Privacy Policy

Draft version — August 2026. Not yet reviewed by legal counsel.

1. Overview

Qvilio ("we," "us," "Qvilio") builds an AI agent that reads a business's website and answers that business's customers in chat. This policy covers two kinds of people: the business owners who sign up for Qvilio, and the visitors who chat with a Qvilio agent embedded on one of our customers' websites.

2. Information we collect

From business owners (our direct customers): name, email, business website URL, and any billing information needed to process payment.

From website visitors chatting with a Qvilio agent: the content of their conversation, and anything they voluntarily type into the chat (for example, a name or phone number to confirm a booking). We do not require visitors to create an account to chat.

From the website itself: the public content a business owner submits (pages, menus, price lists, images) is crawled and stored to build that business's knowledge base.

3. How we use it

• To generate answers to visitor questions in real time.
• To email a business owner a summary when the agent can't answer something (our escalation feature).
• To send weekly summaries and setup recommendations to business owners.
• To detect a visitor's approximate region (country-level only, via IP address) so pricing displays in the right currency. This lookup is performed by a third-party service — see Third parties below.
• To operate, maintain, and improve the reliability of the Qvilio platform itself (not to train AI models — see below).

4. AI models and training

Conversations are sent to a third-party large language model (LLM) provider only to generate that specific reply. We do not use customer or visitor conversation data to train, fine-tune, or otherwise improve any AI model — ours or our LLM provider's. Our agreements with LLM providers are structured to prevent our data from being retained for their model training.

5. Sensitive data handling

Qvilio never asks for or knowingly stores payment card numbers in chat. Where technically feasible, sensitive identifiers such as card numbers and national ID numbers are filtered out of a conversation before it reaches the AI model or is stored. If a visitor volunteers sensitive information anyway, we recommend business owners avoid processing payments or sensitive transactions through chat and instead direct customers to a dedicated, secure checkout page — which is how Qvilio is designed to behave by default.

6. Third parties & sharing

We do not sell personal information. We share data only with service providers that help us run Qvilio, currently including:

• AI/LLM provider(s) — to generate chat responses (see above).
• ipapi.co — a third-party IP-geolocation lookup used to detect a visitor's country, for currency display only. This sends the visitor's IP address to ipapi.co; no other conversation data is shared with this service.
• Email delivery provider — to send escalation emails and account communications.
• Payment processor — to process subscription billing for business-owner customers.

We may also disclose information if required by law, or to protect the rights, property, or safety of Qvilio, our customers, or the public.

7. Data isolation between customers

Qvilio is multi-tenant: many businesses share the same underlying infrastructure, but each business's website content, knowledge base, and conversation history is logically isolated and is never visible to, or mixed with, another business's data.

8. Retention & deletion

We retain conversation data for as long as needed to provide the service (for example, so a business owner can review past conversations and escalations) and delete it on request. Business owners can request deletion of their account and associated data at any time by emailing hello@qvilio.ai.

9. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing (for example, under GDPR in the EU/EEA, or the CCPA in California). To exercise any of these rights, contact hello@qvilio.ai. We will verify your request and respond within a reasonable time.

10. Cookies & tracking

The Qvilio marketing website (qvilio.ai) does not currently use advertising or analytics cookies. We may introduce basic, privacy-respecting analytics in the future — if we do, this policy will be updated first.

11. Security

We use industry-standard measures (encryption in transit, access controls, tenant isolation) to protect data. No method of transmission or storage is 100% secure, and we can't guarantee absolute security. See our Security & Privacy page for more on our current practices and compliance roadmap.

12. Children's privacy

Qvilio is a business tool and is not directed at children. We do not knowingly collect personal information from children under 16.

13. International transfers

Qvilio serves businesses globally, which means data may be processed in countries other than where you live, including the United States and the EU. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

14. Changes to this policy

We'll update this page as our practices evolve, and — once Qvilio has active customers — will make reasonable efforts to notify business owners of material changes.

15. Contact us

Questions about this policy or your data: hello@qvilio.ai.