Privacy Policy

Improvado has updated its Privacy Policy effective July 22, 2026.

Your privacy is a top priority for us at Improvado. This policy explains what information we collect, how we use and share it, and the rights you have over your data. We’ve written it to be as clear and straightforward as possible.

Important: Improvado is a business service and is not directed to children under 13. Users aged 13–17 may use it only where permitted by their organization and applicable law.

Privacy at a Glance

This table summarizes the key points of our data practices. For full details, please read the sections below.

1. The Information We Collect

To deliver our services, we need to collect certain information. Some of this is required - without it, we can’t provide the service. Other information is optional and won’t affect your access or experience if you choose not to provide it. We group the information we collect into three categories.

a. Information You Give Us
This is data you provide directly when you sign up, fill out a form, or contact support. It includes your name, email, phone number, company name, and any other information you choose to share.

b. Information We Collect Automatically
As you use Improvado, we automatically collect technical data to help our service run smoothly. This includes:

• Usage Data: Which features you use, which pages you visit, and how you interact with our platform.
• Device & Connection Data: Your IP address, browser type, device type, and operating system.
• Cookies & Trackers: We and our third-party partners use Cookies and other tracking tools to provide the core functionality of our service. They are also used for the other purposes outlined in this policy and, where applicable, in our detailed Cookie Policy.

c. Information From Third-Party Services

When you connect an account from a third-party service (like Google APIs, YouTube, Facebook, etc.), you authorize us to access the data needed to provide our service, in accordance with that service's policies and your privacy settings.

When you connect or share data from a third-party source through our service, you are responsible for that data. By using the service, you confirm that you have the legal right to obtain, share, and process this data, including having obtained any necessary consent from third parties.

Google API Services and Limited Use Disclosure: Our application’s may use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. When you grant us access to your Google account, such as for Gmail, we access this data under strict terms. Specifically:

• We limit our use of your data to providing or improving user-facing features. We do not use it for advertising.
• We only transfer your data to third parties when necessary to provide or improve these features, to comply with applicable law, or as part of a merger, with notice to you.
• We do not allow humans to read your data unless we have your specific consent for certain messages, for security purposes, or to comply with law. Otherwise, access is limited to internal operations on aggregated and anonymized data.

YouTube API Services: To enhance our service, we may use YouTube API Services. By connecting your YouTube account, you agree to be bound by the YouTube Terms of Service. This connection allows our API client to access data from YouTube, and this data is subject to the Google Privacy Policy. In addition to our standard procedures for exercising your rights, you can revoke our access to your YouTube data at any time via the Google security settings page.

2. How and Why We Use Your Information

We use your information for specific purposes, always with the goal of providing and improving your experience.

• To Run and Improve Our Service: We use your data to operate our platform, provide customer support, and develop new features.
• To Power AI Features: With your consent, we process the data described in Section 3.a to provide the AI features you choose to use.
• For Security and Legal Reasons: To protect our users and our platform from fraud, and to comply with legal obligations.
• To Communicate With You: To send you service updates, invoices, and marketing information (which you can opt out of).

3. Sharing Your Information: AI and Service Partners

We do not sell your personal data. We only share it in specific circumstances with partners who help us run our service, and only with strong privacy protections in place.

a. AI-Powered Features, the Improvado AI Agent, and the ChatGPT App

Improvado uses advanced AI models from trusted partners to provide analytics, assistant, and agent features. These features are opt-in: before you first use an AI-powered feature we ask for your explicit consent through a clear, unticked opt-in checkbox, separate from any other consent (such as Google authentication). Your consent is the legal basis (GDPR Art. 6(1)(a)) for the AI processing described here. You may withdraw your consent at any time (see “Your controls” below and the “Your Rights and Choices” section of this policy); withdrawal does not affect processing that already took place.

What we process. Depending on the tools you ask the app to run, we may process: your prompts and tool inputs (search terms, SQL queries, API parameters, connection identifiers, dashboard and workflow configuration, naming-convention rows, and documents or files you deliberately select); query results and private workspace data returned by a tool (data-source and connection metadata, extract/load status, dashboards, documents, workflow code and run results, and logs); account and authorization data (name, business email, workspace/agency identifiers, roles, permissions, OAuth status); and technical/security data (IP address, device/browser info, timestamps, tool name, success/error status). Some processing happens as auxiliary system steps rather than as an explicit action in the conversation — for example, generating a chat title or suggested follow-ups from your conversation content.

We correct our prior statement that only the structure of your data is shared: AI-powered features may process the content you provide or select for a request, not only table and column names.

Why we process it. To authenticate you and enforce agency, workspace, role, and permission boundaries; to execute the specific tool or workflow you request and return the result; to create, update, schedule, send, or delete workspace resources when you ask; to maintain reliability, prevent abuse, secure the service, and meet legal obligations; and to improve our services using aggregated or de-identified information where permitted by contract and law. We do not sell personal data, and we do not use AI-feature data for advertising or behavioral profiling.

Recipients.

• When you use Improvado AI Agent through ChatGPT (or another third-party AI interface): OpenAI operates that interface. The tool input you select and the tool result returned to the conversation are received by OpenAI under your own ChatGPT plan, settings, terms, and privacy controls — not under Improvado’s AI-provider contracts. Manage retention, model-improvement, Memory, and app permissions in your ChatGPT settings, which are controlled by OpenAI.
• Improvado’s own AI providers: when an Improvado feature needs a model, the content required for that feature is processed by Microsoft (Azure OpenAI Service), Anthropic (Claude), and Google (Gemini). Our contracts with these providers prohibit the use of your data to train their public AI models, and your data is used only to deliver the feature you are using.
• Sandboxed code execution: when an AI feature needs to run generated code (for example, a workflow or analysis step), it executes in an isolated, ephemeral sandbox operated by FoundryLabs, Inc. (E2B), one of our contracted sub-processors. Data is processed only transiently for the duration of the execution, is not retained after completion, and is not used for AI training. The full, current list of sub-processors involved in AI features is maintained in our Data Processing Agreement.

International transfers. Where personal data originating in the European Economic Area, the United Kingdom, or Switzerland is processed by a US-based provider, the transfer is governed by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two) and, for transfers originating in the United Kingdom, the UK International Data Transfer Addendum, as set out in our Data Processing Agreement.

Retention (AI Agent / ChatGPT app).

Your controls. You direct the AI processing. No data is sent to an AI model until you turn on an AI feature (the opt-in consent described above) and choose to use it. You decide what to submit — your prompt, which tool to run and with what parameters, and which documents to include. To fulfill your request, Improvado then processes the input you provided together with the workspace data the requested tool returns (for example, the results of a query you asked the agent to run), and shares with the model only the information needed to complete that request — including auxiliary steps our systems perform to operate the feature (such as generating a chat title or follow-up suggestions) and any scheduled or automated runs you have configured, which execute your standing instructions. Improvado does not scan your workspace or send its data to AI models on its own initiative; our role in processing your organization’s workspace data is set out in our Data Processing Agreement.

In addition, you may: review an action before it runs when ChatGPT shows a confirmation; disconnect the app or revoke Improvado OAuth access; remove connected services and workspace permissions; delete supported chats, documents, files, knowledge-graph entries, and workflows; and request access, correction, deletion, restriction, objection, or portability by emailing dpo@improvado.io. Disconnecting the app stops future access but does not automatically delete data already stored in an Improvado workspace or a ChatGPT conversation — use each service’s deletion controls.

Security and data minimization. Tools are limited to your existing permissions and return only what the request needs. The public ChatGPT app does not request passwords, API keys, client secrets, MFA codes, or similar authentication secrets through its tool input schemas; OAuth and connector authorization happen through Improvado’s controlled interfaces outside the ChatGPT conversation. Do not submit payment-card data, protected health information, government identifiers, or authentication secrets through prompts or tool inputs. Questions: dpo@improvado.io.

b. Other Service Partners
We work with other companies (sub-processors) to help us operate our business. We only share the minimum data necessary for them to perform their service. An updated list of our specific service partners can be provided upon request. Our primary partners include:

4. Your Rights and Choices

You are in control of your personal data. You have the right to:

• Access and Correct Your Data: You can review and update your account information at any time.
• Withdraw Your Consent: You can withdraw your consent for any data processing, including for AI features and marketing emails, at any time by contacting us or using the opt-out links provided.
• Delete Your Data ("Right to be Forgotten"): You can request that we delete your personal data.
• Object to or Restrict Data Use: You can object to our use of your data for certain purposes. Notably, you have the absolute right to object to your data being used for direct marketing purposes at any time, without providing a reason.
• Data Portability: You can request a copy of your data in a machine-readable format.
• Lodge a Complaint: You have the right to bring a claim before your local competent data protection authority.
• Opt-Out of Interest-Based Advertising: In addition to any opt-out features provided by the specific services listed in this policy, you can learn more about how to generally opt out of interest-based advertising by visiting the dedicated section of our Cookie Policy.

To exercise any of these rights, please email us at dpo@improvado.io. These requests are free of charge, and we will respond to your request as early as possible and always within one month.

5. Data Retention

We process and store your personal data only for as long as required by the purpose for which it was collected. The specific retention period is determined by the following criteria:

• Personal data collected to perform a contract with you (like your account information) will be retained until the contract has been fully performed.
• Personal data collected for our legitimate interests will be retained as long as needed to fulfill those purposes.
• When we process your data based on your consent, we will retain it until that consent is withdrawn.

We may be required to retain personal data for a longer period to comply with a legal obligation or upon the order of an authority.

Once the retention period expires, your personal data will be deleted. After this point, your rights to access, delete, correct, and move your data cannot be enforced.

6. Other Important Information

• Data Security: We use technical and organizational security measures to protect your data from unauthorized access or destruction.
• Legal Action and Government Requests: Your personal data may be used for legal purposes by us in court or in the stages leading to possible legal action arising from improper use of our service. You should also be aware that we may be required to reveal your personal data upon the request of public authorities.
• System Logs and Maintenance: For operational and maintenance purposes, our service and any third-party services we use may collect system logs. These are files that record interactions and may contain personal data such as your IP address.
• International Data Transfers: We are based in the U.S., and your data may be processed in countries other than your own. We use legally-approved mechanisms, like Standard Contractual Clauses, to ensure your data is protected wherever it goes.
• Children's Privacy: Our service is not intended for children under 13. We do not knowingly collect data from anyone under this age.
• "Do Not Track" Signals: Our services do not currently respond to "Do Not Track" signals. To determine whether any of the third-party services we use honor Do Not Track requests, please read their respective privacy policies.
• Changes to this Privacy Policy: We reserve the right to make changes to this privacy policy at any time. We will provide notification of changes on this page, through the service, and - where technically and legally feasible - by sending a notice to you via your contact information. We strongly recommend you check this page regularly. Should any changes affect processing activities that are performed on the basis of your consent, we will collect new consent from you where required.

7. Regional Privacy Notices

• For Residents of the EEA, UK, and Switzerland:
  You have the rights listed in Section 4 under the General Data Protection Regulation (GDPR). Our legal bases for processing your data include performance of a contract (to provide you with our services), your consent (where we ask for it), and our legitimate interests (such as improving our service and for security).

• For Residents of California:
  You have specific rights under the California Privacy Rights Act (CPRA). This includes the right to know what personal information we collect and share, and the right to not be discriminated against for exercising your CPRA rights. We do not "sell" or "share" your personal information as defined by the CPRA.

8. Legal Information

This privacy statement has been prepared based on the provisions of multiple pieces of legislation, including the General Data Protection Regulation (GDPR) and the California Privacy Rights Act (CPRA).

This privacy policy relates solely to the activities of Improvado, unless otherwise stated in this document.

9. Contact Us

If you have any questions, concerns, or requests related to your privacy, please don't hesitate to contact us.

Improvado, Inc.

3919 30th St,

San Diego, CA 92104

United States

dpo@improvado.io