Privacy Policy

1. Who we are and who this policy covers

This Privacy Policy explains how poneva handles personal data when people use our website, Poneva Chat, signup and login pages, dashboard, public demos, embedded widgets, and related tools for creating and managing AI shopping assistants. It also applies to people who interact with poneva-hosted demos or merchant-deployed assistants where poneva processes that interaction.

Poneva AB, company registration number 559536-8522, c/o Simon Skoog, Ruddammsvägen 4, 114 21 Stockholm, Sweden, is responsible for this policy.

2. Information you give us directly

We may collect information such as:

• your email address, display name, and account details;
• login and authentication data, including password hashes and OAuth identifiers;
• store URLs, onboarding responses, prompts, branding, and assistant settings;
• support messages, feedback, and other communications you send us; and
• demo, sharing, and deployment choices you make inside the product.

When you join the waitlist on our website, we send your name, work email, company, title, optional message, submission time, IP address and browser user agent to our team's inbox through our email provider. We use the email to respond to your request and keep it as our record of that communication, subject to the retention principles below. Replies go to the email address you entered.

3. Conversation and assistant interaction data

When you use a poneva assistant, public demo, or embedded widget, we may process conversation content, assistant replies, tool-result context, session identifiers, page or store context needed to answer the request, and related interaction metadata. This helps us run the assistant, keep session continuity, investigate issues, and improve reliability and safety.

Voice input is optional and starts only when you use the microphone control in Poneva Chat. Your device then streams what you say to one of Poneva's cloud speech providers and shows the text as it is recognized. Your chat messages and unsent draft text are not sent with the audio. To recognize names and terms, Poneva may send the provider a short vocabulary list built from your company: its name, the display names of its members, the names of the attendees of a meeting you are recording, and terms from company knowledge your company has approved. The spoken language is detected automatically; your company's working languages may be sent to the provider as hints. Your selected interface language does not restrict what you can dictate. Transcription quality can vary by language, accent, recording conditions, and subject matter, and typed chat remains available. In dictation mode, the resulting transcript is placed in the message composer for you to review and nothing is sent until you send it; if you send it, we handle it like conversation content you typed yourself. Until you insert or discard the text, your device keeps a temporary copy of the dictation audio in browser storage so that a failed transcription can be retried. Poneva holds dictation audio in memory for the active request only and does not add it to your chat or persistent application storage. The microphone control is provided by Poneva Chat and does not use Siri or your browser's speech-recognition service.

Voice mode is a separate, optional way to talk with Poneva Chat. After you enter it with a microphone gesture, a completed utterance can become a chat message automatically after a short undo window. The app shows when it is listening, lets you cancel before sending, and lets you leave voice mode. Voice instructions use the same AI models and tools as typed messages. Changes to your data requested through voice wait for your confirmation. Speech providers receive audio and the company vocabulary described above; a sent voice transcript is kept as part of your conversation.

Read-aloud is optional where configured. To read answers aloud and provide spoken replies, Poneva sends selected answer text and approved pronunciation entries to ElevenLabs or Amazon Polly. Provider-default retention and use terms apply unless the provider account has different terms. Poneva does not keep read-aloud audio in server storage as a durable chat attachment.

Meeting recording is optional and starts only when a member chooses Record in Poneva Chat and confirms that everyone in the meeting knows it is being recorded; Poneva stores the time of that confirmation. A recording captures the voices of everyone who can be heard, including guests who do not use Poneva, together with the attendee names and email addresses the member enters. While the meeting is recorded, the audio is uploaded to Poneva's storage in short parts (the device keeps each part until it is saved), and it may be streamed to a speech provider to show a provisional live transcript, which is stored while the meeting records. After the recording stops, Poneva keeps it as one audio file in the company's workspace storage and sends it to cloud speech providers to produce the transcript and the speaker turns, and to a second provider whose reading is used to check the transcript. To check disputed words, Poneva sends transcript passages, attendee names, company vocabulary, the company's knowledge overview page with its page titles, and relevant company-knowledge search results to its AI model provider. To write meeting notes, it sends the whole transcript, up to 160,000 characters, with speaker and attendee information and approved company knowledge. The recording, its transcript and its notes are private to the member who recorded the meeting. If that member asks Poneva in chat to suggest a change to the company's knowledge from the meeting, the suggestion names the meeting; a reviewer who cannot open the meeting sees only its title, never its transcript or notes.

You can also upload an existing meeting audio file. Poneva keeps that file in the company's workspace storage and sends it to speech providers for transcription and speaker turns; transcript checking and notes use the processing described above. The uploaded meeting and its notes are private to the member who uploaded it. Uploaded audio may also contain other people's voices.

When the meeting voice pass is enabled, Poneva analyzes retained meeting audio on its own host to compare voice segments, improve playback samples, suggest speaker merges and highlight uncertain transcript rows. Temporary voice representations stay within that processing worker. Suggestions do not change a speaker's name until an authorized person confirms them.

Voice signatures are optional and off for a company until its owner enables them. You must also agree and enroll yourself. Poneva derives a numerical voice template from your recording or from a meeting segment you confirmed as your own, and stores it encrypted for your account within your company. With your current consent, a strong match can automatically name you in a company meeting, visibly marked with an Undo action; less certain matches are suggestions for confirmation. It does not match people across companies. The earlier suggestion-only consent requires a new explicit agreement and fresh enrollment before this automatic naming is used. Enrollment recordings are not kept. You can withdraw and delete your template; switching signatures off for the company, leaving the company or reaching its unused-retention limit also removes it. Open suggestions based on a deleted template are removed. Speaker names already applied in a meeting stay as edits to that meeting; automatic names retain their Undo action. Company owners can see an enrolled count and audit events, but not another person's template.

Depending on the feature and the deployment, Poneva's speech providers are Soniox (United States), AssemblyAI (its European Union endpoint), Amazon Web Services Transcribe (European Union regions) and OpenAI. Streaming speech providers may retain audio, and may use it for training, under their default terms. Vendor contract terms or account settings may change this. For example, audio uploaded to AssemblyAI for a meeting transcript is kept by AssemblyAI for about 24 to 48 hours, while Poneva deletes its transcription jobs and files at Soniox and Amazon Web Services once a transcript has been read.

4. Product and usage data

We collect operational data needed to run and secure the service. This can include request logs, IP address, browser and device information, session activity, assistant usage, public-demo or share-link activity, dashboard actions, and error or diagnostics data.

5. Discovery, testing, and trace data

If you use poneva's discovery, testing, monitoring, or browser-based tools, we may receive technical browser and page data needed to run those features. Depending on the feature, this may include page snapshots or DOM excerpts, URLs and navigation paths, search queries, product snippets, and portions of request or response data from connected merchant flows, as well as relevant session or cookie data when a feature requires it.

These features should only be enabled on sites you control or are authorized to monitor. They are not intended for special-category or other sensitive personal data unless you have clearly assessed and approved that use.

6. Cookies and browser storage

poneva uses cookies and browser storage to keep the service working and secure. For example, we use a skaii_session cookie to keep an account signed in for up to 30 days, a short-lived skaii_oauth_state cookie during OAuth sign-in for about 10 minutes, and widget browser storage to keep recent messages and session continuity for about 4 hours.

7. How we use information

We use personal data to:

• create and secure accounts and authenticate users;
• provide, maintain, and improve assistants, demos, widgets, and sharing features;
• support discovery, testing, deployment, and monitoring workflows;
• respond to support requests and communicate with you about the service;
• detect misuse, investigate incidents, and improve reliability, safety, and product quality; and
• comply with legal obligations and enforce our terms.

We may also use aggregated or de-identified usage information to understand product performance and improve poneva.

8. Lawful bases

Depending on the situation, we process personal data because it is necessary to provide the service, because it is in our legitimate interests to operate and protect the platform, or because we must comply with the law. Some information is optional, but certain account, authentication, and operational data is required for the service to work.

9. Roles and responsibilities

Poneva AB is the controller for personal data related to our own website, accounts, authentication, support, security, product operations, and poneva-hosted demos.

When a merchant or operator deploys a poneva assistant, widget, or trace tooling on its own site, that merchant or operator is typically responsible for the legal basis, notices, and instructions for shopper-facing interactions and merchant-site data collection. In those situations, poneva may process that data on the merchant or operator's behalf to provide the service, and any separate commercial or data processing terms will govern those roles more specifically.

10. Sharing and disclosure

We may share information with:

• service providers that help us host, operate, secure, support, and monitor poneva;
• authentication providers when you choose to sign in with OAuth;
• AI or model providers, including cloud speech providers, that help us generate, evaluate, or transcribe assistant interactions;
• merchant systems, integrations, or other parties when you ask the service to connect to them;
• people you choose to share public demos or share links with; and
• courts, regulators, law enforcement, or other third parties when disclosure is reasonably necessary to comply with the law or address fraud, abuse, or security issues.

We do not sell personal data or use it for third-party advertising.

11. International processing

poneva and our service providers may process information in countries other than your own. Where required, we use transfer safeguards that are appropriate for the data and the jurisdictions involved.

12. Retention

We keep information for as long as needed to provide the service, maintain security, resolve disputes, enforce our agreements, and comply with legal obligations. In practice, different categories may be kept for different periods. For example, widget browser storage typically expires after about 4 hours, server-side assistant session memory typically expires after about 24 hours unless reset or reconfigured, share links normally expire after 30 days unless revoked earlier, heartbeat status signals are short-lived and typically expire after about 5 minutes, and trace batches are typically retained for about 24 hours.

Dictation audio is processed for the active voice request and is not written to Poneva's persistent application storage; the temporary copy on your device is deleted when you insert or discard the text, or after 24 hours. A transcript you choose to send follows the same retention rules as the rest of that conversation. A meeting recording, its transcript and its notes are kept in the company's workspace storage. Uploaded meeting audio is part of that recording data. Deleting a kept recording in the app is not available yet. The uploaded parts of a recording are deleted once it is saved as one file, and the provisional live transcript is deleted when the final transcript is ready. Streaming speech providers may retain audio, and may use it for training, under their default terms. Vendor contract terms or account settings may change this.

13. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to our processing of your personal data, or to ask for a copy of it. You may also be able to withdraw consent where processing depends on consent.

To make a request, contact privacy@poneva.com. If your request relates to a merchant-deployed assistant or merchant-site trace activity, you should usually contact the relevant merchant or operator first because they are typically responsible for that deployment.

14. Security

We use reasonable technical and organizational measures to protect information, but no system is completely secure. You should also use strong passwords, protect your accounts, and avoid sharing sensitive information through public or shared demo surfaces unless it is appropriate for that use.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version here and update the "Last updated" date above.

16. Contact