Privacy Policy

1. Company Information

IVAS Corp is the data controller responsible for your personal data processed through the Service at ivas.dev.

2. Information We Collect

2.1 Information You Provide

2.2 Information Collected Automatically

2.3 Payment Information

Payment processing is handled entirely by Stripe. We never see, receive, or store your credit card numbers, bank account details, or other payment credentials. Stripe processes your payment data in accordance with PCI DSS Level 1 standards. For Stripe's privacy practices, see stripe.com/privacy.

2.4 Customer Memory Data

When you use the IVAS API, your AI agents store and retrieve memory data through our Service. This data is stored in isolated, per-customer SQLite databases. We do not access, read, analyze, or use your memory vault contents for any purpose other than providing the Service to you. Your memory data belongs to you.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery — To create and manage your account, authenticate API requests, and provide the hosted memory API
• Communication — To send account verification emails, service updates, security alerts, and billing notifications
• Billing — To calculate usage, generate invoices, and process payments through Stripe
• Security — To detect abuse, prevent fraud, enforce rate limits, and protect the integrity of our infrastructure
• Performance — To monitor API performance, debug issues, and improve service reliability
• Analytics — To understand website usage patterns (only with your cookie consent)
• SMS notifications — To send service alerts via SMS (only with your explicit TCPA consent)

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

You may withdraw consent at any time without affecting the lawfulness of processing performed prior to withdrawal.

5. Third-Party Service Providers

We share your data only with the following third-party processors, strictly for the purposes described. Each processor is bound by data processing agreements.

6. Data Storage and Security

6.1 Infrastructure

• User database: SQLite on isolated VPS infrastructure
• Customer memory vaults: Isolated, per-customer SQLite databases on private VPS
• Location: United States (DigitalOcean data centers)

6.2 Encryption

• In transit: All data transmitted over HTTPS (TLS 1.2+)
• At rest: SQLite databases stored on encrypted disk volumes

6.3 Isolation

Each customer's memory vault is stored in a physically separate SQLite database file. There is no shared database between customers. One customer's data cannot be accessed by another customer's API keys.

6.4 Security Measures

We implement industry-standard security measures including but not limited to: API key authentication, rate limiting, IP-based abuse detection, encrypted storage volumes, automated security updates, and access logging. While no method of transmission or storage is 100% secure, we take reasonable and appropriate measures to protect your data.

7. Data Retention

When data is permanently deleted, it is removed from all active databases. Backup copies are purged as they rotate out according to the backup schedule described above.

8. Cookies and Tracking

8.1 Essential Cookies

We use essential cookies for session management and authentication. These cookies are strictly necessary for the Service to function and are always active. They do not track you across websites.

8.2 Analytics Cookies

We use Google Analytics 4 (GA4) to understand how visitors interact with our website. Analytics cookies are only placed with your explicit consent. You may grant or withdraw consent at any time via the cookie consent banner on our website.

8.3 What We Do Not Use

• No marketing or advertising cookies
• No third-party tracking cookies
• No cross-site tracking
• No fingerprinting for advertising purposes

8.4 Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service. You can opt out of Google Analytics at any time using the Google Analytics Opt-Out Browser Add-on.

9. Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation:

We will respond to all GDPR requests within 30 days. If we need additional time, we will notify you within the initial 30-day period. You also have the right to lodge a complaint with your local data protection supervisory authority.

10. Your Rights Under CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA), provide you with the following rights:

10.1 Right to Know

You have the right to request that we disclose what personal information we collect, use, and share about you. The categories of personal information we collect are described in Section 2 of this policy.

10.2 Right to Delete

You have the right to request deletion of your personal information. You can exercise this right via the DELETE /api/v1/account API endpoint or by contacting us at admin@ivas.dev.

10.3 Right to Opt Out of Sale

10.4 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge different prices, or provide a different quality of service because you exercised your privacy rights.

10.5 Authorized Agents

You may designate an authorized agent to submit requests on your behalf. Authorized agents must provide proof of written authorization and identity verification. Contact admin@ivas.dev to submit an authorized agent request.

10.6 Verification

When you submit a CCPA request, we will verify your identity by matching the information you provide with the information we have on file. We will respond to verifiable consumer requests within 45 days.

11. SMS and Phone Communications

If you provide your phone number and opt in to SMS notifications, we may send you service-related text messages via Twilio. By opting in, you provide your express written consent under the Telephone Consumer Protection Act (TCPA).

• SMS is used for service alerts and notifications only
• Message frequency varies based on account activity
• Standard message and data rates may apply
• We will never send marketing SMS without separate, explicit consent

Opting Out of SMS

You can stop receiving SMS messages at any time by:

• Replying STOP to any message
• Updating your notification preferences in your account settings
• Contacting us at admin@ivas.dev

Opting out of SMS will not affect your ability to use the Service.

12. Children's Privacy

The Service is not directed at children under the age of 13 (or under the age of 16 in the EEA). We do not knowingly collect personal information from children. If we discover that we have inadvertently collected personal data from a child under the applicable age, we will promptly delete that information.

If you are a parent or guardian and believe that your child has provided personal information to us, please contact us at admin@ivas.dev and we will take steps to delete such information.

13. International Data Transfers

Our servers are located in the United States (DigitalOcean data centers). If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

For users in the EEA and UK, we rely on the following transfer mechanisms as applicable:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all third-party processors
• Your explicit consent, where applicable

By using the Service, you acknowledge that your data will be processed in the United States, where data protection laws may differ from those in your jurisdiction.

14. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms:

• GDPR: We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay.
• CCPA: We will notify affected California residents promptly, in accordance with California Civil Code Section 1798.82.

Breach notifications will include the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify registered users via email
• Post a prominent notice on our website

We encourage you to review this page periodically. Continued use of the Service after changes are posted constitutes your acknowledgment of the updated policy. For material changes that affect how we process your data, we will seek your consent where required by law.

16. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or have a privacy concern, please contact us:

We aim to respond to all privacy inquiries within 30 days.