Corvio Privacy PolicyCorvio Privacy Policy

This Privacy Policy explains how NeoFlux AI Pte. Ltd. (“NeoFlux,” “we,” “us,” or “our”) collects, uses, discloses, transfers, stores, and otherwise processes personal data in connection with the Corvio Service (the “Service”); unless otherwise defined in this Privacy Policy, capitalized terms have the meanings in the Terms of Service.

1. Scope; Roles; Controller/Processor Distinction

Depending on the context, NeoFlux may process personal data as a controller (e.g., when you create an Account, purchase a Subscription, or interact with our marketing sites) and/or as a processor (e.g., when an enterprise customer uploads content containing personal data and NeoFlux processes such data on behalf of that customer); where NeoFlux acts as a processor, the applicable Data Processing Addendum (“DPA”) governs, and the enterprise customer is the controller.

2. Categories of Personal Data We Collect

We may collect: (i) Account and identity data, such as name, username, email, phone number, and organization details; (ii) billing and transaction data, such as payment method identifiers, billing address, invoices, and tax information, noting that payment card data is typically processed by our payment service providers and not stored by us in full; (iii) usage and device data, such as IP address, device identifiers, browser type, operating system, timestamps, feature usage metrics, and diagnostic logs; (iv) support and communications data, such as messages sent to support, feedback, and survey responses; (v) Content data to the extent it includes personal data, including personal data contained in documents, prompts, notes, messages, or attachments you upload; and (vi) security and compliance data, such as authentication logs, access records, and abuse signals.

3. Sources of Personal Data

We collect personal data directly from you, from your organization (if you are an authorized user under an enterprise account), from your devices and browsers via cookies and similar technologies, from integrations you enable, and from service providers that help us operate the Service.

4. Purposes of Processing and Legal Bases (Where Applicable)

We process personal data to provide and operate the Service, including account creation, authentication, hosting content, generating Output, providing search/retrieval, enabling collaboration, and delivering customer support; to administer subscriptions, billing, and payments; to secure the Service, prevent fraud, detect abuse, and enforce policies; to improve and develop the Service, including debugging and performance monitoring; to communicate with you about the Service, including transactional notices, security alerts, and updates; and to comply with legal obligations and protect rights; where applicable law requires a legal basis, we rely on one or more of contract necessity, legitimate interests (e.g., service security and improvement), consent (e.g., marketing communications where required), and legal obligation.

5. AI and Content Processing; Training Practices

The Service may process Content, including personal data contained in Content, to provide AI-enabled features. We do not use Customer Content to train public or shared foundation models, and we require AI inference providers not to train their foundation models on Corvio inputs or outputs. We may use de-identified and aggregated Service Analytics that does not reasonably identify individuals or contain Customer Content to operate, secure, and improve the Service.

6. Disclosure of Personal Data; Categories of Recipients

We may disclose personal data to: (i) service providers and subprocessors who assist with hosting, analytics, customer support, payment processing, and security; (ii) your organization’s administrators if you are a user under an enterprise account; (iii) third-party integrations you enable, at your direction; (iv) professional advisers such as lawyers, auditors, and insurers; and (v) governmental authorities where required by law or to protect rights and safety; we do not sell personal data in the ordinary meaning of “sell” under common privacy statutes.

7. International Transfers

Because we operate globally, personal data may be transferred to and processed in countries other than your country of residence; where required, we implement appropriate safeguards, which may include contractual protections, such as standard contractual clauses, and measures designed to protect data in transit and at rest.

8. Data Retention

We retain personal data for as long as necessary to provide the Service, to fulfill the purposes described herein, to comply with legal obligations, to resolve disputes, and to enforce agreements; retention periods vary by data type and context, and we may retain certain logs and backups for a limited period even after deletion requests, consistent with security and operational needs.

9. Security

We maintain reasonable administrative, technical, and organizational measures designed to protect personal data; however, no method of transmission or storage is fully secure, and we cannot guarantee absolute security.

Corvio's servers must process Content to provide storage, search, retrieval, AI editing, and related features. This is not end-to-end encryption and does not mean that employees have default access. Human access to Workspace content is exceptional, read-only for support and diagnostic use, restricted to authorized staff, time-limited, purpose-bound, and audited. Workspace owners and administrators can manage Support Access in Settings → Security & privacy. Emergency access is separately restricted to security, abuse, service-integrity, or legal obligations and requires an incident reference and post-review.

10. Your Rights and Choices

Subject to applicable law, you may have rights to access, correct, delete, or port your personal data, to withdraw consent (where processing is based on consent), and to object to certain processing; if you are an authorized user under an enterprise account, you should direct requests to your organization’s administrator, and we will assist the controller as required; you may manage certain settings within the Service, including optional controls related to data usage if offered.

11. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service, remember preferences, measure performance, and improve user experience; you can control cookies through browser settings, though disabling cookies may affect functionality; further details may be provided in our Cookie Notice.

Where enabled, we may use analytics and session replay tools, including PostHog product analytics and Microsoft Clarity, to understand product journeys and how users navigate public pages, authentication flows, and selected low-sensitivity product surfaces. Session replay is intended to reconstruct interface behavior such as clicks, scrolls, navigation, and layout state; it is not intended to collect document content, prompts, AI responses, uploaded files, or other customer content, and Corvio applies masking controls for sensitive workspace areas. We use these tools to diagnose usability issues, improve onboarding, and detect friction such as dead clicks or excessive scrolling, subject to applicable consent requirements and cookie controls.

12. Corvio Chrome Extension

On first install, the extension may ask you to sign in to Corvio and confirm a Workspace. It stores a small local connection receipt containing the Corvio user and Workspace identifiers and display labels, plus the connection time. This receipt is only used to present the connected Workspace; it is not an authentication credential, and the extension does not store your Corvio session Cookie, password, access token, or refresh token. Each action still uses the current authenticated Corvio session.

The Corvio Chrome extension reads a page only after you open its Side Panel from the toolbar, use its selection context-menu action, or approve a site-specific sign-in handoff for an active Corvio Browser task. For a page or selection handoff, the extension may process the current HTTP(S) page's URL, canonical URL, title, description, language, selected text, and a bounded amount of visible page text. It does not capture password or other form-field values, browsing history, downloads, content from other tabs, or hidden profile state.

You may optionally enable a floating Corvio shortcut on ordinary HTTPS websites. Chrome then asks for broad HTTPS site access. Before you click the shortcut, the injected shortcut does not inspect page text, selections, forms, DOM content, or sign-in state; it only opens the same tab-scoped Side Panel. Opening the panel may capture bounded current-page context locally, but it is transferred to Corvio only when you submit it. The shortcut is off by default, is not shown on Corvio pages, and disabling it unregisters the script, removes the visible shortcut, and revokes the optional all-sites permission. This permission expands the extension's technical access, including while the separately requested Cookie permission is briefly active, even though Corvio's implementation continues to limit Cookie reads to the finite sites you selected.

If selected text is present, the extension transfers that selection rather than the page's full visible text. Selected text is limited to 20,000 characters and visible page text to 60,000 characters. The handoff is held in Chrome session storage behind a random one-time identifier for no more than ten minutes and is removed after Corvio completes the handoff.

You may attach up to five local files, each no larger than 10 MiB, from the Side Panel. The extension temporarily stores their bytes in its local IndexedDB and places only bounded file metadata behind the one-time handoff identifier. The authenticated Corvio page reads the files in bounded chunks and sends them through the Workspace's normal file validation and upload path. The temporary extension copies are removed when the handoff completes, fails cleanup, or expires after ten minutes; selecting a file alone does not save it to Corvio.

You may also explicitly choose “Use this tab,” enter a task, and start it. In that mode, Chrome shows its debugger-control warning and the extension attaches only to the selected tab for up to thirty minutes. Corvio may receive bounded visible text, page identity, and semantic descriptions of visible controls, and may ask the extension to click, scroll, navigate within the approved origin, or fill the value required by your task. The selected tab remains native and visible in Chrome. Tab identifiers, DOM selectors, Chrome profile data, raw cookies, passwords, one-time codes, and entered form values are not returned to Corvio. The attachment ends when the task stops, the tab closes, the grant expires, or you disable the extension.

When an active Corvio Browser task presents a finite list of required sites, you can select which sign-ins to reuse and approve one optional Cookie and HTTPS origin request for only those sites. The extension reads no more than 80 Secure cookies per selected site, encrypts each site separately with its one-time task public key, and removes the optional permissions after the attempt. It does not enumerate or export your browser's full Cookie store. Raw Cookie values are not exposed to webpage JavaScript, conversations, AI models, analytics, or Corvio's database. The short-lived encrypted handoff expires within five minutes.

Corvio Mac app

In the Corvio Mac app, you may instead ask Corvio to scan local Google Chrome profiles. That scan returns profile labels and Secure-cookie counts by site; Cookie values are not read until you choose one profile, select up to twelve sites, and start the import. The app then asks macOS Keychain for Chrome Safe Storage access once for that selection, uses that password once to derive Chrome's local Cookie key, immediately clears the password buffer, and encrypts each selected site locally to a one-time Browser task key. The temporary derived key is cleared when the selection completes or expires. Cookie values are not exposed to the renderer, conversations, AI models, analytics, logs, or Corvio's database. They are handled briefly in the Mac main process and target Browser Session, and the resulting login state is retained only in the selected site's Browserbase Context. Corvio does not request Full Disk Access, copy your Chrome profile, or bypass unsupported Chrome encryption.

Information received through Chrome APIs is used only to provide, maintain, secure, and support the user-requested extension and related Corvio functionality. It is not sold, used for personalized advertising, or used to determine creditworthiness. Corvio applies the same purpose-bound, time-limited and audited human-access controls described above. During staged enforcement, necessary diagnostic access without active Support Access is labeled as a transition exception; emergency access remains limited to security, abuse, service-integrity, or legal obligations.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

13. Children

The Service is not directed to children under 13 (or the age defined by local law), and we do not knowingly collect personal data from such children.

14. Updates

We may update this Privacy Policy from time to time by posting a revised version and updating the “Last Updated” date.

15. Contact

For privacy inquiries, contact: privacy@corvio.ai; for legal notices: legal@corvio.ai; postal address: 68 CIRCULAR ROAD, #02-01, SINGAPORE 049422.