DAVAI LLC · Last updated: 1 September 2026
DAVAI LLC ("we") provides DAVAI Trace. This Privacy Policy explains what information we collect when you use the Service, why, how long we keep it, and the choices you have.
Where you use the Service as part of an organization, that organization controls the workspace and its content. For content you submit in that context, the organization is the data controller and we act as a processor on its behalf under the Data Processing Addendum. This Policy still describes what we do with that data.
Account information — your name, email address, organization and role, and the authentication details needed to sign you in: a hashed password (never stored in plaintext), single sign-on identifiers if you use SSO, and multi-factor secrets and recovery codes if you enable MFA.
Content you submit — the questions you ask, the documents you upload, the reports and projects you create, comments and team messages, and the settings that govern them.
Usage and billing records — which features you used and when, the model calls a run consumed and their cost, credit ledger movements, seat changes, and charges. We keep these to bill accurately, to show organization administrators where their spend went, and to defend a chargeback.
Security and audit records — sign-ins, administrative actions, sharing and export events, and access grants and revocations.
Technical information — IP address, browser and device type, timestamps, and error diagnostics.
We do not use advertising trackers, and we do not buy personal data about you from third parties.
To provide the Service and generate the results you ask for; to authenticate you and keep accounts secure; to meter usage and bill it; to detect, investigate, and prevent abuse and fraud; to provide support; to understand aggregate product usage so we can improve it; and to meet legal, tax, and accounting obligations.
We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
We rely on: performance of a contract, to provide the Service you have subscribed to; legitimate interests, to secure the Service, prevent abuse, and improve the product, balanced against your rights; legal obligation, for tax, accounting, and lawful requests; and consent, where we ask for it, which you may withdraw at any time.
Generating a report or answering a question requires sending relevant material — your question, retrieved records from public sources, and, where you have chosen to include them, passages from documents you uploaded — to the language-model providers listed in section 6.
Those providers process that material only to return a result to us. Under our agreements with them, they do not use it to train their models. We do not use it to train models of our own.
If you would rather your uploaded documents were not sent to a model provider at all, you can run a report using only public sources; the run-setup screen offers this choice before anything is spent.
We use the sub-processors listed on this page and on our Trust page to run the Service. Each is bound by contractual confidentiality and data-protection terms. The list names every third party that may process customer content or personal data, including every language-model provider, and we keep it current as part of the change that adds or removes one.
We will give notice of a new sub-processor before it begins processing customer content, so that a customer with a Data Processing Addendum can raise a reasonable objection.
| Provider | Purpose | Region |
|---|---|---|
| phoenixNAP | Application, database and knowledge-graph hosting | United States |
| Anthropic (Claude) | Language-model inference for report generation and chat | United States |
| OpenAI | Language-model inference for evidence classification and enrichment steps within the pipeline | United States |
| Moonshot AI (Kimi) | Language-model inference for polarity grading of PUBLIC literature (published abstracts) and relationship extraction. Under an enterprise provider policy it never receives customer documents, chat prompts or report drafts — those are routed to the US providers above. | Singapore / China |
| WorkOS | Authentication, single sign-on and directory sync | United States |
| Optional Google sign-in, and outbound transactional email | United States | |
| Stripe | Subscription billing and payment processing | United States |
| Cloudflare | Encrypted off-site backup storage and DNS | United States |
| Sentry | Application error monitoring and diagnostics | United States |
Each customer's data is separated at the database itself using row-level security, so isolation does not depend on an application query being written correctly. Access is role-scoped within an organization, and administrative access on our side is limited to staff who need it and is recorded.
Data is encrypted in transit using TLS. Backups are encrypted at rest with AES-256 before leaving our infrastructure. Passwords are hashed, and multi-factor authentication is available to every account.
We keep an audit trail of security-relevant events, including sign-ins, sharing, exports, and administrative actions.
No system is perfectly secure. If a breach affects your personal data we will notify you and, where required, the relevant supervisory authority, without undue delay.
The Service is hosted in Ashburn, Virginia, United States. Backups are stored with a US-based provider. Our sub-processors are listed with their processing regions, and one language-model provider processes data outside the United States and the EEA.
Where personal data is transferred out of the EEA or the UK, we rely on appropriate safeguards for that transfer, including the European Commission's Standard Contractual Clauses and the UK Addendum where applicable.
Account and content data — for as long as your account is active. After termination you may request an export for 30 days, after which we delete or irreversibly anonymize it, except where we must retain it by law.
Backups — database backups are retained for 14 days on our own infrastructure and 30 days off-site in encrypted form, then deleted. Content you delete disappears from the live Service immediately and ages out of backups within that window.
Billing and tax records — retained for the period required by law, typically seven years, independently of account deletion.
Security and audit logs — retained for up to 12 months, and longer where an active investigation requires it.
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, to receive it in a portable format, and to withdraw consent where we relied on it. Exercising these rights will never result in discriminatory treatment.
To make a request, contact privacy@davai.ai. We will verify your identity and respond within the period the applicable law requires. If you are a member of an organization's workspace, we may need to direct your request to that organization, and we will tell you if so.
If you are in the EEA or the UK, you also have the right to complain to your local supervisory authority.
We use a single strictly-necessary session cookie to keep you signed in. It is HttpOnly, so page scripts cannot read it, Secure, so it is only ever sent over HTTPS, and SameSite=Lax. It carries no advertising or cross-site tracking function, and we do not set third-party advertising cookies.
Clearing it signs you out. Blocking it prevents you from signing in at all, because it is how the Service recognizes your session.
The Service is intended for professional use and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@davai.ai and we will delete it.
We may update this Policy. For material changes we will give notice through the Service or by email before they take effect, and we will update the date at the top of this page.
DAVAI LLC — privacy questions and data-rights requests: privacy@davai.ai. General enquiries: info@davai.ai.