apps are encrypted at rest with a key that is not stored with the data. They are used only by Akilira's own servers, only for the conversations you choose, and never shown to the agent, to the browser or in logs. Disconnecting an app revokes its token with the app and deletes it from Akilira.

How long we keep it

Your content stays until you delete it or your account. Security records are kept for up to twelve months. Deleting your account removes your name, content and connected apps at once; a minimal anonymised record of credits and audit events may remain where the law or fraud prevention requires it.

Your rights

You can see and export everything in your account from Settings, correct your name there, and delete the account entirely. Where the law gives you further rights, such as to object to or restrict processing, write to us and we will act on them.

Cookies

Akilira sets one strictly necessary cookie to keep you signed in, and stores your theme and language choices in your browser. There are no advertising or tracking cookies.

Children

Akilira is not for anyone under 18. If you believe a child has created an account, tell us and we will delete it.

Changes and contact

If this policy changes in a way that matters to you, we say so in the app before the change applies. Questions and requests go to akilira101@gmail.com.