Privacy Policy

Welcome to Envoa (“we”, “our”, “us”). We are an autonomous personal assistant service operated by Carneiro Ventures UG, headquartered in Berlin, Germany. We are deeply committed to protecting your privacy and ensuring the security of your personal data.

This Privacy Policy explains how we collect, process, store, and protect your information when you visit our website (envoa.app), use our web applications, or interact with our automated assistant coordination services. Our data practices comply with the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).

The controller responsible for data processing on this platform is:

We collect only the data necessary to provide and operate your dedicated assistant:

• Account Information: Your name, email address, password credentials, or OAuth tokens received when you sign in.
• Calendar & Availability Data: Calendar events, busy/free schedules, meeting participants, titles, and timestamps synchronized from your connected calendar (such as Google Calendar or Microsoft 365) to identify openings and schedule confirmed events.
• Instructions & Correspondence: Prompts, voice notes, and email messages sent or received in the process of coordinating meetings on your behalf.
• Technical & Usage Logs: IP addresses, browser agent, operating system, and interaction timestamps used for diagnostics, service availability, and cybersecurity.

We process your personal data based on the following legal grounds:

• Contract Fulfillment (Art. 6(1)(b) GDPR): Processing is necessary to provide the Envoa assistant services requested by you, including managing calendar availability and negotiating schedules.
• Consent (Art. 6(1)(a) GDPR): When you explicitly authorize third-party calendar connections or personalized settings. You can withdraw your consent at any time.
• Legitimate Interests (Art. 6(1)(f) GDPR): To ensure the integrity, uptime, anti-abuse protection, and security of our IT systems.
• Legal Obligation (Art. 6(1)(c) GDPR): To adhere to statutory commercial and fiscal retention requirements under German law.

• AI Inference: Envoa uses state-of-the-art AI reasoning models to understand intent and compose polite emails. Text inputs are processed via secure APIs. Your private communications and scheduling data are never used to train public foundation models without your explicit opt-in consent.
• Google Calendar API Limited Use: Envoa’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We never sell your Google data.
• Transactional Email Delivery: Outbound negotiation emails and meeting confirmations are delivered via dedicated enterprise email infrastructure (such as Resend) with transport layer encryption (TLS).
• No Data Brokering: We do not sell, rent, or trade your personal or calendar data to third parties, advertisers, or data brokers.

Your data is stored in high-security cloud data centers. We implement comprehensive technical and organizational measures (TOMs), including 256-bit TLS encryption in transit, encryption at rest, least-privilege access policies, and automated security monitoring to safeguard your data against loss, destruction, and unauthorized access.

We retain personal data only as long as necessary to fulfill the purposes described in this policy, or as mandated by applicable statutory retention periods. You may disconnect your calendar or delete your Envoa account and associated history at any time by emailing us at hello@envoa.app.

Under Chapter III of the GDPR, you have the following rights:

• Right of Access (Art. 15 GDPR): The right to obtain confirmation and a copy of the personal data we hold about you.
• Right to Rectification (Art. 16 GDPR): The right to have inaccurate personal data corrected.
• Right to Erasure (Art. 17 GDPR): The right to request the deletion of your personal data (“Right to be forgotten”).
• Right to Restriction of Processing (Art. 18 GDPR): The right to restrict the processing of your data under certain conditions.
• Right to Data Portability (Art. 20 GDPR): The right to receive your data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): The right to object to data processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3) GDPR): The right to revoke consent at any time with future effect.
• Right to Lodge a Complaint (Art. 77 GDPR): The right to file a complaint with a competent data protection supervisory authority, including the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

To exercise any of these rights, simply email us at hello@envoa.app.

We may update this Privacy Policy periodically to reflect enhancements to our service, emerging technologies, or changes in legal regulations. Any revisions will be published on this page with an updated timestamp.

If you have any questions or comments about this Privacy Policy or our data privacy practices, please contact us at: