Privacy Policy

Last updated: August 29, 2026

Cavoti LLC, operating the Cavoti AI platform (“Cavoti,” “we,” “us,” or “our”), respects your privacy. This Privacy Policy explains how we collect, use, disclose, and retain personal information when you visit our website, create an account, use the console, API, model routing, credits, subscriptions, or support channels. It should be read with our Terms of Service.

1. Information we collect

We may collect account and contact details, credentials, organization information, support correspondence, transaction and usage records, billing and refund information, IP address, browser and device information, timestamps, pages and clicks, API metadata, error and performance logs, approximate location, cookies, local storage, and information received through OAuth, administrators, partners, or integrations.

We also process Inputs, Outputs, and files you submit through the Service, which may contain personal information. You are responsible for having authorization to submit information about other people. Do not submit identity documents, complete payment details, health information, biometric information, children’s information, or other sensitive data unless the feature requires it and you have a lawful basis.

2. How we use information

We use information to provide accounts, routing, API, billing, support, and requested features; verify identity and process payments; send service notices; detect abuse, fraud, attacks, and Terms violations; secure the Service; comply with legal obligations; troubleshoot and improve performance; and produce aggregated or de-identified analytics. With required consent, we may send product or marketing messages, which you may unsubscribe from.

We do not use your Inputs or Outputs to train our own models. To fulfill a request, we may transmit Inputs and necessary metadata to the model provider you select or to a provider selected by automatic routing. Provider retention, training, evaluation, and other processing are governed by that provider’s policies.

3. How we share information

We may share information with vendors that provide cloud, database, security, logging, email, support, payment, analytics, or related services; model providers needed to generate your requested Output; affiliates and partners needed for operations or integrations; authorities or other parties when required for law, safety, fraud prevention, or enforcement; parties involved in a merger, financing, restructuring, or asset transfer; and people or services you intentionally connect or authorize. We do not sell personal information. We may share aggregated or de-identified statistics that cannot reasonably identify you.

4. Cookies and analytics

We use necessary cookies for authentication, security, and core functions, and may use preference and analytics technologies to understand usage, improve the experience, and diagnose problems. You can manage cookies in your browser, although disabling necessary cookies may affect features.

5. Retention and deletion

We retain information as reasonably necessary to provide the Service, complete transactions, resolve disputes, prevent abuse, perform audits, comply with law, and enforce agreements. We then delete, anonymize, or securely isolate it unless continued retention is required. You may request account and personal-information deletion at [email protected]. We may verify identity and retain limited information for legal, tax, payment, security, dispute, or abuse-prevention reasons. Data already received independently by a model provider is handled under that provider’s policies.

6. Your choices and rights

Depending on your location and applicable law, you may have rights to access, correct, delete, export, restrict, or object to processing, withdraw consent, and opt out of marketing. Use account settings where available or contact [email protected]. We may verify identity and explain when a request cannot be fulfilled. You may also contact your local data-protection authority.

7. Controller, legal bases, security, and international transfers

The controller and business operator for this Policy is Cavoti LLC, with the registered address 30 N Gould St, Suite N, Sheridan, Wyoming 82801, United States. We process information to perform a contract, comply with law, pursue legitimate interests such as security, fraud prevention, service improvement, and operations, or with consent where required. You may withdraw consent, but withdrawal does not affect prior lawful processing.

We use reasonable safeguards, including access controls, transport protection, monitoring, and permission management. No system is completely secure. Protect your keys, use strong passwords, enable available multi-factor authentication, and contact us about a suspected compromise.

We and our providers may process information outside your country. Where required, we use adequacy decisions, standard contractual clauses, equivalent safeguards, or another lawful transfer mechanism.

8. Model providers, rights, state disclosures, children, and updates

After you submit an Input, it may be forwarded to the model provider you select or to one or more providers selected by automatic routing. Providers may log, cache, retain, evaluate, filter, train, or improve their systems depending on the model, provider, account type, and settings. We do not control or guarantee a provider’s retention, training, location, Output, or security practices. Review the relevant provider terms before sending sensitive information. Zero-retention, no-training, data-processing, or geographic commitments require an applicable enterprise agreement or explicit provider commitment.

Depending on your location and law, you may request access, correction, deletion, export, restriction, objection, withdrawal of consent, and marketing opt-out. Contact [email protected], preferably from your account email. We may verify identity and may deny or narrow a request where permitted for legal, security, fraud-prevention, confidentiality, or third-party-rights reasons. You may contact your local data-protection authority.

Depending on applicable U.S. state law, we may collect identifiers, commercial information, internet or network activity, inferred location, credentials, communications, and submitted content. We use these categories to provide, secure, improve, bill, support, and enforce the Service, and may disclose them to service providers, model providers, affiliates, payment and cloud providers, professional advisors, transaction parties, and authorities. We do not sell personal information for money. Where applicable law gives you a right to opt out of sale, sharing, or targeted advertising, contact [email protected].

The Service is not directed to children under 13; a higher local minimum age applies where required. If you believe a child provided personal information, contact [email protected]. We do not control third-party websites, models, OAuth, payment, or other integrated services, so review their policies before using them.

We may update this Policy. Material changes will be communicated through the Service, account email, or another reasonable method, and the date above will be updated. Continued use after the effective date means you accept the update.

9. Communications, sensitive information, and de-identified data

We may send transactional communications about accounts, payment, security, support, legal matters, and Service changes; these generally cannot be opted out of. With consent or where permitted by law, we may also send marketing communications. You may unsubscribe through the message or contact [email protected]. Processing an opt-out may take reasonable time and does not reverse processing already lawfully completed.

Our ordinary Service does not require precise location, biometric templates, health information, race or ethnicity, political opinions, religion, union membership, sexual orientation, identity-document numbers, or full payment-card details. Certain models may accept face images, voices, video, or other information that can contain biometric data. If you submit it, it may be transmitted to a model provider to produce the requested Output. You must have the required notice, consent, and other lawful basis.

We may use first- or third-party analytics to measure performance, usage trends, errors, and security signals. Unless separately disclosed and consented to where required, we do not provide your Inputs, Outputs, or direct identifiers to advertisers for cross-service behavioral advertising. We may create aggregated, statistical, or de-identified information for operations, research, capacity planning, improvement, reporting, or collaboration; where law permits, it is no longer subject to personal-information obligations.

10. Wyoming law and exclusive venue

This Policy and any dispute relating to personal information, privacy, the Site, an account, the Service, or this Policy are governed by Wyoming law, without regard to conflict-of-law principles and without limiting non-waivable privacy rights. Any lawsuit may be brought only in a state or federal court with jurisdiction located in Wyoming. You and Cavoti consent to the exclusive jurisdiction and venue of those Wyoming courts and waive any right to sue elsewhere. Before filing, send written notice to [email protected] and allow at least 30 days for good-faith discussion, except for legally permitted emergency privacy, security, injunctive, or preservation relief. Questions, privacy-rights requests, deletion requests, and security reports may be sent to [email protected].