Privacy Policy

Effective date: [EFFECTIVE DATE]

This Privacy Policy explains how Formm AI Ltd, trading as Tevy ("Tevy", "we", "us" or "our") collects, uses, shares and protects your personal information when you use the Tevy personal assistant on WhatsApp or iMessage, our website and any related services (together, the "Service"). Please read it alongside our Terms of Service, Messaging Terms and Cookie Policy.

The short version

• We use your information to do the tasks you ask for, in life and at work.
• Tevy asks before it buys, books, pays or sends anything for you, unless you've set up a routine for it.
• Logins and payment cards you add go in an encrypted vault, kept apart from your chats.
• We never sell your personal information.
• We don't track your live location. Your country comes from the one you pick when you sign up.
• You can see, download and delete your information.

1. Who we are

Formm AI Ltd, trading as Tevy, a private company limited by shares registered in England and Wales under company number 17372021, with its registered office at 126 New Kings Road, London SW6 4LZ, United Kingdom, is the controller of the personal information described in this policy.

Questions about this policy or your information: privacy@[TEVY DOMAIN].

[LAWYER: whether a Data Protection Officer is required (German BDSG §38 may require one if a DPIA is needed). If one is appointed, add: "Our Data Protection Officer is [DPO NAME OR PROVIDER], reachable at [DPO EMAIL]." If not, delete this note.]

We're based in the UK, so UK data protection law (the UK GDPR and the Data Protection Act 2018) applies to everything we do. If you're in the EU, the EU GDPR also protects you.

Because we're based in the UK, we've appointed [EU REPRESENTATIVE NAME], [EU REPRESENTATIVE ADDRESS], as our representative in the EU under Article 27 GDPR. You can contact them at [EU REPRESENTATIVE EMAIL] about anything in this policy.

2. Information we collect

2.1 Information you give us when you sign up

• Your phone number and the country you pick with it.
• The one-time code we send you by SMS to check the number is yours.
• Your first and last name and email address.
• Your date of birth. We use it only to check that you meet our minimum age of 18 (section 13).
• The messaging app you want Tevy to use (WhatsApp or iMessage).

2.2 What you send Tevy

• The messages you send, including your instructions, preferences and anything you ask Tevy to remember.
• Voice notes. We convert them to text so Tevy can understand them. [CTO: confirm whether the audio file is kept after transcription and for how long.]
• Photos and files, such as a receipt, a parking ticket or a document you want handled.
• Anything you tell our support team.

These may include information about other people, such as names and contact details of the people you want Tevy to message, call or book for. Please only share other people's information when you have a good reason to.

2.3 Your country and language

When you sign up, you pick your country along with your phone number. We use it to set the language Tevy talks to you in (Spanish, Portuguese, Italian, French, German or English) and to give you local information and suggestions. We don't track your live location. You can change your country [CTO: confirm how, in settings or by telling Tevy].

2.4 Accounts you connect

Tevy connects to two email providers only: Gmail and Outlook. If you connect your Google account (Gmail and Google Calendar) or your Microsoft account (Outlook email and calendar), or other apps like notes, to-do, work or smart home, we access the information in them that we need to carry out the tasks you ask for. For example, we read an email thread to draft a reply, or check your calendar before booking an appointment. You choose which accounts to connect, using the permissions you approve on that provider's own consent screen, and you can disconnect them at any time. Section 7 has more on Google user data.

2.5 The vault: logins and payment cards

• Logins. You can add login details for any site or app where you have an account, so Tevy can act for you there. For example, it can post a listing, fill in a form or manage a booking.
• Payment cards. You can add a payment card so Tevy can pay for things after you say yes.

Both are kept in an encrypted vault, separate from your chat history, and used only for the tasks you approve. You can view and remove them at any time. [CTO: card storage. If the card goes straight to a PCI DSS certified payment provider and Tevy keeps only a token, add: "When you add a card, it goes straight to our payment provider, [PAYMENT PROVIDER], which is certified to the PCI DSS security standard. We never see or store your full card number. We keep only a token and the last four digits, so you can tell your cards apart." If Tevy stores card numbers itself, this needs Tevy's own PCI DSS certification first.]

2.6 Phone calls Tevy makes for you

When you ask, Tevy can phone a business or person for you, for example to book a table or to wait on hold with a company. To do this we process the number called, the time and length of the call, and what's said on the call, so Tevy can complete the task and tell you what happened. Tevy always tells the person it's calling that it's an AI assistant calling on your behalf. [CTO: whether calls are recorded or transcribed, and for how long. If not recorded, add: "Tevy listens and talks in real time to complete the call. We don't record calls. We keep a short written summary of the outcome so we can tell you what happened, for [CTO: retention period]." If audio is recorded: LAWYER: recording consent rules by country.] Tevy doesn't join group calls or meetings.

If Tevy calls or messages you for one of our users, we use your name, number and what's said only to complete that task. You can find out more, or ask us to delete your details, at privacy@[TEVY DOMAIN].

2.7 Payments and tasks with businesses

When Tevy completes a task for you, we may receive information from the businesses involved, such as shops, restaurants, booking sites, marketplaces and payment providers. Examples are an order confirmation, a booking reference, a payment receipt or a refund status. Apple and WhatsApp deliver your messages to us and may share related technical data under their own terms. If you subscribe to Tevy Max, our payment provider processes your subscription payments.

2.8 Information collected automatically

When you visit our website or use the Service, we collect technical information such as IP address, device and browser type, pages viewed, and dates and times of access. On our website, we use cookies and similar technologies, as explained in our Cookie Policy. Non-essential cookies are only used if you agree.

3. How we use your information

We use your information to:

• provide the Service and carry out the tasks you ask for, in life and at work;
• check with you before we buy, book, pay for or send anything on your behalf, unless you've set up a routine for it;
• make payments you approve, using the card in your vault;
• make phone calls you ask for, and tell you how they went;
• talk to you in your chosen country's language and give you local suggestions;
• send you check-ins, suggestions, reminders and follow-ups, including messages Tevy starts itself, such as asking how something went;
• remember your preferences so Tevy gets more useful over time;
• run your account and subscription, including the Free plan's monthly request limit;
• give you support;
• keep the Service safe and secure, and prevent fraud and abuse;
• understand how the Service is used so we can fix problems and improve it;
• comply with our legal obligations; and
• send you occasional product news by email, only if you've opted in. You can unsubscribe at any time. We don't send marketing by SMS.

4. Our legal bases (EU GDPR)

The article numbers below are from the EU GDPR. The UK GDPR has the same provisions.

5. AI and automated processing

Tevy uses artificial intelligence, including models from third-party providers, to understand your messages and voice notes, draft replies, plan tasks and talk to people on calls for you. We require these providers to process your content only to provide the Service to us, under contract.

[CTO: confirm and state clearly whether user content is used to train or improve AI models, ours or our providers'. If it isn't, say: "We don't use your messages, voice notes, photos or connected-account data to train AI models." If it is, describe it and offer an opt-out.]

Tevy asks for your confirmation before taking actions such as purchases, bookings, payments or sending messages for you. We don't make decisions that have legal or similarly significant effects on you based solely on automated processing.

AI can make mistakes, so please check important details before you confirm. See our Terms of Service.

6. How we share your information

We share personal information only as needed to run the Service:

• Service providers (processors) who help us operate it, such as hosting, AI model, speech-to-text, telephony, payment, analytics, communications and support providers. They work under contracts that require them to protect your information and use it only on our instructions. You can see the list of providers we use, and where they process data, at [TEVY DOMAIN]/subprocessors. [CTO: provide the provider list for that page.]
• Businesses and people you ask Tevy to deal with, such as a restaurant it calls, a shop it pays or a site it logs in to for you. We share only what's needed for that task.
• Apple and WhatsApp, to deliver messages.
• Professional advisers, regulators, law enforcement or others, where required by law or to protect rights and safety.
• A buyer or successor, if Tevy is involved in a merger, acquisition or sale of assets. We'll tell you if this happens.

We never sell your personal information, and we don't share it with third parties for their own advertising.

7. Google user data

If you connect your Google account, we access Gmail and Google Calendar data only with your permission and only to provide the features you use, such as finding emails that need a reply, cleaning up your inbox, drafting replies and managing your calendar.

Tevy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In line with those requirements:

• we don't transfer or sell Google user data to third parties such as advertisers or data brokers;
• we don't use it for advertising or to determine creditworthiness;
• we don't use it to develop, improve or train generalized AI or machine learning models; and
• people at Tevy don't read it unless you ask us to, it's needed for security or to comply with the law, or it has been aggregated and anonymized.

You can revoke our access at any time by disconnecting Google in Tevy or in your Google Account permissions. [CTO: Google OAuth verification, scopes and CASA security assessment status. Delete this note once Google has approved the app.]

Microsoft (Outlook) data is handled in the same way, with the permissions you approve on Microsoft's consent screen, and you can revoke access in Tevy or in your Microsoft account.

8. How long we keep your information

We keep your information while your account is open and for as long as we need it to provide the Service. Specifically:

• Chat history, voice notes and photos: [CTO: retention period]
• Call recordings or transcripts (if any): [CTO: retention period]
• Vault logins and cards: until you remove them or close your account
• Connected-account data: only as long as needed for the task, [CTO: retention period]
• Payment and billing records: as long as tax law requires, [CTO: retention period]

If you delete your account, we delete or anonymize your personal information within [CTO: deletion period]. The exception is anything we have to keep longer for legal, tax or accounting reasons, or to resolve disputes.

9. Security

We use technical and organizational measures to protect your information, including encryption in transit and at rest, a separate encrypted vault for logins and cards, and access controls. [CTO: confirm "at rest", and add any certifications only once they actually exist.] No system is completely secure, but we work hard to protect your information. Where the law requires it, we'll tell you and the authorities about a breach that affects you.

10. International transfers

We and our service providers may process your information outside the European Economic Area. When we do, we use appropriate safeguards, such as the European Commission's standard contractual clauses or an adequacy decision. You can ask us for details at privacy@[TEVY DOMAIN]. [CTO: confirm where data is hosted. If it's all in the EU, say so, because that's a strong trust point.]

11. Your rights

Under UK and EU data protection law, you have the right to:

• access your personal information;
• correct it;
• delete it;
• restrict or object to how we use it, including objecting to processing based on legitimate interests;
• get a copy in a portable format; and
• withdraw any consent at any time, without affecting what was done before.

You can see and delete much of your information yourself in your account settings or by asking Tevy in chat, and you can remove vault items and disconnect apps at any time. For anything else, email privacy@[TEVY DOMAIN]. We'll reply within one month.

You can complain to a data protection authority. In the UK, that's the Information Commissioner's Office (ICO), ico.org.uk. In the EU, you can complain to the authority in the country where you live or work, for example AEPD (Spain), CNPD (Portugal), Garante (Italy), CNIL (France) or your state's authority in Germany. We'd appreciate the chance to sort it out first, at privacy@[TEVY DOMAIN].

12. Cookies

Our website uses cookies that are essential for it to work. With your consent, we also use analytics cookies. These are off until you turn them on. We don't use cookies for advertising. You can change your choices at any time through "Cookie settings" in the footer. See our Cookie Policy.

13. Children

Tevy is only for people aged 18 or over. We check your date of birth at sign-up and don't knowingly collect information from anyone under 18. If you think someone under 18 has given us their information, contact privacy@[TEVY DOMAIN] and we'll delete it.

14. Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll tell you by message or email before they take effect. The effective date at the top shows when it last changed.

15. Contact us

Formm AI Ltd, trading as Tevy, 126 New Kings Road, London SW6 4LZ, United Kingdom

Company number: 17372021

Email: hello@[TEVY DOMAIN]

Privacy and data requests: privacy@[TEVY DOMAIN]

EU representative: [EU REPRESENTATIVE NAME], [EU REPRESENTATIVE ADDRESS], [EU REPRESENTATIVE EMAIL]

[LAWYER: Data Protection Officer line, see section 1]