1. Introduction
daretriva ("we", "our", or "the platform") is a SaaS AI-powered knowledge management platform designed for institutions, teams, and organisations. This Privacy Policy explains how we collect, use, store, and protect information when you use our platform hosted on our secure European cloud, or under a Dedicated License (on-premise or private cloud deployment).
By using daretriva you agree to the practices described in this policy. If you do not agree, please discontinue use of the platform.
2. Data We Collect
2.1 Account data
When you create an account we collect:
- Name and email address
- Organisation name and billing information (paid plans)
- Authentication credentials (stored as bcrypt hashes — never in plain text)
2.2 Content data
Documents and files you upload are processed to build your knowledge base. This includes:
- File content (PDF, DOCX, TXT, Markdown, etc.)
- Vector embeddings computed from your documents
- Conversation history with AI agents
- Custom prompts and agent configurations
2.3 Usage data
We collect anonymised usage data: page views, feature interactions, API request logs (without content) and error reports.
2.4 Third-party AI API keys (BYOK)
daretriva operates on a Bring Your Own Keys (BYOK) model. Your API keys are stored encrypted and are never transmitted to daretriva servers — they go directly to your chosen AI provider.
3. How We Use Your Data
- Service delivery: processing documents, building vector indexes, responding to AI queries
- Account management: authentication, billing, and support
- Security: detecting abuse, fraud, and unauthorised access
- Product improvement: anonymised usage analytics
- Legal compliance: responding to lawful requests from public authorities
We do not sell your data. We do not use your document content to train AI models.
4. Data Storage and Security
- Documents and embeddings stored in your dedicated storage bucket (MinIO or S3-compatible)
- Relational data in PostgreSQL with pgvector
- Passwords hashed with bcrypt; API keys encrypted at rest with AES-256
- All data in transit encrypted with TLS 1.2+
- Under a Dedicated License (on-premise or private cloud), data remains in your environment under the agreed contract terms
5. Dedicated License
The Dedicated License is a separate offering from cloud SaaS plans. It enables deployment in your environment — on your premises or in a dedicated private cloud. Contact us at contact@daretriva.com to discuss options. In that case:
- Data remains in your environment according to the agreed architecture
- You are responsible for securing and managing the deployment (depending on the chosen model)
- Data processing terms are specified in the corresponding commercial agreement
6. Data Connectors and Third-Party Services
When you connect a third-party service (Google Drive, Confluence, etc.):
- We only read content you explicitly authorise
- OAuth tokens are stored encrypted and revocable at any time
- We are not responsible for third-party privacy practices
7. Data Retention
- Account data: retained for subscription duration + 30 days after cancellation
- Documents and embeddings: deleted immediately on request
- Conversation history: retained until you delete it
- Usage logs: anonymised, retained 90 days
8. Your Rights (GDPR / CCPA)
You may have the right to: access, rectify, erase, restrict, port your data. Contact privacy@daretriva.com — we respond within 30 days.
9. Cookies
We use strictly necessary cookies for authentication (HttpOnly session tokens).
With your consent (banner shown on your first visit), we also use Google Analytics (Google Ireland Ltd.) to understand site usage — this sets _ga/_ga_<id> cookies, retained for up to 14 months. You can withdraw consent at any time by clearing your browser cookies to re-show the banner, or via the Google Analytics opt-out add-on.
Separately, a functional dr_attribution cookie (90 days, no consent required) records only the channel of your first visit (e.g. a search engine, an AI assistant, or a campaign link) — it contains no personal data and does not track you across other sites.
10. Children's Privacy
daretriva is not directed at children under 16. We do not knowingly collect data from minors.
11. Changes to This Policy
Material changes will be communicated by email to account administrators at least 30 days before they take effect.