Privacy Policy

1. Who we are

PV0T OÜ (“PV0T,” “we,” “us,” or “our”) is a private limited company registered in Estonia (registry code 17468061, VAT number EE102970834), with its registered address at Järvevana tee 9, 11314 Tallinn, Estonia. We are the data controller responsible for your personal data under the General Data Protection Regulation (GDPR) and other applicable data protection law.

Contact us about privacy matters at contact@pv0t.com.

2. Scope

This Privacy Policy applies to pv0t.com and the PV0T application (together, the “Service”), including our AI assistant feature, FLCRUM.

3. What data we collect

We do not process or store your payment card details or tax identification numbers ourselves — billing is handled entirely by Polar (Section 7.1).

4. Our legal basis for processing

• Performance of a contract — account data, your content, and billing data, to provide the Service you signed up for.
• Legitimate interests — session/device data for account security; aggregated usage for improving the Service; cookieless, anonymous visitor counting (Section 6).
• Consent — analytics cookies (Section 6); you can withdraw consent at any time.
• Legal obligation — billing records we’re required to keep for tax purposes.

5. FLCRUM, our AI assistant

When you use FLCRUM:

• Your messages, along with contextual information from your account — your name, email, workspace role, subscription plan, recent performance statistics, active commitments you’ve mentioned, and (if connected) today’s Google Calendar events (title, time, and location) — are sent to OpenRouter, a third-party AI infrastructure provider, which routes the request to an underlying language model to generate FLCRUM’s response.
• This happens every time you send FLCRUM a message. FLCRUM does not retain memory with the model provider between requests — we resend your conversation history each time from our own records (or from your browser, if you’re using FLCRUM outside a workspace).
• FLCRUM can take actions in your account — for example, creating or deleting items and notes, updating your PV0T planner, or inviting a workspace member — but only when you explicitly ask it to. FLCRUM reads your Google Calendar events but never creates, changes, or deletes them. You remain responsible for reviewing what FLCRUM does on your behalf; every action it takes is visible in your account afterward.
• If you’re using FLCRUM inside a workspace, your conversations are stored on our servers (Section 9). Outside a workspace (“personal” mode), your conversation history is stored only in your browser and isn’t sent to our servers.
• We don’t use your conversations to train our own AI models. Every request to OpenRouter explicitly instructs it to route only to providers that don’t collect or train on your data — this isn’t just an account setting, it’s enforced on every individual request.
• FLCRUM is not a substitute for professional advice (legal, medical, financial, or otherwise), and its responses may be inaccurate. Please don’t enter highly sensitive information — such as government ID numbers, medical records, or financial account credentials — into FLCRUM; it’s built for productivity, not for handling that category of data.

6. Cookies

We don’t set analytics cookies until you’ve consented — the choice you make in the cookie banner takes effect immediately, before any cookie-based analytics script loads. This applies to pv0t.com’s public pages; the signed-in application doesn’t set any analytics or marketing cookies at all.

Separately, we count page views with Vercel Web Analytics, which works without cookies and stores nothing on your device. Visits are recognised only through a short-lived, anonymous hash of the request that is discarded daily, so it can’t follow you across days or across other websites. Because nothing is stored on or read from your device, this counting doesn’t depend on the cookie banner; we rely on our legitimate interest in understanding overall traffic (Section 4), and you can object at any time (Section 10).

7. Who we share your data with

We do not sell your personal data.

7.1 Payments — Polar and VAT

Polar acts as our payment processor and merchant of record for subscription purchases. When you subscribe, you’re redirected to Polar’s own checkout, where Polar collects your payment details directly — we never see or store your card details.

Prices are calculated based on your location and, where applicable, include value-added tax (VAT) or other transaction taxes required in your jurisdiction. Polar determines the applicable tax rate and collects it as part of your purchase price, remitting it to the relevant tax authorities on our behalf.

7.2 Google user data

PV0T’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data (your name, email address, and profile picture from Google sign-in; your calendar list and calendar events if you connect Google Calendar; and the name, link, and type of files you pick if you connect Google Drive) only to provide and improve the features you turn on: signing you in, showing your calendar in your planner, keeping your planner and calendar in sync, attaching Drive files to your tasks, and, when you send FLCRUM a message, giving it today’s events so it can answer. Keeping them in sync means that when you plan, move, rename, or delete a PV0T item that belongs to the calendar you chose for PV0T (“New items go here”), PV0T creates, updates, or deletes the matching event in that calendar; it never changes events PV0T didn’t create unless you edit them from PV0T yourself (for example, by moving one in the Planner). If you turn on the option to remove finished items from your calendar, PV0T also deletes an item’s event when you mark the item done. PV0T can only see the Drive files you pick, and we store only their name, link, and type, never the files themselves.

We do not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models. We do not transfer it to others except as needed to provide these features, for security purposes, to comply with the law, or as part of a merger or acquisition. We do not allow humans to read it unless you give consent, it is needed for security or abuse investigation, or the law requires it. Data sent to OpenRouter and its model providers is sent only to produce your response and is subject to these same restrictions.

8. International data transfers

Our database, authentication, and file storage (Supabase) are hosted in the EU (Frankfurt, Germany). Where a provider listed in Section 7 processes data outside the EU/EEA, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision, as required by GDPR.

OpenRouter is based in the United States. As a commercial customer, our use of OpenRouter is governed by OpenRouter’s Data Processing Agreement, incorporated by reference into our agreement with them, which itself relies on Standard Contractual Clauses for transfers outside the EU. Every request also independently restricts processing to providers that don’t collect or train on your data (Section 5); we’re additionally moving FLCRUM’s requests to OpenRouter’s EU in-region routing, which processes requests entirely within the EU, once that’s enabled for our account.

9. How long we keep your data

We keep your data for as long as your account is active. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we’re legally required or permitted to retain it — for example, billing records for tax purposes, or reports about you that another user has filed, which we keep in de-identified form.

Within an active account, items and conversations you haven’t used for a while are moved to the trash automatically, based on your subscription plan: items after 120 days on Free and 180 days on Pro (and on the earlier Growth and bundle plans), and 360 days on the earlier Scale plan; conversations after 30, 90 and 180 days respectively. Anything you still use or have planned is kept, and your analytics history is not affected. Items in the trash are permanently deleted 30 days later. You can see which of your items currently fall outside your plan’s window in Settings → Data & Privacy.

If you disconnect Google Calendar or Google Drive, we delete the stored access tokens immediately, along with your calendar settings for Calendar, and revoke PV0T’s access at Google once no other PV0T connection uses that Google account. We don’t keep our own copy of your calendar: events are read from Google when you need them, and the events FLCRUM uses are cached for at most 15 minutes. Events you chose to import into PV0T become your own items and stay until you delete them; planner entries you linked to an event keep only that event’s ID. Drive files you attached stay on your tasks as a name and link until you remove them. You can also remove PV0T’s access at any time from your Google Account.

10. Your rights

If you’re in the EU/EEA (or another jurisdiction with similar rights), you can:

• Access the personal data we hold about you.
• Correct inaccurate data — most of it directly in your account settings.
• Delete your account and data.
• Export your data in a portable format.
• Object to or restrict certain processing, including profiling.
• Withdraw consent for anything we process on that basis, at any time.

Exercise the first four rights directly from Settings → Data & Privacy. Your export covers your content, conversations, reports, workspaces, feedback, integrations you’ve connected, and account/session activity; it deliberately leaves out a small number of items for your own security (live connection tokens and session-security hashes), which the export file itself lists. For anything else, email contact@pv0t.com — we’ll respond within one month, as GDPR requires.

11. Automated decision-making

FLCRUM can take actions in your account, but only ones you explicitly ask for — it doesn’t independently decide to do something about your account without your instruction. We don’t use automated decision-making or profiling that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR.

12. Children’s privacy

The Service isn’t directed at, and isn’t intended for, anyone under 16. We enforce this age minimum when you create an account and if you later update your date of birth.

13. Security

We use industry-standard technical and organizational measures to protect your data, including encryption in transit, database-level access controls, optional two-factor authentication, and EU-based infrastructure with the security practices our hosting provider applies at the platform level.

14. Changes to this policy

We’ll post any changes here and update the “Last updated” date above. If a change is material, we’ll notify you by email or through the Service.

If we change how PV0T uses Google user data (Section 7.2) — for example, to use it for a new purpose — we’ll update this policy and notify you by email before the change takes effect, and we’ll ask for your consent where the change requires it.

15. Contact us