Privacy Policy — Connected Services

This Privacy Policy describes how Souvenir, Inc. (“Souvenir,” “we,” “us,” or “our”) collects, uses, stores, and shares information when you use the Souvenir Meta (Facebook) app, the Souvenir Slack managerial bot, and other Connectors. It covers:

• the Souvenir web application available at getsouvenir.com (the “Service”);
• the Souvenir app for Meta (our Facebook / Meta Platform application used to connect Meta advertising accounts); and
• the Souvenir Slack managerial bot (our Slack application).

By using the Service, the Souvenir Meta app, or the Souvenir Slack bot, you agree to the practices described in this policy. If you do not agree, please do not use the Service. This policy took effect June 11, 2026. Contact: contact@getsouvenir.com

Souvenir is a centralized workspace brain driven by a coordinated team of AI Assistants. It lets you chat with AI models and, optionally, connect third-party business tools (such as Meta Ads, Shopify, Slack, HubSpot, Klaviyo, and others) so the assistants can retrieve and analyze your business data on your instruction.

Souvenir is the data controller for personal information collected through the Service. Where you connect your company’s third-party accounts and instruct Souvenir to process data from them, we act on your instructions with respect to that connected data.

Information you provide directly

• Account information. When you sign up, our authentication provider (Auth0, an Okta company) collects your name, email address, and login credentials or social-login identity. We store your email, display name, and a unique account identifier. We never see or store your password if you use social login.
• Billing information. Payments are processed by Stripe. Stripe collects your payment card details directly; we do not receive or store full card numbers. We store your Stripe customer ID, subscription plan, invoices / credit balances, and transaction history.
• Chat content. Messages you send to the assistants, files and documents you upload (e.g., PDF, DOCX, XLSX, PPTX, images), and the assistants’ responses.
• Configuration data. AI Assistants, projects, team and organization settings, and connector configurations you create.
• Support communications. Anything you send us when contacting support.

Information collected automatically

• Usage and log data. Request logs, timestamps, feature usage, error logs, IP address, browser / device type, and credit / usage accounting records (which features and AI models you used and how much).
• Cookies and similar technologies. We use cookies and local storage for authentication sessions and core functionality. We do not use third-party advertising cookies.

Information from connected third-party services

You may optionally connect third-party accounts (“Connectors”). We only access connected data when you ask an assistant to perform a task that requires it (for example, “summarize last month’s ad performance”).

a) Meta (Facebook) — Souvenir Meta app

When you connect a Meta Ads account, you authorize our Meta app through Meta’s OAuth consent flow. Through this connection we may receive:

• OAuth access tokens for your Meta account (managed through our authentication broker, Composio). We never receive or store your Facebook / Meta password.
• Advertising data you direct an assistant to retrieve, under the ads_read and ads_management permissions: ad account metadata, campaigns, ad sets, ads, creatives, audiences, budgets, and performance insights (impressions, clicks, spend, conversions, and similar metrics).
• Basic profile information associated with the connected Meta account (such as name and account ID) as returned by Meta during authorization.

We use Meta Platform Data only to provide the features you request inside Souvenir (retrieving, analyzing, and summarizing your advertising data). We do not sell Meta Platform Data, use it for advertising of our own, build profiles unrelated to the Service, or transfer it to data brokers. Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies.

b) Slack — Souvenir Slack managerial bot

When a workspace admin or member installs the Souvenir bot via Slack’s OAuth consent flow, we collect and store:

• Workspace installation data: Slack workspace (team) ID and name, the bot access token (encrypted at rest), the bot’s user ID, the granted OAuth scopes, and which Souvenir account performed the installation.
• Identity links: a mapping between your Souvenir account and your Slack user ID in each workspace, created when you link your Slack identity, so the bot can attribute requests to your Souvenir account.
• Message content — only in limited cases: when you @-mention the bot in a channel; send the bot a direct message; use one of the bot’s slash commands; or when the bot reads the history of a thread it is participating in, in order to maintain conversational context for its reply.

The bot requests the following Slack scopes, for these purposes:

The bot does not continuously monitor, archive, or index your workspace’s messages. Messages directed at the bot are processed to generate a response (including being sent to AI model providers) and retained as part of the associated Souvenir conversation history. If the bot is uninstalled from a workspace, or its tokens are revoked, we delete the stored installation record and bot token for that workspace automatically.

c) Google, Shopify, and other connectors

The Service supports additional connectors (e.g., Google Drive, Gmail, Shopify, HubSpot, Klaviyo, ShipStation, and others). For each, the same principles apply: we access data only through the permissions you grant via OAuth, only to fulfill tasks you request, and we store the tokens or credentials you provide encrypted at rest. We do not use data from any connected service for advertising or to train AI models. Souvenir’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can disconnect any connector at any time, or revoke access from the third-party service’s own settings.

d) Connector authentication brokers

To connect third-party accounts securely, Souvenir uses specialized integration providers — Composio and Nango — that act strictly as processors on our behalf. They broker the OAuth flow, hold the resulting credentials encrypted, and relay API requests; they do not use your data for their own purposes. Connections are scoped to your individual account and isolated from other users. When you disconnect a connector in Souvenir, the corresponding connection record is deleted or unlinked, and we no longer have access to that account. You can also revoke access directly from the third-party service’s own security settings at any time.

We use the information described above to:

• Provide and operate the Service — authenticate you, run AI conversations, execute connector tasks you request, and maintain your chat, AI Assistant, and project data.
• Process payments and meter usage — manage subscriptions, credits, and billing through Stripe.
• Generate AI responses — send relevant conversation content and connected data to AI model providers.
• Maintain security — detect abuse, enforce access controls, and protect accounts and stored credentials.
• Improve the Service — analyze aggregate usage patterns and diagnose errors. We use internal logs for debugging; we do not sell usage data.
• Communicate with you — service announcements, billing notices, and support responses.
• Comply with law — meet legal, accounting, and regulatory obligations.

We do not sell your personal information, and we do not use your data — including data obtained from Meta or Slack — for third-party advertising.

Souvenir generates responses using third-party large language model providers, currently OpenAI, Anthropic, Google (Gemini), and Mistral. When you chat with an assistant:

• your messages, relevant conversation history, uploaded document excerpts, and connected data needed to answer your request are transmitted to the selected model provider to generate a response;
• we access these providers via their business / API offerings, under terms that prohibit them from using API-submitted data to train their models.

You control what you share in conversations and which connectors you enable.

We share information only with:

• Service providers / sub-processors that process data on our behalf to run the Service;
• Your team and organization, where you use shared workspaces, shared AI Assistants, team connectors, or chat sharing — content you share is visible to the users or teams you share it with;
• Third-party services you connect, when executing your instructions (e.g., sending an API request to Meta or posting a message to Slack on your behalf);
• Legal authorities, if required by law, subpoena, or to protect the rights, safety, or property of Souvenir, our users, or the public;
• A successor entity, in connection with a merger, acquisition, or sale of assets, in which case this policy will continue to apply to previously collected data.

We never sell personal information or share it with data brokers.

We may update this list as the Service evolves; material changes will be reflected in an updated policy. To request notice of subprocessor changes, email contact@getsouvenir.com.

We protect your information using industry-standard measures, including encryption in transit (TLS / HTTPS) and at rest, access controls limiting production access to authorized personnel, and isolation of connected-account credentials to the account that created them. Credentials held by our integration providers are encrypted at rest. Slack bot tokens are deleted automatically on uninstall or revocation, and disconnecting a connector removes our stored link to that account. No method of transmission or storage is 100% secure, but we work to protect your information and will notify you of any breach affecting your personal information as required by law.

You can, at any time:

• Delete conversations, files, AI Assistants, and projects from within the Service.
• Disconnect any connector (including Meta Ads) from the connectors page — this removes our access and stored credentials for that account. You can additionally revoke Souvenir’s access from the third party’s side (for Meta: Settings & Privacy → Settings → Business Integrations on Facebook; for Slack: remove the app from your workspace, which triggers automatic deletion of our stored installation data).
• Delete your Souvenir account by contacting contact@getsouvenir.com (or via in-app account settings, where available). Account deletion removes your personal information, chat history, uploads, identity links, and stored connector credentials, except records we must retain for legal / billing compliance.

Data deletion for Meta users

If you used the Souvenir Meta app and want data obtained from Meta deleted, either disconnect the Meta Ads connector in Souvenir and delete any conversations that referenced it; or email contact@getsouvenir.com with the subject “Meta Data Deletion Request” from the email associated with your account. We will delete the data and confirm within 30 days.

Depending on where you live, you may have rights to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information;
• Export your information in a portable format;
• Restrict or object to certain processing;
• Withdraw consent where processing is based on consent (e.g., by disconnecting a connector).

EEA / UK (GDPR): Our legal bases are performance of a contract (providing the Service), legitimate interests (security, service improvement), consent (optional connectors), and legal obligation (billing records). You may lodge a complaint with your local supervisory authority.

California (CCPA / CPRA): We do not sell or “share” personal information as defined by the CCPA. You may exercise access, deletion, and correction rights without discrimination.

To exercise any right, email contact@getsouvenir.com. We will respond within the timeframe required by applicable law (generally 30 days).

Our infrastructure is hosted in the United States (AWS). If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. Where required, we rely on appropriate safeguards such as standard contractual clauses with our sub-processors.

The Service is intended for business use and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy from time to time. We will post the updated version at this URL with a revised “Last updated” date, and for material changes we will notify you via the Service or email. Continued use after changes take effect constitutes acceptance.

Souvenir, Inc. — Email: contact@getsouvenir.com — Mailing address: 211 28th Street, Des Moines, Iowa, USA. Website: https://www.getsouvenir.com.