Privacy Policy

This policy explains what PAAI (“we”, “the service”) does with your information. Please review and confirm the operator details below with your own legal advisor before launch.

1. Who we are

PAAI is operated by AOM Legacy. For any privacy question, data request or complaint, contact us at privacy@aomlegacy.com.

2. What we collect

• Account data — your email address, display name, business or hotel name and timezone.
• Task data — the tasks you create, their notes, assignees, due dates, priorities and completion history.
• Staff data — names, job titles, departments and contact details you add for your team members.
• Voice input — audio you record in the app is sent to our speech-to-text provider to be turned into text. We store the resulting transcript with the task; we do not retain the audio file after transcription.
• Billing data — subscription status and the customer/subscription identifiers issued by our payment processor. Card details are handled by the payment processor and never reach our servers.
• Technical data — basic request logs and error reports needed to keep the service running and secure.

3. Why we use it

• To provide the service: capturing, assigning, scheduling and chasing your tasks.
• To send the notifications you switch on (assignments, digests, overdue alerts, reports).
• To authenticate you and keep your account secure.
• To take payment and manage your subscription.
• To fix faults and improve reliability.

Our lawful bases under the GDPR are performance of a contract (providing the service), legitimate interests (security, service improvement) and consent where you opt in to optional emails.

4. Staff members you add

When you add colleagues as staff, you are the data controller for their details and PAAI acts as processor on your behalf. You are responsible for telling them their details are held in PAAI and for having a lawful basis to do so.

5. Who we share it with

We use a small number of processors, each bound by a data processing agreement:

• Lovable Cloud (Supabase) — application hosting, database, authentication and file storage.
• Groq — speech-to-text transcription of voice input.
• Stripe — payment processing and subscription billing.
• Resend (via Lovable Email) — delivery of transactional and notification email.

We do not sell your data and we do not use it to train third-party AI models.

6. International transfers

Some processors operate outside the EEA. Where that happens, transfers rely on the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

7. How long we keep it

We keep your account and task data for as long as your account is active. When you delete your account, your profile, tasks, staff records and history are removed immediately. Billing records are retained for as long as tax and accounting law requires.

8. Your rights

You can access, correct, export, restrict or erase your data at any time. Two of these are built into the app: Settings contains a one-click data export and a permanent account deletion control. For anything else, email us and we will respond within 30 days. You also have the right to complain to your local supervisory authority.

9. Security

Data is encrypted in transit. Access to your records is enforced at database level so that one account cannot read another’s data. We run automated security scans and review new high or critical findings.

10. Cookies

PAAI sets only the cookies and local storage entries needed to keep you signed in and to remember your language choice. We do not use advertising or cross-site tracking cookies.

11. Changes

If we make a material change to this policy we will notify account holders by email before it takes effect.