Privacy Policy | Souvenir AI Legal

Souvenir, Inc. ("Souvenir," "we," "us," or "our") operates the Souvenir platform at getsouvenir.com, a unified AI workspace that connects multiple large language models and AI services into a single interface with persistent context management, intelligent model routing, workflow automation, and organizational tools. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you access or use our Services (as defined in our Terms of Service). It applies to all users of our Services in the United States, Canada, and India, and includes jurisdiction-specific disclosures for each. By creating an account or using our Services, you acknowledge that you have read and understood this Privacy Policy. Where required by applicable law, we will obtain your consent before processing your personal information.

1. Overview

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you access or use our Services (as defined in our Terms of Service). It applies to all users of our Services in the United States, Canada, and India, and includes jurisdiction-specific disclosures for each.

By creating an account or using our Services, you acknowledge that you have read and understood this Privacy Policy. Where required by applicable law, we will obtain your consent before processing your personal information.

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, password, and account credentials

• Inputs: prompts, files, images, code, instructions, and other content you submit to the platform ("Inputs")

• Workspace data: projects, workflows, saved context, Personas, Pins, and AI-generated outputs ("Outputs")

• Payment information: billing details processed by our payment processor, Stripe. We do not store credit card numbers, bank account details, or UPI IDs on our servers.

• Communications: support inquiries, feedback, and correspondence with us

2.2 Information Collected Automatically

• Device and browser information: type, operating system, screen resolution, and browser version

• IP address and approximate geographic location (country/region level). We use ip-api.com to resolve your IP address to city, region, and timezone for localization purposes. Your IP address is transmitted to this third-party service.

• Usage data: features accessed, interaction patterns, session duration, and activity timestamps

• Log data: server logs including timestamps, error reports, referring URLs, and system activity. We use Sentry for error monitoring, which may capture request metadata and stack traces when errors occur.

• Analytics data: we use Mixpanel and Google Analytics to collect aggregated usage insights, feature adoption metrics, and session patterns

• Cookies and similar technologies: as described in our Cookie and Tracking Disclosure Policy

2.3 Information from Third-Party Integrations

If you connect third-party services to your Souvenir account, we may access and process data necessary to enable those integrations, in accordance with the permissions you grant.

3. How We Use Your Information

We use collected information for the following purposes:

• To provide, operate, and maintain the platform, including persistent context and memory across workflows

• To route your Inputs to appropriate AI models based on your settings or our auto-routing algorithm

• To process payments and manage your subscription

• To improve output quality, system performance, and user experience

• To support collaboration within shared workspaces and team accounts

• To respond to support requests, user inquiries, and feedback

• To monitor usage for abuse prevention, security, and enforcement of our Terms of Service and Acceptable Use Policy

• To comply with legal obligations, respond to lawful requests, and protect our legal rights

• To send transactional communications (account confirmations, billing notices, security alerts)

We do not use your Inputs or Outputs to train our own AI models unless you explicitly opt in.

4. AI Models and Third-Party Data Processing

Souvenir connects with third-party AI model providers and processing services. When you submit an Input, it is routed through OpenRouter, a third-party middleware service, to one or more of the following AI providers:

• OpenAI (United States) — text and chat models

• Anthropic (United States) — text and chat models

• Google Gemini (United States) — text and chat models

• Mistral AI (France) — text, chat, and OCR models

All AI providers are based in the United States or the European Union.

In addition to AI model providers, your content may be processed by the following services on our infrastructure:

• OpenRouter (United States) — middleware that routes your Inputs to the appropriate AI model provider

• AWS Bedrock with Cohere embed-v4 (United States) — generates semantic vector embeddings from your content for search and memory features

• AWS Textract (United States) — extracts text from uploaded documents and images via OCR

• Mistral OCR API (France) — alternative OCR for document processing on certain plans

• Docker sandbox (United States) — user-submitted or AI-generated code may be executed in isolated containers on our AWS infrastructure

• PyMuPDF and python-pptx — local parsing of PDFs and PowerPoint files on our servers (no third-party data sharing)

Each AI provider processes your data under their own terms and privacy policies. We share only the data necessary to fulfill your request. Under our API agreements with these providers, your Inputs and Outputs are not used for model training.

5. Data Storage and Retention

• Your data is primarily stored on Amazon Web Services (AWS) infrastructure in the United States, region us-east-1

• User data, conversations, personas, memories, and document embeddings are stored in a PostgreSQL database with pgvector extension

• Uploaded files and documents are stored in AWS S3

• API keys and credentials are stored securely in AWS Secrets Manager

• Data is retained for as long as your account is active or as needed to provide the Services

• You may request deletion of your data at any time by contacting info@getsouvenir.com

• Upon account termination, we will delete your Materials within 90 days, except where retention is required for legal, security, or compliance purposes

• Analytics data (Mixpanel, Google Analytics) is retained for up to 24 months

• Session cookies are deleted upon logout or browser close

7. International Data Transfers

Souvenir, Inc. is based in the United States. Your information is primarily stored and processed in the United States (AWS us-east-1). Mistral AI processes certain requests in France.

For users in Canada, we ensure that personal information transferred outside Canada receives a comparable level of protection through contractual safeguards with our service providers, as required under PIPEDA.

For users in India, cross-border data transfers are currently permitted under the Digital Personal Data Protection Act, 2023, unless the Central Government restricts transfers to specific jurisdictions. We will comply with any future restrictions.

8. Your Rights and Choices

8.1 All Users

Regardless of your location, you may:

• Access the personal data we hold about you

• Correct inaccurate or incomplete data

• Request deletion of your data

• Export your data in a machine-readable format

• Withdraw consent where processing is based on consent

• Close your account at any time

8.2 United States Residents

California Residents (CCPA/CPRA): You have the right to know what personal information we collect; request deletion; opt out of sale or sharing (we do not sell or share personal information); and non-discrimination for exercising your privacy rights.

Other U.S. State Privacy Laws: If you reside in a state with a comprehensive privacy law (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, among others), you may have similar rights.

Contact info@getsouvenir.com to exercise these rights. We will verify your identity before fulfilling requests.

8.3 Canadian Users (PIPEDA)

• Access their personal information held by us

• Challenge accuracy and have information amended

• Withdraw consent, subject to legal or contractual restrictions

• Know how personal information is used and to whom it has been disclosed

We obtain meaningful consent for collection, use, and disclosure. Express consent is required for sensitive information, including AI processing of your content.

8.4 India Users (DPDP Act, 2023)

• Access a summary of personal data processed

• Correct and update inaccurate personal data

• Erase personal data no longer necessary for its original purpose

• Nominate another individual to exercise rights in event of death or incapacity

• File a grievance and complain to the Data Protection Board of India

We process your personal data based on your consent, which you may withdraw at any time by contacting info@getsouvenir.com. Withdrawal does not affect prior lawful processing.

8.5 How to Exercise Your Rights

Email: info@getsouvenir.com

Address: 211 28th Street, Des Moines, IA 50312

We will respond within 30 days (or sooner if required by applicable law).

9. Security

We implement reasonable technical and organizational measures to protect your personal data, including encryption of data in transit (TLS/SSL) and at rest, role-based access controls, regular security assessments, secure authentication via Auth0, and secure credential storage via AWS Secrets Manager.

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

In the event of a personal data breach, we will notify affected users and relevant authorities in accordance with applicable law, including U.S. state breach notification laws (including Iowa Chapter 715C), PIPEDA in Canada, and the DPDP Act in India (once in effect).

10. Team and Workspace Data

• Workspace owners and administrators may control access permissions and account settings

• Content shared within a workspace may be visible to other members

• You are responsible for data you share within collaborative environments

11. Children's Privacy

Souvenir is not intended for individuals under 18. We do not knowingly collect personal data from anyone under 18. If we learn we have, we will delete it promptly. Contact info@getsouvenir.com to report.

12. Cookies and Tracking Technologies

See our Cookie and Tracking Disclosure Policy at getsouvenir.com/cookies. We display an opt-in cookie consent banner to all users.

13. Do Not Track Disclosure

We do not currently respond to DNT signals as no universally accepted standard exists.

14. Third-Party Links

We are not responsible for privacy practices of third-party websites linked from our Services.

15. Changes to This Privacy Policy

We will provide at least 14 days’ notice before material changes take effect. Continued use constitutes acceptance.

16. Contact Information

Company: Souvenir, Inc.