Privacy Policy

1. Overview

InnoventuresAI Inc ("Springbase," "we," "our," or "us") provides an AI workspace for chat, agent workflows, recipes, Canvas assets, knowledge bases, meetings, document processing, media generation, billing, and related web and mobile services. This Privacy Policy explains what personal information we collect, how we use it, when we disclose it, how long we keep it, and the choices and rights available to you.

We wrote this policy to be detailed without publicly naming each infrastructure, processing, analytics, payment, or AI vendor we use. Instead, we describe recipients by category and purpose. We may provide additional subprocessor details to enterprise customers or regulators where required by contract or law.

This policy applies to the Springbase website, web app, mobile app, desktop-related experiences, APIs, support communications, and any feature that links to this policy.

2. Our Role

For individual users, Springbase generally acts as the controller or business for the personal information we collect to provide and improve the service. For enterprise, team, or customer-managed workspaces, Springbase may process some content on behalf of the organization that provides access to the workspace. In those cases, your organization may control certain settings, exports, retention requirements, access permissions, and legal instructions.

3. Information We Collect

Account and Identity Information

When you create or use an account, we collect identifiers and account details such as your name, email address, profile image if you provide one, authentication identifiers, login status, workspace membership, account role, plan, credits, locale, time zone, and account creation or update timestamps.

Profile, Preferences, and Settings

We collect profile and preference information you choose to save, including display name, username, avatar, bio, default model settings, favorite models, AI mode preferences, custom instructions, theme, font, appearance settings, notification preferences, consent choices, onboarding state, and product education state.

Chat, Agent, and AI Content

We collect content you submit to AI features and content generated in response, including prompts, messages, AI responses, reasoning or status metadata when available, selected model and mode, conversation titles, attached files, images, screenshots, code, generated assets, recipe inputs, agent instructions, tool outputs, web-search queries derived from your instructions, and usage metadata such as timestamps, token counts, credits, cost estimates, and execution status.

Files, Knowledge Bases, and Document Data

When you upload files or build a knowledge base, we collect the original file, file name, file type, file size, upload metadata, extracted text, parsed tables or slides where applicable, document chunks, embeddings, project metadata, search queries, retrieval results, and processing status. Supported uploads may include images, PDFs, spreadsheets, presentations, text files, and office documents.

Meetings, Audio, Voice, and Transcription Data

If you use voice, meeting, or transcription features, we collect audio you record or upload, meeting chunks, meeting metadata, generated transcripts, summaries, action items, speaker or participant labels you provide, selected people or meetings used as context, recording status, duration, and processing diagnostics.

Canvas, Recipes, Pipelines, and Shared Content

We collect content and metadata for assets, mini-apps, documents, diagrams, recipes, pipelines, schedules, public or private share links, comments, ratings, favorites, published slugs, execution results, generated media, persistent asset storage, and collaboration or discovery interactions.

Connected Services and Agent Integrations

If you connect an outside account or tool, we collect connection metadata, authorization status, selected toolkits, scopes, encrypted credentials or tokens where needed to operate the connection, action history, and the content necessary to carry out your instructions. The external account provider may also process data under its own terms and privacy policy.

Billing, Subscription, and Transaction Data

For paid plans, credits, invoices, enterprise billing, mobile purchases, coupons, referrals, and related account administration, we collect transaction identifiers, subscription status, plan, billing interval, renewal and cancellation dates, invoice metadata, limited payment method details such as card brand and last four digits when provided by a processor, tax or billing address information, receipts, refund status, and customer support notes. Full card numbers and security codes are handled by payment processors, not stored by Springbase.

Device, Browser, App, and Log Data

We automatically collect technical data such as IP address, hashed or truncated IP where used for privacy protection, device type, operating system, app version, browser type, language, time zone, referring page, session events, feature usage, authentication logs, API usage, request identifiers, crash logs, performance metrics, security events, and diagnostics needed to run and protect the service.

Mobile Permissions and Local Device Data

The mobile app may request access to your microphone, camera, photo library, files, notifications, and location. We use these permissions only when you enable or invoke a feature, such as recording a voice note, adding an image to chat, saving generated media, uploading a document, receiving notifications, or filling a recipe input with your current location. Some data may stay on your device unless you choose to upload, send, save, or process it through Springbase.

Support, Feedback, and Communications

When you contact us, respond to a survey, report a bug, request help, or interact with account notices, we collect your contact details, message content, attachments, support history, and any information needed to respond.

4. How We Collect Information

• Directly from you: when you create an account, type prompts, upload files, record audio, configure settings, connect tools, buy a plan, or contact us.
• Automatically: when your browser, device, or app sends logs, cookies, analytics events, crash reports, or security signals.
• From connected services: when you authorize Springbase to access or act on data from another service.
• From payment and app-store processors: when they send us purchase, subscription, invoice, receipt, refund, or entitlement updates.
• From workspace administrators or teammates: when they invite you, assign roles, manage enterprise settings, or share content with you.

5. How We Use Information

• Provide the service: authenticate you, route AI requests, preserve chat history, process files, generate assets, transcribe audio, run recipes and agents, sync settings, and deliver requested features.
• Personalize your experience: remember model preferences, theme, selected modes, custom instructions, prior context, recent work, and workspace settings.
• Operate AI features: prepare prompts, retrieve relevant context, call model and media-processing systems, stream responses, generate titles or summaries, calculate usage, and prevent abuse.
• Manage accounts and billing: process subscriptions, credits, invoices, refunds, coupons, mobile entitlements, enterprise seats, tax records, and customer communications.
• Maintain safety and security: detect fraud, enforce rate limits, verify sessions, investigate abuse, protect systems, debug errors, audit access, and prevent unauthorized activity.
• Improve Springbase: understand feature performance, fix bugs, develop product improvements, evaluate reliability, and measure aggregate usage trends.
• Communicate with you: send transactional messages, security alerts, product notices, support replies, policy updates, and marketing communications where permitted.
• Comply with law: respond to legal requests, enforce our terms, preserve audit records, meet tax and accounting obligations, and process privacy rights requests.

6. AI and Automated Processing

Springbase uses AI systems to generate text, code, images, videos, summaries, transcripts, research results, titles, classifications, workflow plans, and tool actions. AI outputs may be inaccurate, incomplete, or unexpected. You should review important outputs before relying on them.

To operate AI features, we may send relevant content to AI model providers, routing services, transcription systems, media generation systems, document parsing systems, embedding systems, search systems, and tool-execution services. The content sent depends on the feature you use and may include your prompt, conversation history, selected files, retrieved knowledge-base chunks, meeting snippets, image or audio inputs, profile instructions you saved, and technical metadata needed to return a response.

We do not sell your chat content. We do not use your private customer content to train public foundation models. We also configure and contract with processing providers to restrict their use of your content to providing the requested service, maintaining security, complying with law, and other limited operational purposes. If you connect an external account or intentionally send content to a third-party destination, that external service may process the data under its own policies.

Springbase may use de-identified, aggregated, or statistical data to understand model reliability, latency, costs, feature adoption, and abuse patterns. We may also use data you deliberately make public, submit as feedback, or authorize us to use for improvement, subject to your settings and applicable law.

7. When We Disclose Information

We disclose personal information only as needed for the purposes described in this policy. Categories of recipients include:

• Cloud hosting, database, storage, and infrastructure providers: to host the app, store files, run APIs, manage authentication, and deliver the service.
• AI model, routing, media, transcription, document, search, and embedding providers: to process prompts, files, audio, images, video, retrieval, and generated outputs.
• Connected-service and automation providers: to create OAuth connections, list available tools, and execute actions you request through agent features.
• Payment, app-store, tax, invoicing, and subscription processors: to process purchases, renewals, credits, refunds, receipts, invoices, coupons, and account entitlements.
• Email, notification, and communication providers: to send transactional notices, security messages, support replies, and marketing messages where permitted.
• Analytics, performance, crash, and error-monitoring providers: to understand usage, diagnose issues, detect failures, and improve reliability.
• Security, anti-abuse, rate-limiting, queue, and audit providers: to prevent fraud, enforce limits, process background jobs, and maintain operational logs.
• Professional advisers: including lawyers, auditors, accountants, insurers, and compliance consultants.
• Affiliates, successors, or acquirers: if we reorganize, merge, sell assets, finance, or transfer part of our business, subject to appropriate protections.
• Authorities or other parties where required: when we believe disclosure is necessary to comply with law, enforce terms, protect rights, investigate abuse, or respond to valid legal process.
• Other users or the public: when you share, publish, comment, rate, follow, invite, join a team, or otherwise choose to make content or profile information visible.

8. Sale, Sharing, Advertising, and Training Commitments

• We do not sell personal information for money.
• We do not rent or trade your private prompts, files, recordings, transcripts, or knowledge-base content to data brokers.
• We do not use private customer content to train public foundation models.
• We do not knowingly sell or share personal information of children under 16.
• We may use limited advertising, attribution, referral, or marketing cookies only where permitted by your consent settings and applicable law.
• If a privacy law treats certain advertising or analytics disclosures as a "sale" or "sharing," you may opt out by rejecting non-essential cookies or contacting us.

9. Cookies and Similar Technologies

We use cookies, local storage, pixels, SDKs, and similar technologies to keep you signed in, protect sessions, remember preferences, measure performance, understand usage, support referrals and attribution, and improve the service.

Essential Technologies

Essential technologies support authentication, session security, fraud prevention, load balancing, user preferences, privacy choices, and core app functionality. They cannot be disabled through our banner because the service may not work without them.

Analytics Technologies

Analytics technologies help us understand feature usage, page performance, navigation, errors, conversion funnels, and aggregate product trends. Where required, we use them only after consent.

Marketing and Attribution Technologies

Marketing and attribution technologies help us understand how people discover Springbase, measure campaigns, operate referral programs, and avoid showing irrelevant promotions. Where required, we use them only after consent.

Managing Choices

When you first visit Springbase, you can accept, reject, or customize optional cookies. Authenticated users may also have consent records stored with their account. You can use browser controls to block or delete cookies, but blocking essential cookies may prevent sign-in or core features from working.

10. Data Retention

We keep personal information for as long as reasonably necessary to provide Springbase, honor your choices, comply with law, resolve disputes, protect security, and maintain business records. Retention may vary by plan, workspace settings, legal requirements, and whether you delete specific content.

• Account profiles: kept while your account is active, then deleted or de-identified after account deletion except where retention is required.
• Chats, messages, Canvas assets, recipes, pipelines, generated content, and user files: kept until you delete them, your workspace deletes them, or your account is deleted, subject to backups and legal exceptions.
• Knowledge-base documents, extracted text, chunks, and embeddings: kept until the document, project, workspace, or account is deleted.
• Audio, meeting recordings, transcripts, and summaries: kept until you delete the meeting or account, unless a workspace retention setting or legal obligation requires a different period.
• Connected-service tokens and credentials: kept while the connection is active and deleted or revoked when you disconnect, where technically supported.
• Consent records: kept as needed to demonstrate consent, withdrawal, notice version, and compliance history.
• Security, authentication, API, audit, and data-access logs: kept for limited periods needed for security, debugging, incident response, audit, and compliance.
• Billing, invoice, tax, subscription, and transaction records: kept for the period required by accounting, tax, chargeback, and financial laws.
• Backups: deleted on a rolling schedule. Deleted data may remain in encrypted backups for a limited time before automatic expiration.

You can request deletion through account tools where available or by contacting us at [email protected]. Some records may be retained when necessary for security, legal compliance, fraud prevention, tax, accounting, dispute resolution, or enforcement of our agreements.

11. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, encryption at rest where supported, access controls, authentication controls, rate limiting, audit logging, monitoring, vulnerability management, least-privilege practices, file validation, webhook signature verification where applicable, and review of sensitive operational access.

No online service can guarantee absolute security. You are responsible for maintaining the confidentiality of your account, device, sign-in method, workspace invitations, and any content you choose to share publicly or with third-party services.

12. Your Privacy Rights and Choices

Depending on where you live, you may have rights to access, know, correct, delete, export, restrict, object to, or opt out of certain processing of your personal information. You may also have the right to withdraw consent, opt out of marketing, opt out of certain sale or sharing activities, limit certain sensitive-information uses, and appeal a denied request.

You can access, update, export, or delete some information directly in Springbase. For other requests, contact [email protected]. We may need to verify your identity before fulfilling a request. We will respond within the time required by applicable law, and generally within 30 days where no shorter period applies.

United States State Privacy Rights

If a state privacy law applies to you, you may request disclosure of the categories of personal information we collect, use, disclose, sell, or share; the categories of sources; the purposes of collection; the categories of recipients; and the specific pieces of personal information we maintain about you. You may also request deletion or correction and opt out of certain targeted advertising, sale, or sharing activities where applicable.

EEA, UK, and Similar Rights

Where applicable, our legal bases may include contract necessity, legitimate interests, consent, legal obligations, and protection of rights and security. You may have rights to access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to your local supervisory authority.

Marketing and Notifications

You can opt out of marketing emails using unsubscribe links or by contacting us. Transactional, security, billing, and service messages may still be sent when necessary. Mobile push notifications can be managed through app or device settings.

13. Public Sharing and Workspace Controls

Springbase includes features that let you publish or share profiles, recipes, pipelines, assets, documents, links, comments, ratings, and other content. Public or shared content may be viewed, copied, indexed, or reshared by others depending on your settings. Review content carefully before publishing it.

In team and enterprise workspaces, administrators may manage members, plans, policies, access controls, retention settings, audit needs, and billing. Your use of a managed workspace may be subject to that organization's policies in addition to this policy.

14. Children's Privacy

Springbase is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to Springbase, contact us and we will take appropriate steps to delete it.

15. International Data Transfers

Springbase is operated from the United States and may process information in the United States and other countries where we or our service providers operate. These countries may have privacy laws that differ from those in your location. Where required, we use appropriate safeguards for international transfers, such as contractual protections and technical and organizational security measures.

16. Legal Requests, Safety, and Enforcement

We may preserve, access, or disclose information if we believe it is reasonably necessary to comply with law, legal process, regulatory requests, or enforceable governmental demands; enforce our terms and policies; protect the rights, safety, and property of Springbase, users, or others; detect or prevent fraud, abuse, security incidents, or harmful activity; or defend legal claims.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in Springbase, our processing practices, legal requirements, or operational needs. If changes are material, we will provide notice through the service, by email, or by another reasonable method. The updated policy will be identified by the "Last updated" date above.

18. Contact Us

If you have questions, concerns, or privacy requests, contact us at:

InnoventuresAI Inc
Email: [email protected]