Privacy and data
Your content is never used to train AI models. Here is who processes what, how long it is kept, and how connected-tool tokens are handled.
Updated 2026-10-13
This is a plain summary. The legal text is the Privacy Policy and the Terms, which win if they differ.
Who processes what
| Provider | Why | What they handle |
|---|---|---|
| Supabase | Database, sign-in, file storage and the backend functions that run Pythe. | Everything stored in your account. |
| Vercel | Website hosting, an AI gateway and cookieless page-view counts. | Technical request data and AI requests. |
| AI model providers (xKiro, OpenAI, OpenRouter) | Model access for Pytheus, AI employees, research and planning. | The prompts and context needed for each AI task. |
| Tavily | Web search and page reading for research. | Search queries and the pages being read. |
| Daytona | The cloud computers your AI employees work on. | The files, code and instructions given to a task. |
| ElevenLabs | Voice conversations with Pytheus, if you use them. | Your voice audio and the conversation. |
| Stripe | Checkout, billing and invoices. | Name, email, payment details (held by Stripe). |
| Resend | Sign-up codes and service emails. | Your email address and the message. |
| PostHog (EU cloud) | Product analytics, only if you allow analytics cookies. | Pages viewed, clicks, device and browser, your account ID. |
How long it is kept
- Account and workspace content: while your account is open. You can delete items at any time.
- After you ask to delete your account: personal data is deleted or anonymised within 30 days, and leaves backups as they expire.
- Connected-tool tokens: deleted when you disconnect the tool or delete your account.
- Billing records: as long as tax and accounting law requires, usually six years.
- Product analytics: up to two years, then deleted.
- Server and security logs: a short period set by hosting providers, usually under 90 days.
How it is protected
- Encrypted in transit (TLS) and at rest.
- Row-level security so only you and the people you share with can reach workspace data.
- Connector tokens kept on the server and never put on an agent’s computer. See How agent computers work.
- Approvals for anything that leaves Pythe. See Approvals.
Your rights
You can ask for access, correction, deletion and a copy of your data. The Privacy Policy lists how.