Version 2 · 22 October 2026
Privacy Policy
Controller
The data controller is Arkay Labs Ltd, registered in England and Wales. You can contact us at admin@svare.ai.
What we collect
We collect your account email address and a password hash, handled by Supabase Auth. We collect OAuth tokens for the email provider (Gmail or Outlook) and the Shopify store you connect. These tokens are encrypted with AES-256-GCM and held only on our servers. We read order and delivery metadata from your connected accounts to ground the drafts Svare writes. We keep usage and billing records through Stripe. If you join our waitlist, we collect your email address.
What we deliberately do not keep
We never store the raw body of a customer email. We store a customer's sender address only as a SHA-256 hash, never in plain text.
Google user data
If you connect a Gmail account, Svare asks for two Google permissions. gmail.readonly lets us read the support messages in your mailbox so we can triage them and ground a reply in the thread. gmail.compose lets us save a reply as a draft in your mailbox and, once someone on your team approves it in Svare, send that reply from your address. We never send a message you have not approved. We use this data only to provide and improve the features you see in Svare: sorting your support mail, drafting replies, and sending the ones you approve. We do not use it for advertising, we do not sell it, and we do not use it to train generalised AI or machine learning models. Our staff do not read your email, except where you ask us to for support, where it is needed to investigate abuse or a security incident, or where the law requires it. We transfer Google user data to third parties only to provide those features (for example Anthropic, which drafts replies, as described below), to comply with the law, or as part of a merger or sale of the business with notice to you. We do not store the raw body of a customer email; the replies Svare drafts are stored encrypted. Svare's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting Google and deleting your data
You can disconnect Gmail at any time from Settings, Connections in Svare. Disconnecting revokes our access with Google and deletes the stored token. You can also remove Svare from your Google Account under Security, Third-party apps with account access. To delete the rest of your data, cancel your account or email admin@svare.ai; we complete deletion within 30 days.
Why we process it
We process this data to provide the service: drafting replies and looking up orders. We also use it to bill you and to keep the service secure. If you are on our waitlist, we only use your email address to contact you about Svare's launch. We never sell it or share it for marketing.
AI processing
Email content is processed by Anthropic, using Claude models, as a subprocessor to produce triage and draft replies. Anthropic does not use this content to train their models.
Subprocessors
We use the following subprocessors: Supabase for our database and authentication, Vercel for hosting, Anthropic for AI drafting, Stripe for billing, Upstash for rate limiting, Inngest for job scheduling, Google and Shopify for the accounts you connect, and TrackingMore for delivery status.
Retention and deletion
We delete your account data within 30 days of cancellation. You can request an export of your data at any time. If you want to be removed from our waitlist, email admin@svare.ai.
Your rights
Under UK GDPR, you have the right to access, correct, erase, and receive a copy of your data, and to object to how we process it. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO).
AI processing and subprocessors
Svare uses Anthropic (Claude) to triage messages and draft replies, and Anthropic is a subprocessor for that purpose. Under Anthropic's commercial terms your data is never used to train models and API logs are deleted within days. When Svare drafts payment dispute evidence, the model receives placeholder tokens instead of personal details: names, addresses, email addresses and tracking numbers are filled in from your records after drafting, and never leave Svare's systems. Svare also uses carrier tracking services (currently TrackingMore) to look up delivery status by tracking number, and connects to your own carrier and payment accounts with the credentials you provide, only to fetch the records described here.
Payment dispute evidence
When a payment dispute is opened against an order, Svare assembles evidence to defend it, which can include the customer's name and address, the support email thread for that order, delivery records, and delivery confirmation images from your carrier. This evidence exists only to defend the dispute. It is encrypted at rest, is never used for any other purpose, and is deleted 90 days after the dispute finally closes. Where a deletion request arrives while a dispute is still open, UK GDPR article 17(3)(e) lets the evidence be retained until the dispute is resolved; the request is logged and completed once the dispute closes.
Delivery confirmation images
Carriers may capture a photo or signature at delivery. Where your carrier account allows it, Svare retrieves that image only when a dispute needs it, stores it encrypted alongside the dispute evidence, and deletes it on the same 90 day schedule. These images are treated as personal data.
Questions: admin@svare.ai