Version 1 · 24 July 2026
Privacy Policy
Controller
The data controller is Arkay Labs Ltd, registered in England and Wales. You can contact us at admin@svare.ai.
What we collect
We collect your account email address and a password hash, handled by Supabase Auth. We collect OAuth tokens for the email provider (Gmail or Outlook) and the Shopify store you connect. These tokens are encrypted with AES-256-GCM and held only on our servers. We read order and delivery metadata from your connected accounts to ground the drafts Svare writes. We keep usage and billing records through Stripe. If you join our waitlist, we collect your email address.
What we deliberately do not keep
We never store the raw body of a customer email. We store a customer's sender address only as a SHA-256 hash, never in plain text.
Why we process it
We process this data to provide the service: drafting replies and looking up orders. We also use it to bill you and to keep the service secure. If you are on our waitlist, we only use your email address to contact you about Svare's launch. We never sell it or share it for marketing.
AI processing
Email content is processed by Anthropic, using Claude models, as a subprocessor to produce triage and draft replies. Anthropic does not use this content to train their models.
Subprocessors
We use the following subprocessors: Supabase for our database and authentication, Vercel for hosting, Anthropic for AI drafting, Stripe for billing, Upstash for rate limiting, Inngest for job scheduling, Google and Shopify for the accounts you connect, and TrackingMore for delivery status.
Retention and deletion
We delete your account data within 30 days of cancellation. You can request an export of your data at any time. If you want to be removed from our waitlist, email admin@svare.ai.
Your rights
Under UK GDPR, you have the right to access, correct, erase, and receive a copy of your data, and to object to how we process it. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO).
AI processing and subprocessors
Svare uses Anthropic (Claude) to triage messages and draft replies, and Anthropic is a subprocessor for that purpose. Under Anthropic's commercial terms your data is never used to train models and API logs are deleted within days. When Svare drafts payment dispute evidence, the model receives placeholder tokens instead of personal details: names, addresses, email addresses and tracking numbers are filled in from your records after drafting, and never leave Svare's systems. Svare also uses carrier tracking services (currently TrackingMore) to look up delivery status by tracking number, and connects to your own carrier and payment accounts with the credentials you provide, only to fetch the records described here.
Payment dispute evidence
When a payment dispute is opened against an order, Svare assembles evidence to defend it, which can include the customer's name and address, the support email thread for that order, delivery records, and delivery confirmation images from your carrier. This evidence exists only to defend the dispute. It is encrypted at rest, is never used for any other purpose, and is deleted 90 days after the dispute finally closes. Where a deletion request arrives while a dispute is still open, UK GDPR article 17(3)(e) lets the evidence be retained until the dispute is resolved; the request is logged and completed once the dispute closes.
Delivery confirmation images
Carriers may capture a photo or signature at delivery. Where your carrier account allows it, Svare retrieves that image only when a dispute needs it, stores it encrypted alongside the dispute evidence, and deletes it on the same 90 day schedule. These images are treated as personal data.
Questions: admin@svare.ai