Silvia Privacy Policy

Last Updated: November 2026

1. Introduction and Scope

This Privacy Policy (“Policy”) describes how Silvia, Inc. and its subsidiaries (collectively, “Silvia,” “we,” “us,” or “our”), collect, use, disclose, retain, and protect personal information when you visit our websites, use our products and services, or otherwise interact with us.

This Policy covers all products and services operated by Silvia and its subsidiaries.

Collectively, these are referred to as the “Services.” Where data practices differ between products, this Policy includes product-specific sections clearly labeled as such (see Section 13).

This Policy is incorporated into the Silvia, Inc. Terms of Service. By using the Services, you acknowledge that you have read this Policy. This Policy does not apply to third-party services you may connect to through the Services; those are governed by their own privacy policies.

Geographic Focus: The Services are designed for and primarily offered to users in the United States. We do not specifically target or market to users in the European Union, United Kingdom, or other jurisdictions outside the United States. However, because the Services are accessible globally, this Policy includes provisions addressing the rights of users in those jurisdictions where applicable.

Data Controllers: Silvia, Inc. is the data controller for personal information collected through the Services. For inquiries, contact privacy@cfosilvia.com.

2. Personal Information We Collect

We collect personal information across the categories described below. The specific data elements depend on which Services you use and how you interact with them.

2.1 Account and Identity Information

Information you provide when you create an account, update your profile, or verify your identity: full name, email address, phone number, username, password (stored in hashed form), date of birth or age range, profile photo, household size, employment status, income range, financial goals, risk tolerance, authentication credentials, and login history.

2.2 Payment and Subscription Data

When you purchase a subscription: name on payment method, billing address, payment card type and last four digits, expiration date, billing ZIP code, plan type, subscription dates, billing cycle, payment amounts, transaction confirmations, and refund history. Full payment card numbers and bank account numbers are processed exclusively by our payment processor (Stripe) and are never stored on our systems.

2.3 Device, Technical, and Usage Data

Information collected automatically: IP address, browser type and version, device manufacturer and model, operating system, screen resolution, unique device identifiers, usage and interaction data (pages visited, features accessed, session duration), performance and diagnostic data (crash reports, error logs), approximate geographic location derived from IP address, referral and attribution data, and analytics data collected through PostHog and similar tools.

2.4 Marketing and Communications Data

Your marketing preferences and opt-in/opt-out status, email engagement data, referral information, survey responses, and social media interactions with our accounts.

2.5 Information from Third-Party Sources

We may receive information from payment processors, analytics providers, marketing platforms, and publicly available sources. We may combine this with information we collect directly.

2.6 Support and Feedback Data

Support communications (emails, chat transcripts, phone recordings where disclosed), feedback and ratings, beta and research participation data, and community contributions.

2.7 Product-Specific Data Collection

Additional data collected by Silvia and Silvia Insights is described in Section 13.

3. How We Use Your Personal Information

We use personal information for the following purposes. For users in the EEA, UK, and Switzerland, the applicable legal basis is noted in brackets.

3.1 Service Delivery [Contract]

Providing, maintaining, and operating the Services; creating and managing accounts; processing payments and subscriptions; providing customer support.

3.2 Product Improvement [Legitimate Interests]

Analyzing usage patterns, conducting A/B testing and user research, performing internal analytics and benchmarking.

3.3 Personalization [Legitimate Interests; Consent where required]

Tailoring content, features, and recommendations based on your usage and preferences; customizing notifications and alerts; remembering settings across sessions.

3.4 Marketing [Consent; Legitimate Interests for service communications]

Sending service-related notices and administrative messages (not marketing; cannot be opted out of while you maintain an account). Sending promotional communications where you have opted in or where permitted by law. You may opt out of marketing at any time by clicking unsubscribe, adjusting preferences in account settings, or contacting privacy@cfosilvia.com.

3.5 Safety, Security, and Compliance [Legal Obligation; Legitimate Interests]

Detecting and preventing fraud, unauthorized access, and abuse; complying with applicable laws and regulations; enforcing our Terms; maintaining audit logs.

3.6 Aggregate and De-Identified Data [Legitimate Interests]

We may create aggregate or de-identified data sets by removing information that could identify you. Such data is not personal information under applicable law. Product-specific uses of anonymized data are described in Section 13.

4. Automated Decision-Making and Profiling

Certain features of the Services, particularly within Silvia, involve automated processing to evaluate aspects of your financial situation, including financial health scores, behavioral profiles, risk tolerance assessments, and personalized recommendations.

No automated decision made through the Services has legal or similarly significant effects on you. Silvia does not make binding financial decisions on your behalf, approve or deny credit, set insurance rates, or take any action that produces legal effects. All Outputs are informational and require your independent judgment. Silvia takes actions in a connected Google account only at your request and after you confirm each action, as described in Section 13.3.

If you are located in the EEA, UK, or Switzerland, you may contact privacy@cfosilvia.com to request human review of any automated Output, express your point of view, or contest any result. You may also opt out of certain profiling activities through your account settings.

5. Legal Bases for Processing (EEA, UK, and Switzerland)

Where required by applicable law, we process personal information only with a valid legal basis:

Where we rely on legitimate interests, we have conducted balancing tests to confirm our interests are not overridden by your rights. Records of our balancing assessments are available upon request to our Data Protection Officer. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

6. How We Share and Disclose Personal Information

6.1 Service Providers

We share information with trusted service providers who assist in operating the Services (cloud infrastructure, payment processors, analytics, customer support). They are contractually bound to use your data only for specified purposes and to maintain appropriate security. These include the third-party AI model providers that process your requests to generate responses, the messaging and voice providers described in Sections 13.1.4 and 13.1.5, and the search and web content providers that support deep research requests.

6.2 Financial Integration Partners

When you link financial accounts, your data is shared with integration partners (Plaid, SnapTrade, Coinbase) to facilitate connectivity. Data sharing is governed by your authorization and their privacy policies.

6.3 Legal and Regulatory Disclosures

We may disclose personal information to comply with law, regulation, or legal process; protect rights, property, or safety; detect or prevent fraud; or enforce our Terms.

6.4 Business Transfers

In the event of a merger, acquisition, or similar transaction, your information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

6.5 Anonymized Data Recipients

We may license Anonymized Data derived from Silvia user data to third parties for analytics, benchmarking, and research purposes. Anonymized Data is not personal information and is not subject to personal data restrictions. See Section 13.1 for details.

6.6 With Your Consent

We may share your information when you direct us to do so or provide explicit consent.

6.7 Advertising Partners

If you allow Marketing cookies, Meta (through the Meta Pixel), Google (through the Google Ads tag and Google Analytics), and X (through the X Pixel) receive identifiers and information about your activity on our website, such as pages viewed and sign-up events, so we can measure which of our ads bring people to Silvia and how visitors use our website. We do not show third-party ads on Silvia. When you sign up, or link your first financial institution, our servers may also send that event directly to X through its Conversion API, together with your IP address, browser information, a hashed (coded) version of your email address, and X’s ad click identifier if you arrived from an X ad, so X can match it to the ad. We do this only when you allow Marketing cookies, and never send your financial account information. You can withdraw this permission at any time through Your Privacy Choices. See Section 10 and Section 4.4 of our Cookie Policy.

If you have a Silvia account and are located in the United States, we may also share a hashed (coded) version of your email address with advertising partners such as X, Meta, and Google, rather than the address itself. They match it against their own users to build custom audiences, which we use to find people likely to be interested in Silvia and to avoid showing our ads to people who already use it. We never share your financial account information, such as balances, holdings, or transactions, for this purpose. You can opt out by unsubscribing from our marketing emails or by contacting privacy@cfosilvia.com, and we leave opted-out users out of every list we share afterwards.

7. Sale of Personal Information

Silvia does not sell your personal information as that term is defined under the CCPA/CPRA.

Where we commercialize Anonymized Data (as described in Section 13.1), that data has been de-identified and no longer constitutes personal information. We do not knowingly sell or share the personal information of individuals under 16.

You may exercise your right to opt out of sale or sharing by clicking the “Your Privacy Choices” link in our website footer and turning off Marketing cookies, by enabling Global Privacy Control in your browser, or by contacting privacy@cfosilvia.com. To opt out of the custom audiences described in Section 6.7, unsubscribe from our marketing emails or contact us at the same address.

8. Data Retention

We retain personal information for as long as your account is active, as needed to provide the Services, and as necessary for legal compliance, dispute resolution, and legitimate business purposes.

Messaging data, call recordings and transcripts, Legacy identity checks, and Google User Data are retained as described in Sections 13.1.4, 13.1.5, 13.1.7, and 13.3.5. Section 13.3.5 controls over this Section 8 for Google User Data.

When personal information is no longer needed, we securely destroy, delete, or anonymize it.

9. Data Security

We implement industry-standard technical and organizational measures including: encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, regular security assessments and penetration testing, incident response and breach notification procedures, employee security training, and SOC 2 Type II compliant infrastructure.

9.1 Breach Notification

For GDPR: we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay where required. For U.S. residents: we will comply with applicable state breach notification laws. No method of transmission or storage is 100% secure. We encourage you to use strong passwords and enable two-factor authentication.

10. Cookies and Tracking Technologies

We use cookies and similar technologies for session management, analytics, preferences, and integration functionality. With your permission, we also use the Meta Pixel, the Google Ads tag, Google Analytics, and the X Pixel to measure which of our ads bring people to Silvia and how visitors use our website; we do not show third-party ads on Silvia. You can change your choices at any time through Your Privacy Choices. Full details are in our Cookie Policy at www.silvia.com/cookies.

You can manage cookie preferences through your browser settings or our cookie consent mechanism. We honor Global Privacy Control (GPC) signals where required by law.

11. Your Rights and Choices

11.1 Access and Portability

You may request a copy of the personal information we hold about you in a structured, commonly used, machine-readable format.

11.2 Correction

You may request that we correct inaccurate or incomplete personal information.

11.3 Deletion

You may request deletion, subject to certain exceptions (legal compliance, fraud prevention, contractual obligations). You can delete your account through account settings or by contacting privacy@cfosilvia.com.

11.4 Restriction, Objection, and Withdrawal of Consent

You may request restriction of processing, object to processing based on legitimate interests, or withdraw consent at any time. Withdrawal may limit available features as described in Section 5.

11.5 Opt-Out of Marketing

Follow unsubscribe instructions in any marketing email, adjust notification preferences, or contact privacy@cfosilvia.com.

11.6 Global Privacy Control

We honor GPC signals where required by law. We do not currently respond to browser-based Do Not Track (DNT) signals, as there is no uniform standard.

11.7 Right to Appeal

If we decline a privacy request, you may appeal by contacting privacy@cfosilvia.com with the subject line “Privacy Rights Appeal.”

11.8 Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights.

To exercise any right, contact privacy@cfosilvia.com. We will verify your identity and respond within the timeframes required by applicable law (generally 30 to 45 days). For detailed information on how to submit a request, our verification process, response timelines, authorized agents, and appeals, see our Data Subject Request Procedure.

12. State and International Privacy Disclosures

12.1 California (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act. This section describes our practices for the preceding 12 months.

Categories of personal information collected, sources, business purposes, and categories of recipients are described in Sections 2, 3, and 6. We have not sold personal information in the preceding 12 months. In the preceding 12 months, we have made identifiers and internet activity (such as pages viewed and sign-up events) available to Meta and Google through their advertising-measurement tools, which may be considered “sharing” for cross-context behavioral advertising. We now also make this information available to X through the X Pixel and X’s Conversion API, and may share hashed email addresses with advertising partners to build custom audiences (see Section 6.7), which may also be considered “sharing”. You can opt out as described in Section 7. We collect financial account information as sensitive personal information and use it only as necessary to perform the Services.

Your California Rights: Right to Know, Right to Delete, Right to Correct, Right to Opt Out of Sale/Sharing, Right to Limit Sensitive PI, Right to Non-Discrimination. You may designate an authorized agent with written proof of authorization.

12.2 Virginia, Colorado, Connecticut, Texas, and Other U.S. States

Residents of states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out of certain processing. Contact privacy@cfosilvia.com to exercise your rights. If we decline a request, you have the right to appeal.

12.3 European Economic Area, United Kingdom, and Switzerland

While the Services are designed for and primarily offered to US residents, if you are located in the EEA, UK, or Switzerland and use the Services, the following applies: legal bases for processing are in Section 5, your rights are in Section 11, automated decision-making information is in Section 4, and international transfer safeguards are in Section 14. You have the right to lodge a complaint with your local data protection authority.

12.4 Canada

Canadian residents may have rights under PIPEDA and provincial legislation. Your information may be transferred to and processed in the United States.

12.5 Brazil

If you are located in Brazil, you have rights under the LGPD including confirmation of processing, access, correction, anonymization, portability, deletion, and information about sharing. Contact privacy@cfosilvia.com.

13. Product-Specific Data Practices

13.1 Silvia Platform

13.1.1 Additional Data Collected

In addition to the categories in Section 2, Silvia collects:

• Financial Account and Transaction Data: Linked account data (names, types, masked numbers, balances, status), transaction records (date, amount, merchant, category, status), investment holdings (securities, cost basis, market value), cryptocurrency data (public wallet addresses, token balances), debt and liability data (loan balances, interest rates, payment schedules), and real estate data (property values, mortgage details).
• Inputs, Prompts, and Conversational Data: All text, voice, and other inputs through chat, voice calls, iMessage, RCS, SMS, email, or other channels; AI-generated Outputs; full conversation history; uploaded files and documents; voice recordings and transcriptions.
• Derived and Inferred Data: Financial insights and scores (net worth, cash flow, savings rate), behavioral profiles (spending patterns, income regularity), risk assessments, AI model outputs (recommendations, forecasts, alerts), and automated categorizations.

13.1.2 AI Model Training

We use Silvia Inputs, Outputs, and feedback to train, evaluate, and improve our AI models. Data used for training is de-identified or anonymized before use. You may opt out through Settings > Privacy > Model training or by contacting privacy@cfosilvia.com. If you opt out, the training data sets we build after that, including Anonymized Data used to train or evaluate AI models, leave your data out. Opting out does not degrade service quality or affect our ability to use your data for runtime processing or to create Anonymized Data.

Regardless of opt-out, we may use data flagged for safety review, submitted as explicit feedback, or reported for violations, for maintaining the safety and integrity of the Services.

13.1.3 Anonymized Data Program

Silvia may create anonymized, de-identified, or aggregated data sets from Silvia user data (“Anonymized Data”). Once anonymized, this data is no longer personal information and may be used, licensed, and otherwise commercialized for lawful purposes, including industry benchmarking, market research, analytics products, academic research partnerships, and improving machine learning models.

Anonymization Standards: Removal of all direct identifiers; suppression, generalization, or perturbation of quasi-identifiers; application of k-anonymity, l-diversity, or differential privacy techniques as appropriate; validation testing against re-identification before external use; compliance with CCPA/CPRA de-identification requirements, GDPR anonymization standards, and NIST de-identification guidelines.

Protections: All third-party recipients are bound by agreements that prohibit re-identification, restrict downstream sharing, require breach notification and data deletion upon termination, and include audit rights. The program is subject to periodic privacy team review, annual re-identification risk assessments, and board-level reporting.

13.1.4 Messaging Channels

You can use Silvia by sending messages to Silvia’s phone number. Messages are delivered through Apple iMessage. If iMessage is unavailable, including if you use an Android device, messages are delivered through RCS (Rich Communication Services), and if neither iMessage nor RCS is available, through SMS. Messages are transmitted by Apple, Google, wireless carriers, and our messaging service provider, which delivers iMessage, RCS, and SMS messages on our behalf.

Through messaging channels, we collect:

• Identifiers: your mobile number and messaging identifiers.
• Message content: text, images, screenshots, documents, voice notes, reactions, and other content you send to Silvia, and Silvia’s responses.
• Message metadata: timestamps, delivery and read status, the channel used (iMessage, RCS, or SMS), and device and carrier information made available to us by our messaging providers.
• Information about other people that you include in your messages. You should share information about another person only if you have the right to do so.

Radar alerts. If you set up Radar alerts in the Silvia app and turn on SMS delivery, we send the alerts you configure to your mobile number. Alerts may include financial information, such as balances, transactions, and account names. SMS messages are not end-to-end encrypted and may be visible to your wireless carrier. You can turn off SMS delivery of Radar alerts in the Silvia app or by replying STOP.

Deep research. When you ask Silvia to run a deep research request, Silvia sends search queries based on your request to third-party search and web content providers. We do not include your financial account data or Google User Data in those queries.

Group conversations. If a Silvia user adds Silvia to a group conversation, Silvia receives and processes the messages, images, and other content shared by all participants while Silvia is in the conversation, along with participants’ phone numbers or messaging identifiers. This includes participants who are not Silvia users. We use this information only to provide Silvia’s responses in that conversation. [We do not use messages from participants who are not Silvia users to train AI models, create Anonymized Data, or build Silvia memory about them.] If you are not a Silvia user and want information about you deleted, contact privacy@cfosilvia.com.

Messages on your devices. Messages from Silvia are stored on your devices and may be stored in device backups, synced to your other devices, and displayed in lock screen and notification previews. Silvia cannot access or delete messages stored on your devices or in your backups.

Messaging provider obligations. Our messaging service provider receives and processes message content and metadata on our behalf, solely to deliver messages, under a written agreement that requires it to protect your information and prohibits it from using your information for its own purposes, including training AI models. Apple, Google, and your wireless carrier handle messages under their own terms and privacy policies.

Retention. Message content is stored as part of your conversation history and retained as described in Section 8. Our messaging service provider is contractually limited in how long it may retain message content.

13.1.5 Voice Calls

You can call Silvia’s phone number to speak with Silvia’s AI voice assistant. Silvia does not place outbound calls to you. Calls are routed through a telephony service provider and processed by a voice AI service provider, which converts your speech to text and generates Silvia’s spoken responses.

Recording and transcription. Calls with Silvia are recorded and transcribed. At the start of each call, Silvia tells you that you are speaking with an AI and that the call is recorded. By continuing the call, you consent to the recording. If another person joins or can be heard on the call, you are responsible for obtaining that person’s consent to the recording.

Information we collect. Your phone number and caller ID information, call audio (processed in real time and not stored), call transcripts, AI-generated call summaries, and call metadata such as the date, time, and duration of the call.

No voiceprints. We do not use your voice to identify or authenticate you, and we do not create voiceprints or other biometric identifiers from your voice.

Voice provider obligations. Our telephony and voice AI service providers process call audio and transcripts on our behalf, solely to provide the voice service, under written agreements that require them to protect your information and prohibit them from using it for their own purposes, including training AI models.

Retention. We do not store audio recordings of calls, and our voice AI service provider processes calls under zero-retention terms and does not store them. Call transcripts, summaries, and call metadata are stored with your account and retained as described in Section 8.

13.1.6 Memory

Silvia remembers information from your conversations and connected accounts, including Google User Data, and uses it as context to personalize later responses and Radar alerts. Deleting information from memory does not delete it from your conversation history.

13.1.7 Legacy and Identity Checks

Legacy lets a Silvia user (the “owner”) name up to three people to receive a package of the owner’s records if the owner stops using Silvia for a long time. For each person, the owner gives us their legal name, their relationship to the owner and their email address. We use these only to run Legacy: to confirm the email address, to write to the person if the package is released, to confirm who they are, and to deliver the package.

When a package is released. Release is automatic, and the owner agrees to that when they turn Legacy on. A package is released only after all of the following: the owner has not used Silvia for the period they chose (at least 60 days); we have checked in with the owner three times, a week apart, by email and, if they agreed to receive texts, by text; we have then sent the owner a final notice; and at least 7 more days have passed with no answer. Using Silvia, answering any of these messages, or turning Legacy off stops a release at any point before then. No one at Silvia reviews or approves a release, but our team can pause one, for example while trying to reach the owner. A report that the owner has passed away never releases a package or makes a release happen sooner; we may let the owner know about it so they can tell us they are fine.

A released package contains what the owner chose to include, such as a letter, a summary of their accounts and a spreadsheet, and is shared only with the people the owner named, at the owner’s direction (see Section 6.6). Each package is available for 90 days and then deleted.

Identity check before a package opens. Before a person named by an owner can open a package, they confirm who they are with our identity verification provider, Stripe, Inc. (“Stripe Identity”). Stripe collects a photo of their government ID and a selfie, and compares the two, which can involve biometric technology. Stripe processes this information as described in the Stripe Privacy Policy.

What Silvia keeps. When a check passes, Stripe tells us the name on the ID. Our systems compare it with the name the owner gave us and do not store it. We keep only whether the check passed, whether the name matched, Stripe’s reason code when a check does not pass, a reference to the check at Stripe, and when each step happened. We do not keep the photos, the ID number, the date of birth, the address or any other detail from the ID. We delete these records three years after the package is deleted, once nothing remains to be deleted at Stripe.

Deletion at Stripe. We ask Stripe to delete what it collected 90 days after a check passes. When a check does not pass or the name does not match, we ask Stripe to delete it within 180 days, so that a member of our team can review it if the person asks for help, and our team can ask for it to be deleted sooner. If a check is canceled before it finishes, a member of our team deletes what Stripe holds for it.

When the check cannot be completed. If the identity check does not work for someone, for example because their name has changed or they cannot take a selfie, a member of our team may confirm who they are another way, such as from documents they send us. Those documents are handled as support data (see Section 2.6) and kept as described in Section 8.

13.2 Silvia Insights

13.2.1 Additional Data Collected

Silvia Insights collects: which articles and content you access, time spent on each piece, content preferences, reading history, navigation patterns, newsletter open rates, click-through behavior, and engagement metrics.

13.2.2 AI-Generated Content and Your Data

We do not use your personal information as inputs to the AI models that generate Silvia Insights content. We may use aggregate, de-identified usage data to inform editorial decisions. We do not sell or provide your personal information to third-party AI model providers for training.

13.2.3 No Anonymized Data Commercialization

Silvia Insights does not create anonymized data sets from subscriber data for sale or licensing. We may use aggregate usage data internally for product improvement only.

13.3 Google User Data

If you connect a Google account to Silvia, you authorize Silvia to access data from Gmail, Google Calendar, and Google Drive through Google’s APIs (“Google User Data”). This Section 13.3 governs Google User Data and controls over any other provision of this Policy that would otherwise apply to it.

13.3.1 Google User Data We Access

• Gmail: your messages and their contents, including senders, recipients, subjects, message bodies, and attachments, and your labels. At your request, Silvia also creates drafts, sends drafts you approve, and archives, trashes, labels, or marks messages as read or unread.
• Google Calendar: your events and their details. At your request, Silvia also creates, updates, deletes, or responds to events.
• Google Drive: your files and folders and their contents. At your request, Silvia also creates, updates, renames, moves, trashes, restores, or shares files and folders.

Silvia accesses Google User Data when you connect your Google account, to record which account you connected, and when you ask Silvia to perform a task that requires it. Information Silvia retrieves to complete a task may be stored in Silvia’s memory and used as context in later conversations and Radar alerts, as described in Section 13.1.6.

Silvia takes an action that creates, sends, changes, shares, moves, trashes, or deletes Google User Data only after you confirm that specific action.

13.3.2 How We Use Google User Data

We use Google User Data only to provide and improve the user-facing features you use in Silvia, such as answering your questions about your email, calendar, and files, remembering relevant context from them, drafting replies, and managing events and documents on your behalf.

Silvia’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The Google API Services User Data Policy is available at https://developers.google.com/terms/api-services-user-data-policy.

13.3.3 What We Do Not Do with Google User Data

• We do not use Google User Data to develop, improve, or train generalized or non-personalized AI or machine learning models, and it is excluded from the AI model training described in Section 13.1.2.
• We do not use Google User Data to create Anonymized Data, and it is excluded from the Anonymized Data Program described in Section 13.1.3 and from the disclosures described in Section 6.5.
• We do not sell Google User Data.
• We do not use or transfer Google User Data for advertising, including personalized, retargeted, or interest-based advertising.
• We do not use Google User Data to determine creditworthiness or for lending purposes.
• We do not allow any person to read Google User Data unless you have given us your affirmative agreement to view specific data, it is necessary for security purposes such as investigating abuse, or it is necessary to comply with applicable law.

These restrictions also apply to information from Google User Data that is stored in Silvia’s memory.

13.3.4 Sharing Google User Data

We transfer Google User Data to third parties only:

• as necessary to provide or improve the features you use in Silvia, with your consent, which you give when you connect your Google account and ask Silvia to perform a task;
• for security purposes;
• to comply with applicable law; or
• as part of a merger, acquisition, or sale of assets, and only after obtaining your explicit prior consent.

The first of these includes the service providers that host and operate the Services, the third-party AI model providers that process your request to generate a response, and, if you ask Silvia about Google User Data through a messaging channel or a voice call, the messaging and voice providers described in Sections 13.1.4 and 13.1.5. These providers process Google User Data only on our behalf and are contractually prohibited from using it for any other purpose, including training their own models.

13.3.5 Storage, Retention, and Deletion

Google User Data is encrypted in transit and at rest. Content from Google that appears in your Silvia conversations is stored as part of your conversation history until you disconnect the Google account or delete the conversation.

To operate, secure, and troubleshoot the Services, we also keep records of which Google features were used in a conversation, such as that a Gmail search ran, whether it succeeded, how long it took, and the size of the result. These records do not contain the content of your Google User Data and are never used to train AI models.

You can disconnect a Google account at any time in Silvia’s settings. Disconnecting revokes Silvia’s access, deletes the access tokens we hold for that account, and deletes the Google User Data from that account that we hold, including Google content in your conversation history and information stored in Silvia’s memory, within 30 days. You can also remove Silvia’s access from your Google Account permissions page. To request deletion of Google User Data we hold, contact privacy@cfosilvia.com or follow our Data Subject Request Procedure.

14. International Data Transfers

Silvia, Inc. is based in the United States. If you access the Services from outside the United States, your personal information will be transferred to and processed in the United States.

Where required by applicable law, we implement appropriate safeguards including Standard Contractual Clauses (SCCs), adequacy decisions, the EU-U.S. Data Privacy Framework (and UK/Swiss extensions where applicable), and consent where required.

15. Children’s Privacy

The Services are not intended for individuals under 18. We do not knowingly collect personal information from anyone under 18. If we learn we have collected information from a child under 18, we will promptly delete it. Contact privacy@cfosilvia.com if you believe a child has provided us with personal information.

16. Third-Party Links and Integrations

The Services may contain links to third-party websites and services. We do not control them and are not responsible for their privacy practices. This Policy does not apply to third-party services.

17. Data Protection Officer

Silvia has designated a Data Protection Officer responsible for overseeing data protection compliance:

Email: dpo@cfosilvia.com

Mailing Address: Data Protection Officer, Silvia, Inc., 600 Lexington Avenue, New York, NY 10022

Because the Services are designed for and primarily offered to users in the United States, Silvia has not appointed representatives in the European Union or United Kingdom under GDPR Article 27 or UK GDPR at this time. If our user base in those jurisdictions grows to a point where appointment is required, we will update this Policy with the relevant contact information.

18. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the effective date, post the updated Policy, notify you by email, and where required by law, obtain your consent. Your continued use after changes constitutes acceptance.

19. Contact Us

Silvia, Inc.

600 Lexington Avenue, New York, NY 10022

Privacy Inquiries: privacy@cfosilvia.com

Data Protection Officer: dpo@cfosilvia.com

Security: security@cfosilvia.com

General Support: support@cfosilvia.com

Legal Notices: legal@cfosilvia.com