Privacy Policy
Version 1.3 — Effective date: August 9, 2026
This is a courtesy translation. The French HTML version is the official version and prevails in case of any discrepancy.
This policy is published in accordance with the Act respecting the protection of personal information in the private sector (RSQ, c. P-39.1, as amended by Law 25) and the Personal Information Protection and Electronic Documents Act (SC 2000, c. 5, "PIPEDA").
1. Person in charge of the protection of personal information
In accordance with section 3.1 of the private sector Act:
| Title | Person in charge of the protection of personal information |
| support@savantisai.com | |
| Other contact details | Available on request |
Any request for access, rectification, withdrawal of consent, portability or de-indexing, and any complaint, must be addressed to this person.
2. Guiding principle
Savantis is designed to know as little about you as possible.
The control plane — which manages accounts, subscriptions and billing — stores no conversation, no message content, no files, no tool arguments, and no browser state. Your conversations, files, browser profiles, and short-term working memory remain in the dedicated KVM virtual machine for your workspace. Durable Savantis memory is a separate central service scoped by account and available across Savantis clients.
3. Information we collect
3.1 Account and billing information
| Information | Source | Purpose | Basis |
|---|---|---|---|
| Verified email address, identity identifier | Google Identity Platform, at sign-up | Authenticate access, bind your account to your workspace, and issue a Savantis session | Necessary to perform the contract |
| Account and workspace identifier (opaque) | Generated by the service | Isolate and route your workspace | Necessary to perform the contract |
| Subscription status, plan, Stripe identifiers, payment history | You, Stripe | Billing, taxes, fraud prevention, accounting obligations | Contract, legal obligation |
| Billing address and country | You, via Stripe | Calculation of applicable taxes | Legal obligation |
| Country; if you provide them: address and mobile phone number | You, at sign-up or on the Account page | Determining the applicable jurisdiction (taxes, consumer law); the phone number is kept for a possible future SMS channel — no SMS is sent today | Legal obligation, consent |
| Register of your communication consents (choice, date, surface) | You | Proof of consent required by Canada's Anti-Spam Legislation (CASL, s. 13) | Legal obligation |
| Confirmation that you are 18 or older (date, language, and confirmation screen) | You | Enforce adult-only access without collecting your date of birth | Contract performance, safety |
We never hold your credit card number. Payment processing is performed by Stripe, which acts as a separate controller for that information.
3.2 Usage and usage-billing information
Aggregate counters: number of tokens processed per period, per source (connected models or managed inference), per provider and per model; quota status; timestamps; idempotent event identifiers.
These counters contain no prompt text, no response, no tool arguments and no session identifier.
3.3 Content you entrust to your agents
Your messages, files, artifacts, memories, professional agent dossiers, scheduled tasks, configured secrets, and browser profiles.
Conversations, files, browser profiles, and local short-term memory are stored on the encrypted disk of the KVM virtual machine dedicated to your workspace. Durable memories you retain in Savantis Memory are stored in the central service under your account identity. None of this content is copied to the billing control plane, transmitted to another account, or published.
This content may include sensitive information if you provide it (health, finances, personal life). Provide only what is necessary, and bear in mind the restrictions in section 4.2 of the Terms of Use (no third-party information for which a business is responsible).
3.4 Technical and security logs
Operational logs using hashed account and tenant identifiers, error codes, performance metrics, security events. Message bodies, prompts, responses, authentication tokens and secret values are excluded from logs and redacted from diagnostics.
3.5 Push notifications
If you enable them: a browser subscription token and the short content of the notification. You may disable them at any time.
3.6 What we do not do
- Savantis does not use your conversations, files, or dossiers to train or fine-tune its models. A third-party route whose terms allow training can be used only after your separate consent; that provider's policy then applies to the content it receives.
- We do not sell your personal information and do not trade it for marketing purposes.
- We do not profile your behaviour for advertising. No identification, location or profiling function is activated by default (s. 8.1 of the private sector Act). The marketing site uses no advertising cookies or third-party trackers.
- The highest privacy settings apply by default (s. 9.1).
4. Providers and communications outside Quebec
The Service relies on providers that may process certain information outside Quebec. This exposes that information to the law of the country where the provider is located, including access requests by foreign authorities.
| Recipient | Information entrusted | Location or location category |
|---|---|---|
| Google Identity Platform | Email and identity proof needed to sign in | Global Google infrastructure |
| Cloudflare, Inc. | Network requests, IP address, opaque identifiers, account, subscription, consents, aggregate counters, and routing metadata | Global network |
| Vercel Inc. | Requests to the marketing site and application (IP address, user agent) | United States / global network |
| Stripe, Inc. | Name, email, billing address, payment method, and transaction history | Canada / United States |
| Savantis infrastructure | Dedicated virtual machine, local workspace state, and centralized durable memory | Available on request |
| Authorized managed-inference routes | Prompts, responses, and tool arguments needed by the model | Canada, United States, China, or an unestablished jurisdiction, depending on the route |
| Providers you connect (BYOM) | Content your agents send to them | Depends on the chosen provider |
Savantis-managed inference. Your requests pass through a private router to capacity operated by Savantis or a third-party provider. The router does not log prompts, responses, or tool arguments. The recipient provider may nonetheless process and retain them under its own policy. The catalogue changes; destination categories requiring your consent are displayed in the Service. The current provider list is available on request at support@savantisai.com.
Routes that require no consent may process requests in Canada or the United States. Two separate consents, off until you choose and withdrawable in Settings, may open other routes:
- providers established in China, subject to Chinese law, including access requests by its authorities;
- providers that may train on received content, or whose jurisdiction is unestablished and therefore cannot provide the same assurance.
Accepting one without the other is a valid answer. The Discovery plan currently requires both consents because its free capacity relies on those routes; paid plans retain managed-inference routes in North America when a consent is refused. A withdrawal affects the routes offered as soon as it is recorded. The date, nature, and surface of each choice are retained as evidence.
BYOM. If you configure your own provider, the content your agents send to it is governed by its terms and privacy policy, not by this policy. It is your responsibility to review them.
The privacy impact assessments required by section 17, agreements with all providers acting on our behalf (s. 21), the complete internal privacy-governance policy, and review by Quebec counsel are not complete. The operator has decided to defer this work until the Service generates material revenue. Savantis therefore does not claim that every communication outside Quebec already meets those requirements.
5. Automated decisions and artificial intelligence
In accordance with section 12.1 of the private sector Act:
- Certain functions of the Service rely on automated processing: quota enforcement, suspension of an agent for insufficient balance, scheduling the deletion of an inactive workspace, security filtering.
- No decision producing a legal effect concerning you is made exclusively by automated processing. Should that change, you would be informed at the time of the decision, with the personal information and the principal factors that led to it, and you could submit observations to a person able to review the decision.
- AI agents generate content that may be inaccurate or fabricated. That content is not a decision on our part.
6. Retention periods
| Category | Retention |
|---|---|
| Local content of your workspace | As long as the workspace exists. Deleted with the workspace's virtual machine. |
| Durable Savantis memory | Until you erase it or the account is deleted, subject to temporary copies needed for operations |
| Content sent to an inference provider | Under the recipient provider's policy and applicable settings |
| Inactive Discovery workspace | Deleted after 7 full days without activity |
| Account and subscription | Duration of the contractual relationship |
| Billing and tax records | As required by applicable tax rules (generally 6 years) |
| Aggregate usage counters | 24 months (default: 24 months) |
| Technical logs | 90 days (default: 90 days) |
| Confidentiality incident register | At least 5 years after the date we became aware of the incident (s. 3.8) |
Once the purpose is fulfilled, information is destroyed or anonymized in accordance with section 3.3.
7. Your rights
By writing to support@savantisai.com, you may:
- access the personal information we hold about you (s. 27);
- have it corrected if it is inaccurate, incomplete or equivocal (s. 28);
- obtain a portable copy of the computerized information you provided to us, in a structured, commonly used technological format (s. 27, para. 3);
- withdraw your consent and request deletion of your account and workspace;
- request that dissemination cease or that information be de-indexed in the cases provided by law (s. 28.1);
- file a complaint with the person in charge, then with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).
We respond within 30 days of receiving a request. A refusal is given in writing with reasons, including the available recourse and the time limit to exercise it.
8. Security
Measures in place: verified identity and Savantis session on every request; a dedicated KVM virtual machine per managed workspace; encrypted data disk with a tenant-specific key; separate network; no filesystem, Docker socket, volume, credential, or port shared with another virtual machine; outbound access denied by default except to imposed destinations; secrets stored in restricted-permission files (mode 0600), never sent to the browser; pinned and scanned runtime images; encryption in transit.
How separation works. The virtual machine and its disk separate each workspace's execution and local state. Durable Savantis memory is separated logically: the account reached follows from proven authentication, and no client parameter can name another one.
A limit you should know. The operator can technically access the hypervisor and administer the central memory service for operations and incidents. That access is restricted and is not used to read your data. Secrets connected from your own vault (1Password, Bitwarden) are not kept in the workspace — only their references are, and resolved values appear in no log, interface, or saved configuration.
No system is perfectly secure. As the Service is in beta, residual risk is higher than that of a mature product.
9. Confidentiality incidents
In accordance with sections 3.5 to 3.8, in the event of a confidentiality incident: we take reasonable measures to reduce the risk, we record the incident in a register, and if the incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information and the persons concerned.
10. Minors' information
The Service is not intended for persons under 18. Where a family workspace is used by a minor under the holder's supervision, the holder is responsible for supervising that use. Parental consent is required for the collection of information concerning a minor under 14.
11. Changes to this policy
Any change is published with a new effective date. A significant change is communicated to you by email or in the application before it takes effect.
Person in charge of the protection of personal information: support@savantisai.com. Other contact details are shared through direct contact, subject to a reasonable confidentiality agreement.