Privacy Policy

Smart AI Manager is a vault for the work your AI tools produce. That means you trust us with two very different things: the small amount of information needed to run your account, and the content you choose to store. This policy explains how each is handled, and it is written to be read rather than to be survived.

By accessing or using Smart AI Manager, you agree to this Privacy Policy. If you do not agree with it, please do not use the service. This policy may change from time to time; continued use after a change means you accept the updated policy, so please check back periodically.

The short version: we do not use your vault content to train AI models. We do not sell or rent it. We never receive the password to any AI tool or storage account you connect — those connections use OAuth and can be revoked by you at any time. If you delete your account, your account information is removed from our database.

01 Information we collect from you

Account information

To create an account we collect your email address and a password, which is stored only as a one-way hash — we cannot read it, and nobody at Smart AI Manager can tell you what it is. If you complete a profile we also hold the name and any details you choose to add. If you belong to a workspace or organization, we hold your membership and the role you have been granted there.

Communications

We retain email messages you send us and our replies, so that a support conversation has a history. If you are invited to a workspace, the email address used for that invitation is used to deliver it.

Cookies

We set a session cookie so that you stay signed in as you move between pages, and a security token used to prevent cross-site request forgery. These are set with the HttpOnly, Secure and SameSite attributes, and are required for the application to work — if your browser rejects them, you will not be able to sign in.

02 Your vault content

Your vault holds what your connected AI tools produce and what you upload: conversations, images, video, audio, code artifacts, collections and saved prompts. This content belongs to you. Our rights to it are limited to what is necessary to operate the service — storing it, indexing it so search works, generating previews and thumbnails, and delivering it back to you or to anyone you deliberately share it with.

We do not use your vault content to train, fine-tune or evaluate AI models. We do not sell it, rent it, or make it available to other customers. We do not mine it for advertising.

Content you share using a read-only link becomes accessible to anyone holding that link, for as long as the link remains active. Sharing is always a deliberate action on your part, it applies to a single item rather than to your vault, and a link can be revoked.

03 Connected AI sources and storage

When you connect an AI tool or a storage account such as Google Drive, authorization is granted through that provider’s own OAuth flow. We receive a scoped access token; we never receive or store the password to that account. The token is held so that the connection keeps working, and is used only to perform the actions the connection exists for.

You can disconnect any source at any time, from your dashboard or from the provider’s own account settings. Once revoked, we can no longer reach that account. Note that what you send to a third-party AI provider is also processed under that provider’s privacy policy — connecting a tool does not place its own handling of your prompts under this policy.

If you choose your own Google Drive as the storage target for your vault, the files are held in an account you own and administer. Deleting your Smart AI Manager account does not delete files from your Drive, because that account is not ours to empty.

04 Google user data

Smart AI Manager connects to Google, so this section states specifically what Google user data we request, why we request it, and what we do with it. It applies in addition to the rest of this policy, and where it is more specific, it governs.

What we request, and why

Sign-in — openid, email, profile. Used only to create and identify your account. We receive your email address, name and profile picture. The email address is your account identifier and the address we send service notices to.
Google Drive — drive.file. Requested only if you choose Google Drive as the storage target for your vault. This is a per-file scope: it grants access solely to files you create with, or explicitly open through, Smart AI Manager. It does not allow us to list, read or search the rest of your Drive, and we do not request a scope that would.

How we use it

Google user data is used only to provide the user-facing features you connected it for: signing you in, and storing, listing, previewing and retrieving the vault files held in your Drive. It is not used for any other purpose, and it is never used to train AI models.

How we store it

We do not copy your Drive into our systems — files you keep in Drive stay in Drive. What we hold is the OAuth access and refresh tokens needed to keep the connection working, and the file metadata needed to display your vault (names, sizes, identifiers and timestamps). Both tokens are encrypted at rest and are never written in clear text.

How we share and transfer it

We do not sell Google user data. We do not transfer it to advertising platforms, data brokers, information resellers or credit-worthiness assessors, and we do not use it to serve advertisements. We do not allow humans to read it, except where you have given affirmative agreement (for example, to let us investigate a support request you raised), where it is necessary for security purposes such as investigating abuse, where it is necessary to comply with applicable law, or where the data is aggregated and de-identified for internal operations.

Retention and deletion

You can disconnect Google Drive at any time from your dashboard. When you do, we call Google’s revocation endpoint to invalidate the grant, delete the stored tokens and remove the associated connection records — after which Smart AI Manager no longer appears among the apps connected to your Google Account. You can also revoke access directly from your Google Account permissions, and we will simply lose access.

Deleting your Smart AI Manager account removes your account information and any stored Google tokens. Files that live in your Drive remain in your Drive, because that account is not ours to empty.

Limited Use. Smart AI Manager’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

05 Information collected automatically

Log and security records

Your browser sends certain information to our servers on every request, and this is recorded automatically: IP address, browser and device type, the request itself, referring pages and timestamps. We additionally keep deliberate security records — sign-in attempts, session activity, access to items, administrative changes and errors — which appear to you as your activity timeline and security alerts.

These records exist to keep accounts safe and to let us investigate incidents. They are the mechanism by which unauthorised access can be detected and shown to you.

06 How we use the information we collect

We use the information described above to:

Operate your account, authenticate you and keep you signed in.
Store, index, search and display your vault content back to you.
Maintain the connections to the AI tools and storage accounts you have authorised.
Detect, investigate and respond to abuse, fraud and security incidents.
Enforce rate limits and protect the service from automated abuse.
Provide support when you contact us, and send service notices about your account.
Meet our legal obligations and enforce our Terms of Service.

Providing your email address means you agree to receive service notices at it — security alerts, billing notices and account changes. These are not marketing, and cannot be unsubscribed from while your account is open, because they are how we tell you something has happened to your account. Any optional product or marketing email carries an unsubscribe link and you may opt out at any time.

We do not sell, rent or trade your personal information or your vault content. We share information only in the following circumstances:

Providers you connect. Requests you make to a connected AI tool are sent to that provider in order to be answered.
Service providers. Contractors and infrastructure providers who process data on our behalf to run the service, bound to use it only for that purpose.
People you share with. Anyone you deliberately give a read-only link to, or any member of a workspace you place content in.
Payment processors. If you purchase a paid plan, the information needed to take payment.
Legal process. Where we must comply with a court order, law or regulatory request, or where disclosure is necessary to protect the rights, property or safety of our users or others.
Business transfer. A buyer or successor in the event of a merger, reorganisation or sale of assets. This policy continues to apply to information transferred in that way.

We may produce aggregated or de-identified statistics that cannot be linked back to any individual user — for example, totals of how many accounts use a given feature — and may use those without restriction.

08 How we protect your information

We use technical, physical and organisational safeguards to protect your information. In practice that includes encryption in transit and at rest, passwords stored only as one-way hashes, session regeneration on sign-in, CSRF protection, rate limiting against brute-force attempts, role-based authorisation on every request, and audit logging of access and administrative changes.

No transmission over the Internet is ever completely secure, and no service can promise otherwise. Although we consider our measures appropriate, we cannot guarantee the security of information transmitted to us, and any transmission is at your own risk. If a security breach compromises your personal information, we will notify you in the manner required by applicable law.

Our service is hosted in the United States, and information may be stored on servers in other countries via distributed hosting platforms. If you access the service from the European Union, Asia or any other region whose data protection laws differ from those of the United States, please note that you are transferring your information outside your home jurisdiction and consent to that transfer by using the service.

09 Retention and deletion

We retain your information for as long as your account is active, and for a short period afterwards in case you choose to reactivate. You can delete your account at any time; when you do, your account information is removed from our database. Security and audit records may be retained for longer where we are required to keep them, or where they are needed to resolve a dispute or enforce our agreements.

Please note that deletion is not instantaneous everywhere: there may be latency in removing information from all systems, and copies can persist briefly in backups before those backups age out.

10 Children’s privacy

Smart AI Manager is not intended for children. We do not knowingly collect information from anyone under 13, and children under 13 are not permitted to register or use the service. If we learn that we hold personal information from a child under 13 without parental consent, we will delete it as soon as possible. If you believe we hold information about a child under 13, please contact us.

Email us at support@aidigitalvault.com

11 Other linked services

This policy does not cover information you disclose on any third-party website or service linked from Smart AI Manager, including the AI providers you connect. Your activity on those services is governed by their own policies and terms, which you should review before disclosing personal information to them.

12 Accessing and correcting your information

You can review and update your account information from your profile at any time, and your vault content is yours to edit, export or delete from within the application. If you need help with a request that the interface does not cover — including a request for a copy of your data or its erasure — contact us and we will assist.