Privacy policy

Data controller

aikuaa is a platform that answers questions about a company’s documents and databases. The controller of the data described in this policy is aikuaa, operating from Paraguay.

For any privacy matter, the contact is contacto@aikuaa.ai.

Data we receive when you sign in with Google

aikuaa uses Google sign-in to identify who is logging in. At that moment we receive only the basic identity data Google returns with the profile and email scopes:

• the name on the Google account;
• the email address and whether Google has verified it;
• the unique identifier Google assigns to that account, which we use to recognise you on later sign-ins.

What we never access

aikuaa does not access Gmail, Google Drive, Google Calendar, Contacts, Photos or any other Google service. The permissions we request are limited to the basic identity described above, and no product feature asks for more.

aikuaa’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google tokens

aikuaa does not store the Google access token or refresh token. They are used only during the authentication exchange, within the same operation, and discarded when it ends.

As a direct consequence, aikuaa cannot act on your Google account outside the moment of sign-in — not even if it wanted to.

What we use your identity for

Identity data is used to link your sign-in to a user account inside aikuaa and to the organisation that account belongs to. That link is what determines which documents, databases and agents you can query.

We also use it to keep the minimum security and audit record needed — who signed in and when — and to contact you about the service. We do not use your identity data for advertising, and we neither sell it nor share it with third parties for commercial purposes.

People without an account: access requests

aikuaa is invitation-only: access is granted by the contracting organisation. If you sign in with a Google account that is not yet linked to any organisation, you get access to no data at all. Instead, you can create an access request.

From that request we keep the name, email, Google identifier, date and the organisation named, so an administrator can review it. The request grants nothing on its own: until it is approved, the account sees no content.

If the request is denied or left unanswered, the associated data is deleted within the period stated in the retention section.

Company data

The documents, databases and conversations processed inside aikuaa belong to the contracting organisation, not to aikuaa. We process them on that organisation’s behalf, under the service agreement, and only the users it authorises can reach them.

Company content is processed to answer that company’s own questions. We do not use it to train our own models or third-party models.

This website

This site measures visits with Cloudflare Web Analytics, which uses no cookies, no browser fingerprinting, and does not identify visitors. That is why there is no consent banner here.

We store one cookie of our own, holding the language you picked, so we do not ask again. The contact form uses Cloudflare Turnstile to stop automated submissions, and the data you send in it (company, contact, phone and email) is used only to reply to you.

Providers

To run the service we rely on providers that may process data on our behalf: Google (authentication), Cloudflare (site hosting, measurement and anti-abuse protection), Resend (email delivery) and the language-model providers the contracting organisation has enabled.

None of them receives your data to use for their own purposes.

Retention

We keep data only while it still serves the purpose it was collected for:

• identity data: while the account is active, and up to 90 days after it is deactivated;
• unapproved access requests: up to 12 months from creation;
• sign-in and audit records: up to 12 months;
• contact form messages: up to 24 months from the last contact;
• company data: for the term of the service agreement and the return-or-deletion period agreed in it.

Deletion and your rights

You can request access to, correction of, or deletion of your personal data at any time, and you can revoke the Google sign-in consent from your own Google account settings.

To request deletion, write to contacto@aikuaa.ai from the account’s email address. We answer within 30 days at most. Deleting the account erases the associated identity data, except records we must keep by legal obligation or to resolve an ongoing dispute.

If the request concerns company data, we forward it to the contracting organisation, which is the party that decides on it.

Security

Access to aikuaa requires authentication and is scoped to each user’s organisation. Traffic is encrypted in transit and platform secrets are kept out of the code.

No system is infallible. If we detect a security breach affecting your personal data, we will tell you and report what happened without undue delay.

Changes to this policy

If we change this policy, we update the date in the header. When a change materially affects how we handle your data, we email active accounts before it takes effect.

Contact

Questions, deletion requests or privacy complaints: contacto@aikuaa.ai.