Privacy policy

Updated October 11, 2026 · Applies to neurvona.com, neurvona.ai, and the Neurvona apps.

Neurvona, Inc. operates this service. Contact brett@neurvona.com for privacy, deletion, or support requests, and abuse@neurvona.ai to report spam or abuse. You can also download your data or delete your account yourself under Autopilot → Advanced → Delete account, on the website or in the app. Do not send payment credentials or API keys by email.

Google user data

This section applies to information received from Google APIs and information derived from it. Neurvona uses this information only to provide or improve the user-facing features you choose in Neurvona. Connecting Google does not enable autopilot. Google sign-in requests basic profile information only. You can then choose Gmail, Calendar, Docs and optional background sources in one Google tools connection; inbox access and extra sources are optional. We use only the selected permissions Google grants.

What we access and why

Google sign-in: your Google account identifier, verified email address, name, and profile photo. We use them to authenticate you, associate your workspace and credits with your account, display your name and avatar, and deliver account, security, purchase, and requested activity notifications. Signing in does not provide access to your Gmail messages.
Gmail sending: your connected mailbox identity, granted permissions, verified sender addresses when available, and the message and thread identifiers returned by Gmail. With the Gmail send permission, we send from your connected mailbox after you approve specific email drafts or explicitly enable continuous autopilot for newly generated emails within your saved controls. Sending also requires your explicit Gmail autopilot approval. Your approved recipients, email subject, body, and sender footer are sent to Gmail to deliver the message.
Gmail inbox access: when you separately enable read access, we access message and thread identifiers, sender and recipient information, subjects, dates, and message text. Refreshing the inbox imports up to 20 recent messages for you to view and choose for a reply. If you explicitly enable continuous inbox replies, we refresh these recent messages in the background and consider nonautomated inquiries received after activation for a reply in the same conversation. Ongoing outreach and follow-ups also read them in the background to find bounces, opt-outs and replies to that outreach; without continuous inbox replies, no copies are kept. Read access also lets us check delivery receipts, detect matched bounces and opt-outs, stop a follow-up when its conversation has a newer message, and record when a recipient first replied to a sent email (the time only, never the text) for your campaign’s reply count. We do not modify or delete messages in your Gmail mailbox.
Optional Gmail writing samples: if you choose this information import, we read up to ten of your sent messages to provide editable writing-style samples. We trim quotations and remove email addresses and links from the saved samples. These samples are inactive until you approve them and are used for tone and style, not to disclose private correspondence in public content. Samples imported with Google tools are deleted when you remove Gmail or inbox access; samples from an older import connection are deleted when you disconnect it.
Google Calendar tools: if you enable Calendar, we access calendar names, identifiers, timezones and access roles to let you choose a calendar. When you ask for your schedule or choose an event to edit, we access the relevant event identifiers, titles, start/end times, descriptions, locations, attendee email addresses and version identifiers. We create, reschedule, edit or cancel individual events only after you review and approve the exact change. Google may notify the displayed attendees of an approved change. Connecting Calendar does not start background scheduling or grant calendar sharing or access-control permissions.
Google Docs tools: if you enable Docs, we read the document you identify by link or ID, including its title, text, tabs and revision identifier. We create private documents, append text or replace exact text in the first tab after your approval. Edits are bound to the reviewed document revision. We do not automatically search or import all of your documents, change sharing permissions or publish them. Document content is used for the requested document feature; it does not become approved public-writing background automatically.
Optional Google Drive import: titles and bounded text from up to eight recent documents you own, to supply background you can review and approve for your twin’s writing.
Optional Google Calendar import: titles and descriptions from up to 30 primary-calendar events within the preceding 90 days and following 30 days, to supply background you can review. This import does not collect attendee lists, meeting links, locations, or exact event times.
Optional Google Contacts import: organization departments, professional titles, occupations, and interests from a bounded selection of up to 100 connections, to suggest broad professional context. This import does not collect contact names, email addresses, or phone numbers.
Optional YouTube import: your channel titles and descriptions and up to 30 subscribed-channel titles, to supply interests you can review and approve.
Optional Google Tasks import: list titles and the titles and notes of open tasks from up to five lists and 20 tasks per list, to supply project context you can review and approve.

We request optional permissions when you choose the relevant feature and use only the permissions Google grants. Calendar/Docs tools and their change previews appear in Google tools. Imported information is shown in Your information for review. New imports remain inactive until you enable them. You can prepare drafts without granting mailbox access.

AI processing and sharing

When you request AI writing, or explicitly enable an autopilot that uses your approved information, Neurvona sends the selected message or enabled information excerpts, your instructions, and relevant saved context to OpenAI through its API to generate the requested draft or reply. This processing supports your chosen Neurvona feature; manual drafting does not call an AI provider. OpenAI Responses are requested with storage disabled. We do not opt your content into model training. OpenAI’s API abuse-monitoring retention may still apply.

Cloudflare hosts Neurvona and stores account-scoped data and encrypted connection credentials. Google receives approved outgoing emails for delivery and approved document/calendar changes for execution. Your approved email recipients receive the messages you choose to send; calendar invitees may receive Google’s event notifications as shown in the review. If you explicitly approve background for writing on another connected service, relevant context can inform the draft you review or the autopilot you approve on that service. Your own authorized API keys and paired agents can access the saved information needed for the features you enable; keep those credentials private.

Public contact research sends your chosen audience and instructions to Tavily and xAI/Grok. It does not search your private Gmail inbox. We do not send raw Gmail messages to public-search providers. Stripe receives the account and payment information needed to fulfill a purchase; Gmail content and imported Google documents are not used for payment processing.

Limited Use

Neurvona’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. These restrictions apply to raw Google user data and information derived from it.

We do not sell Google user data, transfer it to data brokers, use it for advertising, retargeting, or interest-based targeting, use it to determine creditworthiness, or use it to train, fine-tune, or improve generalized AI or machine-learning models. Product sales, paid promotion, and other commercial features described elsewhere in this policy do not authorize those uses of Google user data. Transfers are limited to providing your chosen visible features with your consent, protecting security, or complying with applicable law. Any transfer in a business ownership change requires your prior explicit consent.

Our personnel do not read Google user data unless you affirmatively authorize access to specific data for support, access is necessary to investigate security or abuse, or access is required by law.

How we protect sensitive data

We use HTTPS/TLS for communication with your browser, Google, and our processing providers. Cloudflare D1 encrypts stored data at rest. Google access and refresh tokens receive additional application-level encryption; Gmail and optional-import credentials use AES-256-GCM with account-specific context. Encryption keys and provider secrets are stored server-side, separately from the database, and are not exposed to other users or to paired agents.

Authenticated sessions and account ownership checks restrict access to your workspace, imported messages, drafts, and connection controls. Production session cookies use Secure and HttpOnly protections. OAuth state, expiring connection requests, and PKCE for Gmail connections protect the connection flow. Write requests check their origin, and rate limits restrict repeated requests. Private workspace responses are marked no-store. Connecting an account does not grant permission to send or publish; specific draft approvals or explicit continuous autopilot approval with saved limits are required for delivery.

Storage, retention, and deletion

Account information, granted scopes, encrypted connection tokens, imported text, email drafts, approval records, delivery identifiers, and research progress are stored in Cloudflare D1 under your account. Calendar/Docs change previews include the requested content or event fields, account and version identifiers, approval state and returned result identifiers so a retry does not repeat a write. Read results appear in your private workspace; when requested by text, a bounded excerpt may also be retained in your private conversation. A daily job deletes imported inbox copies 30 days after each message arrived, except a message that a reply draft waiting for review or sending still needs. Reviewed information, drafts, Google action records and sent-message history otherwise remain until you remove them through available controls or delete your account, which also revokes Neurvona’s Google access.

Disconnecting all Google tools deletes the shared tool connection tokens, pauses Gmail sending, cancels pending Google changes and removes background sources imported through that connection, along with inbox copies. It keeps your separate sign-in, saved drafts and action history, and does not delete documents or events in Google. Removing only Gmail disables mailbox access in Neurvona and pauses sending while retaining the credential for other selected Google tools. Removing Gmail or inbox access deletes inbox copies and the Gmail writing samples imported with Google tools at once, and switching off or pausing continuous inbox replies in their controls, or pausing your twin, deletes inbox copies, in each case except a message a waiting reply draft still needs. Disconnecting an older optional information-import connection deletes that connection’s saved tokens and imported sources. You can remove individual information sources, clear unsent drafts, revoke Google access in your Google account, or request removal of retained Google user data or your Neurvona account at brett@neurvona.com. Revoking access stops future authorized API access; it does not automatically erase previously saved content. See data deletion instructions.

Deletion removes data from active application storage. Encrypted infrastructure backups keep it for up to 30 days. Necessary payment, consent, security, and suppression records may be retained to meet accounting, legal, and opt-out obligations; after an account is deleted they keep no Google data.

Your twin and agents

You can sign in with X or Google. Google-only accounts can use email twins and developer tools. A secure session cookie keeps you signed in. X sign-in supplies your stable account ID, display name, handle, public bio, and profile links; it requests read access to your profile and posts only. Posting and refresh access are requested separately, when you choose Allow posting for X autopilot, and can also request confirmed-email access; neither starts automatic posting. We do not read X direct messages. OAuth tokens are encrypted in storage. We store your account ID, twin profile, X handle, product documents, drafts, agent connections, and transaction records. Your paired agent can read your profile, products, drafts, and sales context. It can create drafts but cannot publish or approve payments. Agent credentials are hashed in our database. Pairing codes expire after ten minutes; connections expire after 30 days and can be revoked in your workspace.

In manual review mode, X receives draft text when you open its composer. In an enabled autopilot mission, Neurvona sends generated posts or selected reposts directly through X’s API. We do not collect your X password. Posting and refresh tokens are stored encrypted separately from ordinary sign-in. Your selected mission, limits, and authorization are recorded. Only X’s authenticated account information verifies account ownership.

Automatic preparation from X

After you connect X, Neurvona caches the public bio and links returned during sign-in to prepare your editable twin and suggest a mission. After you approve paid preparation with prepaid credits, it can read up to 20 recent original posts. Advertising credits are not required. Neurvona processes this material with Sol 6.1 Max through its OpenAI account to prepare private profile and post drafts within your approved credit budget. API keys are stored only as one-way hashes. API requests, usage, and credit purchases are recorded to run billing, limits, and security. Text you send to the post-generation API is processed by OpenAI to write drafts. If you purchase an AI writing sample, the goal, facts, and saved profile you provide are sent to OpenAI the same way; samples stay private and are never posted. Without an active plan, the profile and mission are prepared from available X profile information without a paid AI call. Replies and reposts are excluded. You may provide your own description instead. Profile auto-fill does not import direct messages, your home feed, followers, or another account’s posts. We do not use this content to train models.

Imported post bodies are processed for the request and are not retained as a separate dataset. We retain the number of posts used and generated drafts. A preparation record prevents repeated imports on every visit. We also look for LinkedIn and Instagram profile links in your X profile and the public website linked from it. We save candidate URLs and their source for you to confirm or reject; candidates are not verified identities or account connections. Older import records may also contain source post IDs. Your paired agent can read the resulting drafts and profile, not an archive of imported posts. Auto-fill does not publish, change your X account, or make payments. You review generated content before sharing it. Product sales do not permit selling Google user data or private correspondence. Request removal of imported-source records or derived drafts at brett@neurvona.com.

OpenAI processes supplied posts or descriptions, approved profile context, and generated drafts under its API terms and data policy. Neurvona uses Sol 6.1 with Max reasoning and disables stored Responses. OpenAI does not use API inputs and outputs for training unless the customer opts in; abuse-monitoring logs may be retained for up to 30 days. Neurvona does not opt your content into training.

Autopilot data and receipts

When enabled, autopilot uses your saved profile, mission, public facts you supply, and recent activity to generate posts through OpenAI. It can read up to 20 of your own recent posts with public engagement counts to estimate timing, search up to ten recent posts for a selected repost topic, or read up to five recent mentions for private reply suggestions. Source material is untrusted and cannot authorize actions. Direct messages, likes, follows, and private conversations are not imported.

We store mission settings, consent version and time, action text and source IDs, X confirmation IDs, usage reservations, and email delivery status. Raw search or mention feeds are not kept as an archive; chosen action text and source IDs are retained in your activity. Cloudflare delivers verification codes and activity emails. You can pause or disconnect autopilot in the workspace. Deleting your account deletes stored activity and source records; you can also ask support.

Neurvona emails your account at one notification address: by default the address Google verified when you signed in or connected Gmail, an address already confirmed by X or verified for X autopilot, or another address you confirm with a code under Autopilot → Advanced → Notifications. Changing it needs a recent sign-in, and we email the address it replaces. That address receives security notices (accounts combined, API keys created, Gmail sending connected, the address changed), posting receipts, heads-ups you turn on, and, unless you turn them off, notices when drafts are ready or waiting for your review, an autopilot pauses, credits run low or connections are about to end.

LinkedIn, Instagram, and a paired Mac

When configured, connecting LinkedIn or a professional Instagram account grants the displayed profile and publishing permissions. We verify the provider account identity and store its account ID, display name, permission status, and encrypted access token in Cloudflare D1. Instagram access may be renewed while the connection remains active. Connecting an account does not start publishing. You approve each LinkedIn post before it is published, because LinkedIn does not allow automated posting. Instagram and iMessage deliver only drafts you approve, or new content within continuous autopilot controls you approve, after you explicitly start that account.

These channels store your mission, draft text, Instagram media URLs, approvals, provider post IDs, and activity status. Publishing sends an approved draft to LinkedIn or Instagram. Instagram retrieves the public media URL you supply to create a photo or Reel; use only media you have permission to publish. These connections do not import private messages or send direct messages or connection invitations.

Pairing a Mac stores a hash of its separate connection credential, a device label, expiry, and last connection time. Website iMessage drafts include the recipient, message, approval, and submission status. The companion keeps its credential and recipient allowlist locally. It does not read your Messages history or Contacts. Pairing and checking the connection do not authorize sending; sending additionally requires the integration to be available, your approved queue, explicit activation, local recipient permission, and Apple’s Messages permission.

Disconnecting these channels removes their active credentials and pauses new work. Drafts and activity remain in your account; a request already submitted to a provider may finish. You can also revoke access with the provider. See data deletion instructions to request removal of your account or retained content.

Continuous autopilot

Gmail, LinkedIn, Instagram, and paired-Mac iMessage can keep generating new content after you explicitly approve continuous autopilot. Your shared purpose, enabled background, optional account instructions, selected recipients or media descriptions, and relevant recent draft text are sent to OpenAI for each writing check. Gmail replies also include the new inquiry text. Your selected contact addresses, media links and descriptions, settings, approval time, draft provenance, credit receipts, and activity status are stored under your account in Cloudflare D1. The cloud receives the iMessage recipients you explicitly enter here; your Mac’s full local allowlist and Messages history are not uploaded.

You choose automatic delivery within your saved controls or approval of each draft. LinkedIn posts always need your approval of each post. Daily credit and delivery limits, cadence, and an optional delivery pause apply. Writing checks may use credits even when they skip, need review, or fail after starting. Gmail outreach research uses public professional sources, and Instagram uses each supplied photo or Reel once. Uncertain delivery is not retried automatically. Pausing stops new writing and delivery; already submitted provider requests may finish. Changing your purpose, account, or controls requires renewed approval.

Review links and native messages

Heads-up emails contain a private, expiring link. An X heads-up link controls one pending post. A Gmail batch heads-up, which you can turn on under Notifications, lists the recipients and subjects of the emails queued in that batch, and its link, which works for 24 hours, can cancel one or all of them or pause ongoing Gmail autopilot without signing in. Anyone with an X heads-up link can view the draft and edit, skip, or pause it while eligible. We store a hash of each control token, its expiry, and notice status. Opening a link never changes a post. X post edits generate a new link and review window. You may reply with SKIP, PAUSE, or EDIT: followed by replacement text from your verified notification email. The private reply address expires with that review window.

Native app message drafts, explicitly allowed recipients, limits, and submission status are stored in the app’s local outbox on your device. We do not read your Messages history or Contacts. Mac delivery uses Apple’s Messages app after OS permission and your local opt-in. iPhone and personal WhatsApp delivery use the platform composer. Delivery status may be unknown. Local notifications may show a recipient and a message preview according to your notification settings. Website drafts copied into the app become local drafts; this does not authorize sending.

Talking to your twin

We retain instructions and replies from the console and any bot channel you connect so you can see their history. SMS uses Twilio, which processes your phone number and message content. OpenAI processes natural-language instructions, recent messages in your twin conversation, your account-control summaries, and approved background to interpret commands or write private drafts. Neurvona records requested setting changes, time-limited approvals, usage charges, and SMS delivery receipts. A text note you explicitly ask your twin to remember becomes owner-approved background across your accounts. Connection credentials are never included in these AI requests. We do not use your messages to train models. Phone destinations and private email control addresses are encrypted; pairing codes and lookup identifiers are hashed. SMS consent is separate from purchase and recorded with its time. We do not sell or share mobile opt-in information with third parties for marketing. We share it only with providers needed to deliver the service. Text STOP or disconnect in your console to revoke SMS access.

The email bot accepts instructions only at your private control address from your verified notification email. Keep this address private. Bot commands use your saved permissions and limits; draft requests share the purchased service credits and may send the supplied context to OpenAI. We do not import personal text history. Optional Google imports are described below. Clear history permanently deletes the text of finished messages and replies, along with the request and reply saved in the credit receipt of each instruction the AI interpreted; disconnecting SMS or the email bot, or texting STOP, does the same for that channel. Each message’s time, channel and status, and each receipt’s charge, stay for usage limits, receipts and duplicate protection. Clearing skips requests that are still running.

Your twin’s photo

If you choose a custom profile photo, your browser creates a smaller square JPEG before uploading it. We store that photo in private Cloudflare R2 storage and its account ownership in D1. Image metadata is removed. Your original upload is not retained by this feature. Only your signed-in account and authorized API keys can retrieve the saved image. You can replace it or return to your X/default photo on My AI Twin; the previous image is removed from active storage. This feature changes your photo on Neurvona.

Optional persona sources

You can save notes and extracted document text as private persona sources. PDF and text extraction happens in your browser; original files are not stored by this text-upload feature. New imports remain inactive until you approve them. Enabled excerpts are sent to the writing provider as context. Review them before allowing public writing; generated posts may reveal approved facts.

Optional Google access uses Google’s own consent screen. Only granted permissions are used. Imports are bounded samples, not a complete Google archive: your sent-mail writing samples, recent owned documents, primary calendar context, broad professional contact context, YouTube profile and subscriptions, and open tasks. The optional Gmail writing-sample import uses sent-mail excerpts for writing style; separate Gmail workspace permissions support the email features described above. LinkedIn imports basic profile information; Facebook and professional Instagram import supported profile/post data when their integrations are approved and configured. No Outlook connector is provided.

Provider access and refresh tokens are encrypted with account-specific context. Imported text is stored in Cloudflare D1 under your account. Disconnect deletes the saved connection tokens and its imported sources. You can also revoke the provider grant in its settings. Your API keys can read your saved source text, so share keys only with trusted integrations.

AI usage and old connections

Neurvona uses its own server-side OpenAI key for writing and xAI key for research and supported media services. You do not need to provide an AI key. We store request IDs, request hashes, billing periods, provider usage costs, credit reservations, and generated results to enforce allowances, prevent duplicate charges, and show your balance. Paired agents cannot read our provider key or spend your subscription allowance or build balance.

If you saved a personal AI key in an earlier version, it remains encrypted, is no longer used, and can be deleted under “Remove your old AI key” in your workspace. Disconnect deletes it from the active database; infrastructure backups may retain encrypted records for their normal retention period. You can also revoke it in the provider’s console.

Products and payments

Product descriptions become public when you publish. The full document is shared with you, your paired agent, and buyers with a verified paid receipt. Receipt links grant access to the purchase; keep them private. Stripe holds card details and verifies seller identity. We store connected-account IDs, subscription customer and invoice IDs, billing periods, payment IDs, credit balances, automatic top-up settings and consent, payment attempts, amounts, fees, refunds, and immutable copies of purchased documents for fulfillment.

Email twins and Gmail

Connecting Gmail is an explicit Google permission step separate from sign-in and persona imports. You choose sending and/or inbox access on Google’s screen. We store the verified Google account ID, mailbox and accepted send-as addresses, its Google Workspace domain if it has one, granted scopes, and encrypted access and refresh tokens in Cloudflare D1. Gmail messages are sent only from a verified connected address after you approve specific drafts or explicitly approve continuous writing and delivery within your saved controls. We store mission settings, prospect business contacts and their public sources (and, for an imported list, where you said it came from), drafts, approvals, sending states, when a recipient first replied (the time only, never the text), and Gmail message/thread IDs.

Refreshing the inbox copies up to 20 recent messages into your private workspace. A daily job deletes each copy 30 days after the message arrived. Copies are deleted at once when you disconnect Gmail, remove inbox access, disconnect Google tools, switch off or pause continuous inbox replies in their controls, or pause your twin. A copy stays while a reply draft to it is waiting for review or sending, because sending the reply in the same conversation needs it; the usual rules apply again once that draft is sent or deleted. Paid AI writing sends the selected inquiry or prospect context, mission, saved profile, and approved persona sources to OpenAI to produce a draft. Writing is optional: you request an individual draft or explicitly approve ongoing writing. Continuous inbox replies use only new nonautomated inquiries received after activation. Manual drafting does not invoke an AI provider. Your Gmail content is not used to train or improve generalized AI models, sold, or used for advertising targeting. Neurvona’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use requirements.

When you request prospect research, your chosen business audience, mission, and sender name go to Tavily and Grok to find publicly listed business contacts. Selected public source context and approved sender information go to OpenAI to prepare tailored draft introductions. We save public source links, brief evidence, relevance, contact details, drafts, and progress privately in your account. This research does not use your private inbox or business mailing address. Your account and authorized API keys can review and control these drafts. Email contents and public research are treated as untrusted input, never sending authorization. Business outreach emails include the sender’s business address and an unsubscribe link; job-search and recruiting emails include the sender’s name and an unsubscribe link. Suppression records are retained to honor opt-outs. Each opt-out, and each address Gmail reports does not exist, is also kept as a keyed hash of the address, never the address itself, so outreach to that person can stop across Neurvona: an address that opted out from two accounts, could not receive email, or chose to stop outreach from everyone on an unsubscribe page gets no further outreach through Neurvona. With inbox access, a reply to outreach that asks to stop is honored as an opt-out when the inbox is refreshed, which every ongoing Gmail check does; a check without continuous inbox replies reads recent messages for bounces, opt-outs and replies without keeping copies. There are no open-tracking pixels. A recipient can also report an email as spam or abuse from its unsubscribe page: that unsubscribes them from the sender and keeps a report with the sending account, naming the email and holding a keyed hash of their address, never the address, for Neurvona to review. What Google, X, LinkedIn or Instagram refuse when your twin sends or publishes is kept with your account as the provider’s status code, never the message. Neurvona may put an account on hold or suspend it to investigate spam or abuse; it keeps a record of each change and its reason, and emails you each time. Disconnect Gmail to remove the mailbox grant, pause queued sending, and delete inbox copies and the Gmail writing samples imported with Google tools; this preserves your sign-in, drafts, and delivery history. Revoke provider access in your Google account or contact brett@neurvona.com to request deletion of retained content. Transaction and necessary suppression records may be retained.

iPhone companion

The iOS 27 companion uses your Neurvona account for the same cloud autopilots and credit controls as the website. Native Messages and WhatsApp drafts, device action history, selected contact details, calendar events, and reminders remain on your device and in your own Apple accounts. They are not automatically uploaded to Neurvona or its AI providers. Apple’s contact picker shares only the phone number or email you choose. Calendar, Reminders, and AlarmKit request permission when you use those features; manage or revoke access in iOS Settings. Messages opens Apple’s composer and requires you to send. Siri and Shortcuts prepare actions for review. A configured widget or named shortcut runs your chosen Apple Shortcuts action under its own permissions. Files or photos you separately upload through Your information follow the upload and provider terms below.

Token payments

If you pay with NEURVONA, we store your account-linked quote, receiving wallet, token amount, price, credit quantity, timestamps, payment reference and transaction signature in Cloudflare D1. Solana transfers and wallet addresses are public blockchain records. Your wallet shares its public address to prepare the transaction; no private keys or seed phrases are collected. Our server queries DEX Screener for the public token price and a Solana RPC provider to verify payments. Payment records are retained for fulfillment, accounting and support.

Boosting requests

If you request paid boosting, we record your verified X account ID, handle, permission version, time, and request status. We may share the handle, account ID, and permission with X to request promotion access. A request is not an advertising approval or payment authorization. You can withdraw it in your boost controls; withdrawal pauses promotion. For enabled boosts, we read recent original posts and organic engagement counts, then send a bounded selection with your mission and brief to Grok. We retain recommendations, post IDs, spending limits, consent, campaign IDs, delivery results, and credit charges. Stripe settlement records verify the USD funds available for advertising.

API tools

Upstream bearer tokens and cached API results are encrypted at rest. Buyer payment tokens go to Stripe and are not stored in our application database. API input goes only to the seller’s configured upstream; we retain its hash for duplicate protection, not its body. Cached results expire after 24 hours and are removed at the next cleanup, which runs at least daily.

Providers and retention

Google user data remains subject to the Google user data and Limited Use restrictions above; the descriptions of other features do not expand its permitted uses.

Cloudflare hosts the application, stores its database and files, and delivers notification, verification and autopilot emails. Cloudflare processes your IP address to route and protect requests. Neurvona’s sign-in sessions store your browser or app description, not your IP address. Stripe processes payments. The configured AI providers process the context needed for the features you choose, subject to the Google user data restrictions above when that context includes Google data. Rate limits store a keyed hash of your network address, never the address itself. We use no advertising trackers and do not sell your product contents.

Profiles and drafts remain until you delete them or your account. Transaction and fulfillment records may be retained for accounting, refunds, and legal obligations. Disconnect agents and pause products from your workspace. Delete your account under Autopilot → Advanced → Delete account, which needs a sign-in from the last 10 minutes. It signs you out everywhere at once, stops every autopilot, ends your API keys and connected devices, cancels your plan, revokes Neurvona’s Google and X access, and then deletes your records, files, saved voice and video avatar, the last two at Cartesia and Anam too, usually within minutes. Unused credits end with the account. Payment, credit and usage records (amounts, Stripe and token payment references, and what was charged), keyed hashes of the opt-outs your recipients sent, which still count as one account’s opt-outs on the Neurvona-wide list described above, and a keyed hash of the sign-in account that received starter credits are kept without your name, email address, content or account ID. Unsubscribe links in emails you sent keep working for 30 days after each email, holding only a keyed hash of the address, and a document a buyer bought from your storefront stays available on their receipt. A new account starts with an empty opt-out list. Download your data from the same place first if you want a copy; it includes your opt-out list.

Service providers

These providers process personal data for Neurvona, only for the features you use:

Cloudflare: hosting, database and file storage, request logs, and sign-in and notification email.
Stripe: checkout, subscriptions, credit purchases and seller payouts.
OpenAI: drafts, replies, profile preparation and the instructions you send your twin.
xAI: research and boost recommendations with Grok, and transcription of uploaded recordings, and the check that a personal voice recording says the words shown.
Tavily: web searches for research.
Twilio: text messages with your phone.
LiveKit: live calls, generated clips and X streaming. LiveKit Inference uses AssemblyAI for speech recognition, Google’s Gemma model for replies and an xAI voice when you have not saved your own.
Cartesia: your personal voice.
Anam: your video avatar.
PublicNode: checks NEURVONA token payments on the public Solana network. DEX Screener, GeckoTerminal and Coinbase supply public prices and receive no personal data.

Services you connect, such as Google, X, LinkedIn and Instagram, receive what you approve for them and follow their own policies.

How long we keep data

A daily job enforces the time limits below. Encrypted infrastructure backups keep deleted data for up to 30 days.

Data	Kept
Gmail inbox copies	30 days after the message arrived. Deleted at once when you disconnect Gmail, remove inbox access, disconnect Google tools, switch off or pause continuous inbox replies in their controls, or pause your twin. A copy stays while a reply draft to it is waiting for review or sending.
Imported sources and notes	Until you remove them. Disconnecting the connection that imported a source deletes it. Gmail writing samples imported with Google tools are also deleted when you remove inbox access.
Email drafts, sent history and saved contacts	Unsent drafts until you delete them. Sent history until your account is deleted. A saved contact you emailed goes 180 days after your last email to them, once nothing more is on its way; keyed hashes of the address and of its company’s domain stay so research does not find them, or someone else at their company, again. Other saved contacts stay until you delete them or your account.
Email notification log	90 days after each email is final: its kind, outcome, provider message ID and error code, and a keyed hash of the address, never the address or the message. A notice to an address you replaced keeps that address encrypted until it is sent, for at most three days.
Gmail batch heads-ups	30 days after the batch is final.
Notification settings	Until your account is deleted: the address you confirmed, the kinds of notice you turned off, and an address waiting for its code, until the code is confirmed or a new request replaces it.
Opt-out records	As long as needed to keep honoring the opt-out.
Spam reports, account holds and suspensions	As long as your account exists, and afterwards without your name, email address or account ID, so a suspension and the reports behind it still count. Provider refusal codes go with your account.
Conversations with your twin	Until you clear history, disconnect SMS or the email bot, or text STOP, which also deletes the request and reply saved with AI instruction receipts. Each message’s time, channel and status, and each charge, stay.
Sign-in sessions	Until you sign out, or 7 days without use. Sessions store your browser or app description, not your IP address.
Connection, app sign-in and pairing requests	Expire after 10 minutes and are deleted within a day.
Rate-limit counters	48 hours after their last use; sign-in counters 24 hours. They store a keyed hash of your network address, never the address.
Visit analytics	90 days. Account milestones stay with your account.
Private generated recordings	30 days.
Cached paid API results	24 hours.
Personal voice and video twins	Until you remove them in Manage my voice or Manage my video twin, or delete your account; either deletes them at Cartesia or Anam too. A video twin made from an earlier X photo stays until you remove it. Neurvona does not keep the voice recording itself. Your consent record (its version and time, and hashes of the words you read and of what the check heard) stays with the voice or video twin record until your account is deleted.
Your account	Until you delete it. Deletion signs you out at once and usually finishes within minutes.
Payment, credit, consent and security records	As long as accounting, legal and opt-out obligations require. Once your account is deleted they keep no name, email address, content or account ID.

Research, transcription, and live media

When you ask your twin to research you, we send your account name, your connected X handle and public bio, and any professional context you add to Tavily for web search and to xAI’s Grok to summarize what it finds. Saved findings include source links and require your review before use in public writing. This research looks up only you, the account owner. Gmail prospect research, described above, is separate: it finds publicly listed business contacts for an audience you describe.

For a recording you upload, only the first ten minutes of audio, without the file name, are sent to xAI for transcription. Neurvona stores the resulting text, not the original upload. Provider retention and processing terms also apply; do not upload recordings without permission.

Live voice and video run through LiveKit. During a live call, LiveKit Inference converts your speech to text with AssemblyAI and writes your twin’s replies with Google’s Gemma model. Your twin speaks with an xAI voice unless you saved a personal voice, which uses Cartesia; video twins always use your personal voice and appear through Anam. A video twin is made only after you confirm that your X profile photo shows you and that you are 18 or older. Choosing one authorizes sending the full-size public photo from your connected X profile to Anam to create a personal AI avatar. Anam stores the source and generated avatar. Neurvona stores the photo URL, X account ID, avatar ID, creation request, and the version and time of your confirmation, linked to your account, and reuses that avatar for your sessions. A changed X photo can create another version. Use Manage my video twin to remove any version: it stops being used at once and is deleted at Anam, source photo included, and Neurvona keeps only its X account ID and your confirmation. Deleting your account deletes these records and the provider avatars. Your photo is not used to clone your voice. For a personal voice, you read aloud words Neurvona shows you, ending with check words chosen at random, then review the recording and confirm that it is your own voice. Recording and retakes stay in your browser until you choose to save. Saving sends the recording to xAI, which transcribes it so we can check that it says those words, and only then to Cartesia to create a private voice; a recording that does not match goes no further and costs nothing. Neurvona does not retain the raw recording; we store the provider voice ID, a hash of the recording, hashes of the words and of the transcript, its duration, consent version and time, setup status, and billing records in D1. xAI and Cartesia process the recording under their own service terms, and Cartesia keeps your voice until it is deleted. Generated speech for your twin is sent through LiveKit and, for video, Anam. Every downloadable clip starts by saying that it is AI-generated. Use Manage my voice to request provider deletion and stop future use; end active calls first. A removal the provider does not confirm at once is retried until it does. Deletion does not erase prior recordings or accounting and consent records. Approved background is provided to the agent for the session. Session tokens are short lived; job context and provider credentials are encrypted. Private generated recordings are stored in Cloudflare R2 for up to 30 days and are accessible only to the account owner. A live session is not recorded by Neurvona unless the owner requests a recording. X streaming sends the session to the owner’s explicitly authorized Producer source.

Payments use Stripe’s embedded checkout. Neurvona does not store full card numbers. Account records, credit ledgers, persona text, and settings are stored in Cloudflare D1; source text is available to the account’s API keys. You can disable or remove sources and disconnect imports in Your persona. Canceling an unsent email or clearing drafts permanently removes its message content from active draft storage and any legacy AI result copies. Sent email history, saved contacts, suppression records, and credit receipts remain. Delete your account under Autopilot → Advanced; payment and audit records stay without your details.

Product analytics

We count setup and usage milestones, including registration, connected services, research runs, first drafts, approvals, first sent emails and published posts, credit purchases, autopilot activation, and paid subscriptions. Account milestones are linked to your internal account ID. Registration also notes which sign-up button you used and, when the page that brought you had them, its campaign tags (utm_source and utm_campaign) and the referring site’s domain. Visit counts use a random ID stored for the browser tab; the server stores only a keyed hash, with the same button, tag and domain labels, and deletes visit records older than 90 days. These records contain no prompts, email addresses, message or document content, OAuth credentials, or payment details. The site owner can view aggregate counts to improve setup and usability. Analytics does not enable services or change your settings.