Privacy Policy

1. Who We Are

Autafy ("we," "us," or "our") provides AI automation software and services, including AIDA — a self-hosted personal AI agent. We are based in Edmonton, Alberta, Canada.

Contact: hello@autafy.ca

2. Information We Collect

We collect only the minimum information necessary to provide our services:

• Account Information: Your name and email address when you register or contact us
• Payment Information: Billing details processed securely through Stripe — we never store your full card number
• License Information: Your license key, plan type, and activation date
• Support Communications: Emails or messages you send to hello@autafy.ca
• Website Analytics: Basic, anonymized usage data (page views, referral sources) to improve autafy.ca

Self-hosted users: We do not collect your emails, calendar events, tasks, files, or AI conversation history — these stay entirely on your own server.

3. How We Use Your Information

• To provide, activate, and support your AIDA license
• To process payments and send billing receipts
• To respond to support requests and questions
• To send product updates and important service notices (you can opt out anytime)
• To improve our website and service offerings

We never sell your personal information to third parties.

4. Data Storage & Security

Self-hosted AIDA: All your AI agent data — emails, calendar, files, conversations — is stored exclusively on your own server. Autafy has zero access to this data.

All instances: We use TLS encryption for all data in transit. We retain your account data for as long as your account is active, or as required by law. You may request deletion of your account and all associated data at any time by emailing hello@autafy.ca.

5. Third-Party Services

• Stripe: Payment processing. Subject to Stripe's Privacy Policy
• Your AI provider: AIDA sends your prompts to whichever AI model provider's API key you configure (for example, Anthropic, OpenAI, or Google). That text is processed under that provider's own privacy policy. Autafy is never in this data path.
• Google / Microsoft: If you connect these services to AIDA, they are governed by their own privacy policies. See Section 5a below for full details.

5a. Google API Services — Limited Use Disclosure

AIDA's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you choose to connect your Google account to AIDA, we request access to the following Google services solely to perform actions on your behalf that you explicitly request:

• Gmail: To read, send, reply to, and manage your emails when you ask AIDA to do so (e.g. "Send an email to John", "What's in my inbox?")
• Google Calendar: To read, create, update, and delete calendar events when you ask AIDA to manage your schedule
• Google Drive: To search, read, create, move, and delete files when you ask AIDA to manage your documents
• Google Docs & Sheets: To create and edit documents and spreadsheets on your behalf
• Google Tasks: To read, create, update, and complete tasks when you ask AIDA to manage your to-do list
• Google Contacts: To look up contact information when composing emails or calendar invites on your behalf

We only access your Google data to provide the AI assistant features you explicitly request. We do not:

• Use your Google data to serve advertisements
• Sell your Google data to third parties
• Use your Google data to train AI or machine learning models. AIDA itself never uses your Google data for training. The AI provider whose API key you configure processes your prompt text under its own terms — choose a provider and plan whose data-use policy matches your requirements, as some free tiers may use submitted data to improve their models.
• Share your Google data with any third parties except as necessary to operate the service (e.g. your chosen LLM API provider processes your prompt text but not your raw Google data)
• Allow humans to read your Google data unless you have explicitly requested support and consented to access for that purpose

Your Google OAuth tokens are stored encrypted on your own server and are used solely to fulfil your requests within AIDA. You can disconnect your Google account at any time from the Settings page, which immediately deletes your stored tokens.

5b. Microsoft 365 / Graph API — Data Use Disclosure

AIDA's use of information received from Microsoft APIs adheres to the Microsoft APIs Terms of Use and the Microsoft Graph permission model.

When you choose to connect your Microsoft account to AIDA, we request access to the following services solely to perform actions on your behalf that you explicitly request:

• Outlook Email: To read, send, reply to, and manage your emails when you ask AIDA to do so
• Outlook Calendar: To read, create, update, and delete calendar events when you ask AIDA to manage your schedule
• OneDrive: To search, read, create, move, and delete files when you ask AIDA to manage your documents
• Word, Excel & PowerPoint: To create, read, and edit documents, spreadsheets, and presentations on your behalf
• OneNote: To read and create notes when you ask AIDA to manage your notebooks
• Microsoft To Do: To read, create, update, and complete tasks when you ask AIDA to manage your to-do list

We only access your Microsoft data to provide the AI assistant features you explicitly request. We do not:

• Use your Microsoft data to serve advertisements
• Sell your Microsoft data to third parties
• Use your Microsoft data to train AI or machine learning models. AIDA itself never uses your Microsoft data for training. The AI provider whose API key you configure processes your prompt text under its own terms — choose a provider and plan whose data-use policy matches your requirements, as some free tiers may use submitted data to improve their models.
• Share your Microsoft data with any third parties except as necessary to operate the service (e.g. your chosen LLM API provider processes your prompt text but not your raw Microsoft data)
• Allow humans to read your Microsoft data unless you have explicitly requested support and consented to access for that purpose

Your Microsoft OAuth tokens are stored encrypted on your own server and are used solely to fulfil your requests within AIDA. You can disconnect your Microsoft account at any time from the Settings page, which immediately deletes your stored tokens.

6. Privacy Principles & Your Jurisdiction

We collect, use, and disclose personal information only with your knowledge and consent, for purposes a reasonable person would consider appropriate — and we apply these principles to every user, wherever you live.

As a company based in Canada, Autafy operates under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If you are in the European Economic Area or the UK, you also have rights under the GDPR; if you are a California resident, under the CCPA. Because AIDA is self-hosted, the only personal data we hold about you is the account, license, and billing information described above — your emails, files, calendar, and conversations never reach us.

7. Your Rights

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated data
• Withdraw consent for marketing communications at any time
• Lodge a complaint with your local data protection authority — for example, the Office of the Privacy Commissioner of Canada, or your EU/UK supervisory authority

To exercise any of these rights, contact us at hello@autafy.ca.

8. Cookies

autafy.ca uses minimal cookies — only what's necessary for the website to function. We do not use advertising or tracking cookies. AIDA (the self-hosted application) does not use cookies.

9. Changes to This Policy

We may update this policy occasionally. We'll notify you of significant changes by email or by posting a notice on autafy.ca. Continued use of our services after changes constitutes acceptance of the updated policy.