Privacy Policy

Effective August 3, 2026

This Privacy Policy explains how Actovia (“Actovia,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects information when you use Actovia AI, our web application for generating and sending personalized commercial real-estate outreach (the “Service”), available at actovia.ai. By using the Service you agree to this Policy.

Information we collect

We collect the following categories of information:

Account information. The email address or username and password you use to sign in. Passwords are stored in hashed form by our authentication provider; we never see your plaintext password.
Credentials you connect. API keys and tokens you enter (for example your Actovia data API token, Anthropic API key, and, if you connect it, a Google OAuth token). These are encrypted at rest.
Campaign data. Property and owner records you retrieve, the contacts you select, the email templates and drafts you generate and edit, your signature, and the send/reply status of your campaigns.
Google account data. Only if you choose to connect Gmail — see the dedicated section below.
Usage and technical data. Standard log data such as IP address, browser type, and pages accessed, used to operate and secure the Service.

How we use information

To provide, operate, and maintain the Service;
To generate outreach content and send the emails you approve on your behalf;
To detect replies so we can stop follow-ups automatically (only when you enable the corresponding Gmail permission);
To secure the Service, prevent abuse, and comply with law;
To communicate with you about the Service.

We do not sell your personal information, and we do not use it for advertising.

Google user data (Gmail)

Connecting Gmail is optional and enables Actovia to send your approved campaign emails directly from your own inbox. When you connect, we request the minimum permissions needed:

Send email on your behalf (gmail.send) — used solely to send the specific emails you approve in a campaign. We do not read, search, or browse your mailbox with this permission.
Message metadata / headers (gmail.metadata) — if and when you enable automatic stop-on-reply, this permission lets us read message headers only (such as sender and date) to detect that a recipient replied so we can cancel their remaining follow-ups. It does not allow us to read the body or content of any email.

We store an encrypted Google refresh token and the email address of the connected account. We use Google user data only to provide the user-facing features described above. We do not transfer Google user data to third parties except as necessary to provide these features, for security, or to comply with law; we do not use it for advertising; and we do not use it to train generalized artificial-intelligence or machine-learning models. You can disconnect at any time in Settings, which deletes the stored token and attempts to revoke our access at Google. You may also revoke access directly at myaccount.google.com/permissions.

Actovia’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we share information

We share information only with service providers who process it on our behalf to run the Service, under agreements that limit their use of it:

Hosting & database — our cloud hosting and database providers (e.g. Vercel and Supabase) store application and campaign data;
AI content generation — the AI providers whose models draft your emails (e.g. Anthropic, and, for certain image features, OpenAI) process the prompt and property context needed to generate content;
Email delivery — Google (Gmail), when you connect it, to deliver the emails you send;
Real-estate data — the Actovia data API you authenticate with, to retrieve property and owner records.

We may also disclose information if required by law or to protect the rights, safety, and security of Actovia, our users, or the public. If Actovia is involved in a merger or acquisition, information may be transferred as part of that transaction.

Data retention

We retain your account and campaign data for as long as your account is active or as needed to provide the Service. Connected credentials are retained until you disconnect them or delete your account. You may request deletion of your account and associated data by contacting us at the address below; we will delete or de-identify it except where we are required to retain it by law.

Security

We protect your data with industry-standard measures, including encryption in transit (TLS) and encryption at rest for sensitive credentials such as API keys and OAuth tokens (AES-256-GCM). Access is restricted and scoped to each user’s own data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your rights and choices

Access, correct, or delete your account information;
Disconnect any connected integration at any time in Settings;
Request a copy or deletion of your data by contacting us.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA/CPRA. We honor applicable rights requests.

Children’s privacy

The Service is intended for business use by adults and is not directed to children under 16. We do not knowingly collect personal information from children.

Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the “Effective” date above. Material changes will be communicated through the Service.

Contact us

Questions about this Policy or your data? Contact us at jeffi@actovia.com or (732) 987-9870. Mailing address: 300 Candlewood Commons, Howell Township, NJ 07731.