Privacy Policy

1. Introduction

Olivra LLC (“Olivra,” “we,” “our,” or “us”) operates Olivra, an AI trade compliance platform that builds a company's compliance program from its own documents, monitors regulatory sources for changes that affect it, and drafts updates for the company to approve. This Privacy Policy applies to olivra.io and the Olivra application (together, the “Service”) and explains what information we collect, how we use and share it, and the choices you have.

Olivra is a business service. Its users are people at the companies that use it, such as trade compliance, operations and finance staff. By using the Service you agree to this Privacy Policy. If you do not agree, please do not use the Service.

Your company controls the documents, program and other content in its workspace, and Olivra processes that content on your company's behalf to provide the Service. For information about visitors to our website, people who book a walkthrough or open the demo, and account and billing details, Olivra decides how it is used, as described below.

2. Information We Collect

2.1 Information you provide

• Account information: your name, email address and password, and the one-time codes we email to verify it, or the account you sign in with at Google or Microsoft.
• Company information: your company's name, industry, operating regions, products and their HTS classifications, trading partners, customs broker and similar details you give us or confirm during setup.
• Documents and trade data: the files you upload or connect, such as compliance manuals and procedures, CBP Form 7501 entry summaries, ACE reports, certificates of origin, powers of attorney and invoices. These can contain entry numbers, values, supplier and broker names, and the names of people named in them.
• Program content: the compliance program built for your company, including its sections, approvals, comments, training modules, assessment binders and exports.
• Conversations with Olive: the messages you send to Olive, our AI assistant, Olive's replies, and any files you share in a conversation. Questions from visitors who are not signed in are answered but not saved; to limit misuse we keep only a one-way hash of the visitor's IP address and a count of questions, voice sessions and sign-up checks for that day.
• Voice: when you talk to Olive out loud, your audio is streamed to our voice provider to be turned into text, and Olive's replies are turned into speech. Olivra does not store recordings of your voice. Text you dictate is saved like any typed message. Our voice provider processes audio under its own terms.
• Signatures and attestations: program adoption signatures and training attestations record the signer's name, the time, the IP address and the browser. Program adoptions also record the signer's title and email. Program attestations record who signed, the time, the IP address and the browser. Training records also hold scores and answers.
• Team information: the email addresses and roles of the people you invite to your company's workspace, and the compliance roles you assign them.
• Billing information: when your company starts a plan, the plan chosen and the email of the person who starts it. Card details, the cardholder's name and the billing country and postal code are entered on Stripe's checkout page and go straight to Stripe; Olivra never sees or stores them. Olivra keeps only Stripe's references to your company's customer record and subscription, the plan, whether it is on contributing member pricing, and its status and renewal date.
• Contributing member consent: when a company chooses contributing member pricing, the consent it gives to be named in our marketing: who gave it (name, email and account), when, the IP address and browser, and the version of the terms agreed to, and, if it is withdrawn, who withdrew it and when.
• Requests, feedback and support: messages you send us, including requests for new regulatory sources, feedback you give in the app or in reply to a check-in email, and support emails.
• Live demo: the email you enter to open the demo. You explore a sample company under a private guest account created for your visit; your questions to Olive in the demo are kept with it. The guest account and its conversations are deleted after 30 days; we keep the email you entered, how many questions and voice calls you used, and a one-way hash of your IP address that limits misuse, to follow up about Olivra.
• Book a demo: your name, email, company, what you trade, whether you import or export, your answers about your compliance program and goals, and a one-way hash of your IP address that limits misuse, used to prepare your walkthrough. The calendar on that page is provided by Cal.com, and your name and email are passed to it to fill in the booking.

2.2 Information collected automatically

• Security and audit records: when you change, view or export parts of your program or account, or when access is denied, we record what happened, who did it, when, and the IP address and browser user agent it came from.
• Technical information: the IP address, browser and device information our hosting provider receives when you load a page, used to deliver and secure the Service.
• Cookies and browser storage: see Section 9. Olivra uses no advertising trackers.
• Website visit counts: on our public website pages (such as the home, pricing and security pages), our hosting provider Vercel counts page visits: the page, the referring site, and your country, browser and device type. It uses no cookies and does not identify you or follow you across sites. Nothing inside the Service (your workspace, onboarding, sign-in or invitations) is counted.

2.3 Google user data

Connecting a Google account is optional. When you choose to, Olivra uses Google user data as follows:

• Sign in with Google: we receive your name, email address and profile picture to create and sign in to your account.
• Google Drive: Olivra requests only the drive.file permission, which covers the individual files you pick in Google's file picker and no others. We copy the files you pick into your company's private storage and read them to build and maintain your compliance program. Olivra never changes or deletes anything in your Drive.
• Credentials: the access tokens for your Drive connection are stored encrypted (AES-256-GCM) and linked to your company, with the email of the Google account you connected. Disconnecting Drive stops all further access and asks Google to revoke it; the encrypted credentials are kept, unused, and copies of files you already imported stay part of your program until you ask us to remove them.

Olivra's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you ask for; we do not use it for advertising, we do not sell it, and we do not use it to train AI models. The AI provider described in Section 4 processes it only to produce your results.

2.4 Microsoft user data

• Sign in with Microsoft: we receive your name and email address to create and sign in to your account.
• OneDrive: when you connect OneDrive, Olivra asks Microsoft for permission to read your files, and uses it only to list your files so you can choose which to import and to read the files you choose. It never changes or deletes anything in your OneDrive. (Connections made before September 25, 2026 were granted read and write access by Microsoft; Olivra only ever read with them, and reconnecting replaces that grant with read-only access.) Access tokens are stored encrypted (AES-256-GCM) with the email of the Microsoft account you connected, and disconnecting stops all further access by Olivra. To remove the permission at Microsoft as well, remove Olivra in your Microsoft account settings.

3. How We Use Information

• To build your compliance program from your documents and keep it current.
• To monitor regulatory sources and score each change against your program, including which sections and which of your confirmed HTS codes it reaches.
• To draft changes to your program, training and assessments for you to approve. Olive proposes; nothing in your program changes until someone at your company with permission approves it.
• To answer your questions in conversations with Olive, typed or spoken.
• To send you the emails the Service depends on: invitations, sign-in and password-reset codes, signature requests, regulatory alerts, notices of changes Olive has drafted for your approval, summaries, and a one-time check-in about how Olivra is working for you, according to the notification settings you choose. Account, security and billing emails (such as a reminder before your first plan charge, or notice of a price change) are always sent.
• To bill for your company's plan and manage the subscription through Stripe, including applying contributing member pricing and showing your plan's status in Company settings.
• To name contributing members in our marketing, only with their consent. A company's name, its logo and a testimonial it has approved appear on olivra.io, LinkedIn, other Olivra channels and sales presentations only when that company chose contributing member pricing and agreed to it at checkout, and never for a company on standard pricing. A company can withdraw in Company settings, Billing, and we remove it from our marketing within 30 days.
• To keep an audit trail of changes to your program, secure the Service and prevent misuse.
• To provide support and to understand and fix problems with the Service.
• To comply with the law and enforce our terms.

We do not sell your personal information, we do not use it for advertising, and we do not use your documents, data or conversations to train AI models.

We use the topics of questions, never your documents, data or conversation text, to improve Olive's knowledge of public regulations. We never use them to train AI models.

4. How We Share Information

4.1 Service providers

We share information only with the providers that run parts of the Service for us, each for one job, under agreements that limit what they may do with it:

• Supabase (United States): database, sign-in and private document storage. Holds your account, company, document and program data, and sends sign-in and password-reset codes.
• Vercel (United States): hosts and runs the application, and counts visits to our public website pages.
• Anthropic (AI provider): reads your documents, extracts facts, drafts your program, scores regulatory changes and writes Olive's answers. We send the content needed for the task you ask for. Under Anthropic's commercial terms, content sent through its API is not used to train its models.
• ElevenLabs (voice provider): turns your speech into text and Olive's replies into speech during voice conversations.
• Resend (email provider): delivers invitations, alerts, notices of drafted changes, summaries, check-ins and signature requests.
• Stripe (payments): when your company starts a plan, receives the company's name, the email of the person who starts it and an Olivra reference to the company, plus the payment details entered at checkout. Stripe processes payments, runs the subscription and hosts the billing portal where your company manages its card, invoices and cancellation. Card details go straight to Stripe; Olivra never sees or stores them. Stripe handles this information under its own privacy policy, including if you choose to save your details with Stripe's Link at checkout.
• Cal.com (scheduling): when you book a walkthrough, receives your name, email and the time you choose through the calendar shown on our Book a demo page, and sends the calendar invitation.
• Google: only when you choose to sign in with Google or to connect Google Drive, as described in Section 2.3.
• Microsoft: only when you choose to sign in with Microsoft or to connect OneDrive, as described in Section 2.4.

The current list is always on our Security page.

4.2 Within your company

Your company's workspace is shared with the people your company invites. What each person can see and do depends on the role your company gives them: owners and admins approve changes, members work in the program, and viewers can read but not change anything. When you ask someone to sign your program, we email them the request.

4.3 Separation between companies

Olivra serves many companies from one platform. Each company's data is kept separate, and every request is checked against the requester's company membership, so one company cannot see another's data.

4.4 Legal requirements and safety

We may disclose information if the law, a court order or a government authority requires it, or where it is necessary to protect the rights, property or safety of Olivra, our users or others.

4.5 Business transfers

If Olivra is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction, and it will remain subject to the protections in this Privacy Policy.

5. AI Processing

Olive is powered by AI. Olive reads your documents and regulatory changes and drafts content for you, and AI can make mistakes: check important information and the cited sources before you rely on it. Olive does not change your compliance program without you; every drafted change waits for approval by someone at your company, and each approval is recorded in your audit trail.

6. Data Security

We protect your information with safeguards including encryption in transit (HTTPS) and at rest, private document storage reachable only through signed links that expire within an hour, most within five minutes, encrypted credentials for connected drives, role-based permissions, a company check on every request, and audit records that cannot be edited or deleted. Our Security page describes these in more detail. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and your company as the law requires.

7. Data Retention

We keep your information for as long as your company uses the Service, and afterwards only as long as needed for the purposes in this Privacy Policy or as the law requires. You can delete your conversations with Olive at any time. Audit records and program adoption signatures are kept as a permanent record of your program's history and cannot be edited or deleted, because their value as evidence depends on it; attestation records are kept for as long as the program they belong to. Demo leads and walkthrough requests are kept until you ask us to delete them. When you ask us to close your account, we delete or anonymize your personal information, except what we must keep for legal reasons. Billing and payment records are kept for as long as tax and accounting law requires, including after a plan ends.

8. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate.
• Delete your personal information.
• Receive a copy of your information in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on it, for example by disconnecting Google Drive or OneDrive.

To exercise any of these, email privacy@olivra.io. We may need to verify your identity first. If your company manages your account, we may refer your request to your company. You can change which emails you receive in your notification settings at any time. We do not sell or share personal information for cross-context behavioral advertising.

9. Cookies and Browser Storage

Olivra uses only what the Service needs to work:

• Sign-in cookies that keep you signed in.
• Two preview cookies that count the free questions and voice turns a visitor who is not signed in can have with Olive (kept for 30 days).
• An invitation cookie that holds a pending invitation while you sign in (kept for one hour).
• Browser storage for preferences such as light or dark mode and notices you have dismissed, a pending invitation, and your onboarding conversation with Olive until you close the tab.

We use no advertising or analytics cookies (the website visit counts in Section 2 use none), and because we do not track you across sites, there is nothing for a browser's Do Not Track or Global Privacy Control signal to turn off. When you use the Google Drive picker, Google's own scripts may set cookies under Google's privacy policy, and Stripe's checkout and billing pages, which open on Stripe's own site, may set cookies under Stripe's privacy policy, and the booking calendar on our Book a demo page is provided by Cal.com and may set cookies under Cal.com's privacy policy. You can control cookies in your browser settings, though blocking sign-in cookies will keep you from signing in.

10. Children's Privacy

Olivra is a business service and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe we have, please contact us and we will delete it.

11. International Data Transfers

Olivra is operated from the United States, and your information is stored and processed in the United States. Some of our providers may process information in other countries. Where they do, we rely on their contractual commitments to protect it in line with this Privacy Policy and applicable law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make a material change, we will post the new version here and update the date at the top, and where appropriate we will tell you by email or in the Service.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us:

• Legal entity: Olivra LLC
• Email: privacy@olivra.io
• Website: olivra.io