## PrivacyPolicy

_Last updated 1st Feb 2026_

1. Who We Are  
Prava (“ _we_,” “ _our_”) operates **Prava Payments**, a payments platform that lets AI agents initiate, receive, or orchestrate transactions on behalf of users.

2. Data We Collect  
**Account & identity data:** Name, email, profile photo — used for account creation and authentication.

**Payment metadata:** Tokenized card IDs, transaction references, amounts — used for processing and reconciling payments.

**Usage logs:** IP address, device information, feature events, error traces — used for security hardening, debugging, and feature improvements.

**Optional content:** Messages or files you send to agents — used solely to execute the requested workflow.

**Google OAuth disclosure.**  
Our use and transfer of information received from Google APIs will adhere to the **Google API Services User Data Policy, including the “Limited Use” requirements**. [Google for Developers](https://developers.google.com/terms/api-services-user-data-policy)

3. How We Use Your Data  
- Authenticate you and secure your sessions  
- Run payment or workflow actions you explicitly trigger  
- Improve visible product features (model performance, UI flows, fraud controls)  
- Comply with legal obligations and prevent abuse

We **never** sell or share personal data with advertisers or data brokers. Transfers occur only: (a) to payment processors and sub-processors bound by similar confidentiality and security obligations; (b) under compulsory legal process; or (c) with your explicit consent.

4. Your Choices & Rights  
- **Revoke Google access** at any time via your Google account’s security settings.  
- **Delete account** by emailing _support@prava.space_; we erase or anonymize your data within 30 days unless retention is required by law.  
- **Access / correct data** through in-app settings or by contacting us.

5. Security  
We encrypt data in transit (TLS 1.3) and at rest (AES-256 or stronger). Access to production systems is protected by MFA and least-privilege IAM.

6. International Transfers  
Data may be processed outside your jurisdiction (e.g., in the US/EU/India) under suitable contractual safeguards (SCCs).

7. Children  
Prava is **not directed to children under 13** and we do not knowingly collect their personal information.

8. Changes to This Policy  
We may update this Privacy Policy **at any time**. Material changes will be posted here; continued use of Prava after changes constitutes acceptance. When updates involve **new uses of Google user data**, we will obtain fresh consent as required by Google policies. [Google for Developers](https://developers.google.com/terms/api-services-user-data-policy)

9. Contact  
Questions? Email: support@prava.space