Privacy Policy

Last updated: 30 August 2026. This describes how Aivimat One actually works today. It is not a claim of zero retention, on-device-only processing, or anonymity.

Controller: AIVIMAT LTD. Company number 17088386. Registered in England and Wales. Registered office: Flat 11 Quartz House, 15 Masonry Place, Hayes, England, UB3 1EG. Privacy contact: privacy@aivimat.com.

Authenticated account

When you create an account we store your email and authentication records (Amazon Cognito, region eu-west-2) so you can sign in on web, iPhone and Android.

Private file storage

Documents and images you attach are stored as objects you own, with access gated by your signed-in identity. Historical files are opened with short-lived server URLs, not by keeping the file only in the browser.

Secure access

API access uses signed-in credentials. Guest use is limited and enforced on the server. We do not put provider API keys in the website or mobile apps.

What we collect

• Account data — email address and authentication records when you create an account.
• Guest identifiers — a device-generated guest id and an unauthenticated identity id so we can enforce the one free guest completion. These are not a full account.
• Conversation data — messages you send and replies we return, plus conversation titles and timestamps, when you are signed in so history can sync across your devices.
• Files — documents or images you upload, stored as objects you own.
• Usage and routing telemetry — request ids, task type, complexity, mode, selected internal model, latency, token counts, actual inference cost, success/failure, and product signals such as thumbs up/down or regenerate. We do not use this in V1 to automatically retrain routing weights.
• Subscriptions — when store billing is live, entitlement state is verified on our servers. Apple and Google process payments.

Model / provider processing

To generate an answer, the relevant prompt, conversation context and any attached file content needed for the task are sent to an inference provider through a server-side gateway. Aivimat One chooses which intelligence to use. You should assume providers process that content to return a result.

Private mode is stricter: we only use provider routes that are configured to deny training/data collection and to request zero-data-retention where the gateway supports it. Private mode does not mean Aivimat stores nothing. We still keep the account, conversation and usage records described here unless you delete them, and we still operate the service from AWS in eu-west-2.

Where data is processed

Primary Aivimat systems are in AWS London (eu-west-2). Inference providers may process content in other regions. We do not use us-east-1 as the product home region.

Legal bases (UK GDPR)

We process account and service data to perform the contract (providing the app), and limited telemetry to operate, secure and cost-control the service (legitimate interests). You may object or request access, correction, restriction or erasure as described below. We do not sell personal data.

Account deletion

Guest quota records are kept so the one-completion limit cannot be reset by reinstalling alone. Signed-in conversations remain until you delete them or delete your account. Account deletion from the app or website deletes the Cognito user and owned conversations, files and preferences we can reach. Some operational logs and cost/audit records may be retained for a limited period for security, abuse prevention and accounting. Historical usage events are not edited after the fact.

Responsible AI

Outputs can be wrong. Aivimat One is not a professional legal, medical or financial adviser. You can report a response from the chat tools. Reports help us operate the service; they do not guarantee a particular model or outcome.

Children

Aivimat One is not directed at children. Do not create an account if you are below the age required by the App Store or Google Play in your country.

Your rights

UK users may contact us at privacy@aivimat.com to access, correct or delete personal data, or complain to the ICO. Use in-app or website Delete account for the fastest deletion path we currently offer.