PRIVACY POLICY

Last Updated: 17 September 2026

1. General Information

We take the protection of your personal data very seriously. This Privacy Policy informs you about how AsIfThatWorks & ThatsBuiltByPham by Ký Anh Pham ("we", "us", or "asifthatworks") collects, uses, and protects your data when you use our SaaS platform and our AI agents (Jarvi, Grim, Murphy, Lexis, and Chronicles).

Controller: AsIfThatWorks & ThatsBuiltByPham by Ký Anh Pham
Brückenstraße 12, 12439 Berlin, Germany
Email: support@asifthatworks.com

2. Data Collection and Purposes

We process personal data only as far as necessary to provide a functional website and our services (Art. 6 para. 1 lit. b GDPR).

• Account Data: Name, email address, phone number, and authentication data.
• User Content: Preferences, goals, personal notes, milestones, and voice memos.
• Contextual Data: Location data and time zones.
• Integration Data: Data from Google Calendar and Google Tasks (if connected).

2b. Messaging Platform Data

Jarvi operates across multiple messaging platforms. When you interact with Jarvi through any of the following platforms, we collect and process:

Telegram:
• Your Telegram user ID, username, and display name.
• Message content you send to the Jarvi bot.

Facebook Messenger:
• Your Page-Scoped ID (PSID) as provided by Meta.
• Your display name and profile picture URL (as provided by Meta's API).
• Message content you send to Jarvi via Messenger.

Instagram Direct Messages:
• Your Instagram-Scoped ID (IGSID) as provided by Meta.
• Your Instagram username.
• Message content and comments you send to Jarvi via Instagram.

WhatsApp:
• Your phone number as provided by Meta's WhatsApp Business API.
• Your WhatsApp display name.
• Message content you send to Jarvi via WhatsApp.

Purpose: This data is used solely to provide the Jarvi service — processing your requests, managing your calendar, tasks, goals, and memory. We do not sell, share, or use this data for advertising purposes.

2c. Sensitive Information You Choose to Share

Jarvi is an open-ended assistant with a long-term memory, so you may choose to tell it things that count as special categories of personal data under Art. 9 GDPR — for example health information or allergies (which Jarvi can store so it does not suggest something harmful), or religious, spiritual or philosophical beliefs (which you may enable so that encouragement and reflection prompts are framed in terms that matter to you).

• Always your choice. We never require this information and no feature is gated behind it. It is processed only where you have explicitly provided it for that purpose, which constitutes your explicit consent under Art. 9(2)(a) GDPR. You can withdraw that consent at any time, with effect for the future.
• It is processed like all other content. Sensitive information you save becomes part of the context Jarvi uses to answer you, which means — exactly as described in § 4 — it may be transmitted to the AI providers named there. It is not given separate or stronger technical treatment, and we ask you to take that into account before sharing anything you would not want processed by a third-party provider.
• Removing it. Individual memories can be viewed and deleted in the ForeverBrain section of your Dashboard. Deleting your account erases all of it (see § 7).
• Not a medical or pastoral service. Jarvi does not provide medical, psychological, therapeutic or spiritual counselling, and nothing it says should be treated as such.

3. Google API Services User Data Policy & Compliance

AsIfThatWorks integrates with Google APIs to provide intelligent calendar scheduling and task management through our AI agents (Grim and Murphy). We strictly adhere to the Google API Services User Data Policy across all Google integrations.

3.1 Data Accessed (Google OAuth Scopes)

When you choose to connect your Google account, AsIfThatWorks requests explicit access only to the scopes necessary to perform the requested scheduling and task management actions:
• Google Calendar API (https://www.googleapis.com/auth/calendar / calendar.events): Allows reading your upcoming events, detecting schedule conflicts, and creating or updating events on your monitored calendars.
• Google Tasks API (https://www.googleapis.com/auth/tasks): Allows reading your task lists, creating new action items, and marking tasks completed.

3.3 Data Sharing & Disclosure

• No Third-Party Sharing: AsIfThatWorks does not share, sell, transfer, or disclose Google user data (including Calendar events, Tasks, or OAuth tokens) to any third-party advertisers, data brokers, or external analytics platforms.
• No Base Model Pre-Training: Information obtained via Google APIs is never used to pre-train, fine-tune, or train foundational AI base models.

3.4 Data Storage & Protection

• Encryption at Rest: All Google OAuth access tokens, refresh tokens, and synchronization metadata are encrypted at rest inside our self-hosted, access-controlled EU-based database, which is not reachable from the public internet.
• Encryption in Transit: All communication between your device, our backend servers, and Google APIs uses HTTPS with TLS 1.3 encryption.
• Account Isolation: Your Google OAuth tokens and synced data are strictly bound to your individual user account and inaccessible to any other user.

3.5 Data Retention & Deletion

• Retention Policy: We retain your Google OAuth credentials and synced data only for as long as your Google account remains actively connected to AsIfThatWorks.
• Instant Access Revocation: You can disconnect your Google Account at any time via your Dashboard settings or directly revoke access at Google Account Security Permissions.
• Data Deletion Process: You may request deletion of your account and all associated Google user data at any time via Profile > Security > Delete Account or by visiting our Data Deletion Page or emailing support@asifthatworks.com. Requesting deletion immediately cancels any active subscription and schedules erasure; your account remains accessible (so you can cancel the request if it was a mistake) until the 30-day grace period ends, at which point your Google OAuth tokens are revoked with Google and all associated calendar/task records are permanently wiped from our systems.

4. Artificial Intelligence — What We Use and What Leaves Our Servers

We want to be precise here, because this is the part of the Service people most often assume works differently than it does.

4.1 We do not build, train or fine-tune AI models.
AsIfThatWorks is not an AI model developer. Jarvi and its agents are an orchestration layer — the reasoning itself is performed by third-party Large Language Models that we access through their commercial APIs. We did not create these models and we do not train them.

We do not use your data to train any AI model — not our own (we have none), and we do not submit your data to any provider for training purposes. Your conversations, notes, memories, calendar entries and tasks are used to serve you and only you, and are not pooled into a training corpus, sold, or shared for advertising.

4.2 Which providers process your content.
To generate a reply, the content of your message together with the relevant parts of your stored context (recent conversation, tasks, calendar entries, notes and saved memories) is transmitted to a model provider. In order of use:

• OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C.) — our primary provider. Most requests are handled here. We use the OpenAI API, which is a different product from the consumer ChatGPT application: under the OpenAI API data usage policy, content submitted via the API is not used to train or improve OpenAI's models. API content may be retained by OpenAI for a limited period for abuse and misuse monitoring, then deleted.
OpenAI is our only AI provider. There is no second one and no fallback. We previously also used Google's Gemini API, and maintained a locally-hosted model as a last resort. Both were removed on 18 September 2026: no content is sent to Google for AI processing any more, and we no longer claim any local AI processing, because we no longer do any. If OpenAI is unavailable, the assistant simply cannot answer until it returns.

Voice and images. If you send a voice message, the audio recording itself is transmitted to OpenAI (Whisper) for transcription. If you send a photo, the image is transmitted to OpenAI for interpretation. Voice and image files are held transiently on our server only for the duration of processing and are then deleted.

This transmission is inherent to the Service and is not optional. It is how the assistant is able to answer at all. If you are not comfortable with your content being processed by these providers, please do not submit it — and see § 2c below regarding sensitive information.

4.3 Legal basis and safeguards.
This processing is necessary for the performance of our contract with you (Art. 6(1)(b) GDPR). The providers named above act as processors on our behalf under data processing agreements incorporating the European Commission's Standard Contractual Clauses for transfers outside the EU/EEA (see § 6).

What we cannot promise: we can tell you what these providers commit to contractually and in their published policies, and we select them on that basis. We cannot independently audit or guarantee a third party's internal conduct, and we do not claim to.

4.4 Automated processing.
Jarvi generates suggestions, schedules, reminders and prioritisations automatically. These are assistive only: they produce no legal effect and have no similarly significant effect on you within the meaning of Art. 22 GDPR, and you remain free to ignore, edit or reverse any of them. Nothing in the Service makes an automated decision about your employment, credit, insurance, eligibility or legal status.

5. Third-Party Services and Subprocessors

The following is the complete list of external services that may process your personal data on our behalf, what each one receives, and where it is located. We keep this list current; if we add a subprocessor we will update it here.

Infrastructure & storage
• Hostinger International Ltd. (EU) — our application servers. Since September 2026 our database is self-hosted on our own server rather than with a managed database provider; your account data, messages and memories are stored on infrastructure we operate directly, in the EU.
• Cloudflare, Inc. — R2 object storage (EU jurisdiction bucket) — encrypted offsite backups. Backups are encrypted with AES-256 on our own server prior to upload, so Cloudflare holds only an opaque encrypted archive and has no ability to read its contents. The bucket is bound to EU jurisdiction.
• Hostinger SMTP (EU) — sending transactional email such as password resets, login links and replies to contact requests. Receives your email address and the message content.

AI processing (see § 4 for full detail)
• OpenAI — assistant responses, semantic memory embeddings, voice transcription and image understanding. This is our only AI provider; there is no fallback and no local model.

Voice output (text-to-speech)
• When you use a spoken reply, the text of Jarvi's answer — which may contain details drawn from your calendar, tasks and memories — is sent to a speech synthesis provider to be turned into audio. Your stored data is not sent, only the reply text. We use ElevenLabs (United States) and Fish Audio for this. Voice output is only triggered when you request it.

Messaging platforms
• Telegram — Bot API, for messages exchanged on Telegram.
• Meta Platforms — WhatsApp Business API, Messenger API and Instagram Graph API. For Messenger we additionally retrieve your first and last name from Meta's profile API so Jarvi can address you correctly.

Integrations you connect yourself
• Google (Calendar & Tasks) — only if you connect your Google account; see § 3.
• Google Firebase Cloud Messaging — only if you use our mobile companion app; receives your device push token and the routine/alarm details needed to deliver a notification.

Payments
• Stripe Payments Europe, Ltd. — subscription processing. Stripe receives your email address and an internal account identifier. We never see or store your card details — these are entered directly with Stripe.

Website analytics & operations
• Google Analytics 4 (Google LLC) — public marketing pages only, and only after you consent; see § 5a. Never used on the authenticated Dashboard.
• Discord (operational alerting) — we receive automated technical alerts about system health, backups and errors through a private Discord webhook. These are operational messages and are not intended to contain your content, though a technical error message may incidentally include an account identifier.

5a. Cookies & Analytics

Our public website (this page and other marketing/legal pages) uses Google Analytics 4 (GA4), provided by Google LLC, to understand aggregate visitor behavior — pages viewed, approximate location (country/city level), device and browser type, and referral source. GA4 does not log or store full IP addresses.

• Consent-based, not automatic: The Google Analytics script does not load, and no analytics cookies are set, until you actively click "Accept" on the cookie banner shown on your first visit. Declining means Google Analytics never runs for you at all. This is required under Art. 6(1)(a) GDPR and § 25 TTDSG (German Telecommunications-Telemedia Data Protection Act), since we are established in Germany.
• Changing your choice: A small 🍪 button (bottom-left of the screen) reopens the cookie banner at any time so you can switch between Accept and Decline.
• International transfer: Google LLC may process this data in the United States under the EU-U.S. Data Privacy Framework (see §6).
• Google's own policy: See Google's Privacy Policy and Google's Analytics opt-out browser add-on.
• Not used on the app: The authenticated Dashboard uses only first-party, GDPR-strictly-necessary presence pinging — no third-party analytics of any kind runs there.

6. International Data Transfers

Your data is stored in the EU. However, several of the processors listed in § 5 — in particular the AI and speech providers — operate from or transfer data to countries outside the EU/EEA, principally the United States.

Such transfers take place on the basis of the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of Standard Contractual Clauses approved by the European Commission, supplemented by the technical measures described here (transport encryption throughout, and encryption of backup archives before they leave our server).

You should be aware that authorities in third countries may have access rights that are not equivalent to those under EU law, and that an equivalent level of protection cannot be guaranteed in every case. You can request a copy of the relevant safeguards from support@asifthatworks.com.

7. Data Retention

We store your data as long as your account is active. Chat history and memory data are retained to provide continuity of service across sessions.

You may request deletion of your data at any time. Your account enters a 30-day grace period (billing is canceled immediately; you can cancel the deletion request at any point during this window), after which all account data, chat history, integration tokens, goal data, and memory entries are permanently removed and your Google OAuth tokens are revoked with Google.

You are not required to wait for that window. When deleting your account you may instead choose permanent, immediate deletion: the same erasure runs at once, there is no grace period, nothing can be recovered, and your email address is released immediately.

One exception: posts and comments you made on the public Community Board are not deleted when your account is purged, since other members may have replied to or upvoted them. Instead they are anonymized — your display name is replaced with "Deleted user" and the content is permanently unlinked from your account — while the text itself stays visible so the discussion around it remains intact. You can remove an individual post or comment yourself at any time before deletion using the delete option on the board.

8. Your Rights

Under the GDPR, you have the right to access, rectification, erasure, data portability, and objection. You can download a complete copy of your data yourself at any time via Profile > Security > Download My Data — no need to email us for this. For rectification, objection, or any other request, contact support@asifthatworks.com.

9. Data Security

We implement technical and organisational measures appropriate to the risk, in line with Art. 32 GDPR:

• In transit: HTTPS/TLS for all traffic between your device, our servers, and every provider listed in § 5.
• Database: self-hosted, bound to the local machine only, not reachable from the public internet, and protected by authentication. Credentials and integration tokens are encrypted at rest.
• Sessions: signed, httpOnly session cookies, so your session cannot be read by scripts in your browser.
• Backups: encrypted with AES-256 prior to leaving our server, so the offsite copy is unreadable without a key held separately from the storage provider.
• Access: the Service is operated by a single developer; administrative functions are restricted to the operator account and access to production data is limited to what is necessary to run and support the Service.

No system can be guaranteed absolutely secure. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours as required by Art. 33 GDPR, and will inform you directly where Art. 34 GDPR requires it.

9a. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. For us as a Berlin-established controller, the competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-berlin.de). We would appreciate the chance to resolve your concern first — but this right exists independently of us.

10. Data Deletion

You have the right to absolute erasure. You can trigger this at any time through your Dashboard > Profile > Delete Account, which immediately cancels any active subscription and starts the 30-day grace period described in §7 above — your account stays accessible so you can cancel the request if it was a mistake, and is permanently purged automatically once the 30 days pass. Alternatively, email support@asifthatworks.com.