Legal

AICO Privacy Policy

Effective Date: 2026
Last updated: October 20, 2026
This Privacy Policy explains how RENVAR INC, Toronto, Ontario, Canada, collects, uses, discloses, stores, and protects personal information in connection with AICO.

1. Information We Collect

We may collect the following categories of information.
Information you provide directly

name, username, display name, profile details;
email address, phone number, login details, account information;
profile photo, biography, preferences, settings;
messages, posts, uploads, prompts, support requests, and other content you choose to submit;
information you provide when using AI-assisted features;
voice messages, call audio and their transcripts and translations;
photos, videos and files you choose to send, and, only if you use those features, a photo for an avatar, a voice sample for a voice clone, and health or calendar summaries you connect (see Section 4).

Information collected automatically

device identifiers;
IP address;
app version, browser type, crash logs, diagnostics, and usage logs;
language, approximate region, and time zone;
feature interactions, session information, and engagement events.

Information from third parties

sign-in providers;
app stores and platform operators;
analytics, anti-fraud, moderation, communications, and identity-related service providers;
other users, where they interact with you through the Service.

2. How We Use Information

We may use personal information to:

create and manage user accounts;
provide messaging, networking, content sharing, and AI-assisted functionality;
authenticate users and protect accounts;
personalize product features and recommendations;
detect, investigate, and prevent fraud, abuse, spam, and policy violations;
respond to support requests and user feedback;
improve, maintain, troubleshoot, and develop the Service;
comply with legal obligations;
send service-related notices and, where permitted, marketing communications.

3. AI Processing and Third-Party AI Services

Some AICO features send your content to third-party AI services so that the feature you use can work. Before the app can be used, we show a screen that explains what is sent and to whom and asks for your permission. You can review or withdraw this permission at any time in the app under Profile → AI data sharing. If you do not agree, the translation, transcription and assistant features cannot work and the app cannot be used.

What data is sent

the text of messages that are translated for you or for the people you write to, and your requests to the AICO assistant;
voice messages and call audio, for transcription, translation and spoken (dubbed) translation;
only if you choose these features: a photo you select for “Avatar from a photo”, a voice sample for a voice clone, and the sleep, heart-rate and calendar summaries used for the optional daily briefing.

Who receives it

OpenAI (United States): translation, transcription, speech generation and assistant responses;
Anthropic (United States): a backup language model, the daily briefing and “Avatar from a photo”;
ElevenLabs (United States): voice cloning, only if you create a voice clone.

These providers process the data on our behalf to deliver the feature you requested, under their service terms and data-protection commitments. We send only what the feature needs and we do not sell this data. AI prompt and response logs are kept as described in Section 8.
AI outputs may be inaccurate or incomplete. Users should review outputs before relying on them and should avoid sharing highly sensitive information unless clearly necessary.

4. Optional Features and Special Categories of Data

Depending on your app version and region, some of the features below may not be available yet. They apply only if you use or enable them.

Contacts. If you allow access to your address book, we use phone numbers and email addresses from it to help you find people you know on AICO. You can turn this off in your phone settings.
Voice clone (biometric information). A voice clone is created only from a voice sample you record and only with your explicit consent. It is kept in a protected area that only our services can access, and it is deleted when you delete the clone or your account.
Health and calendar summaries. If you connect Apple Health, a wearable or a calendar, we read sleep, heart-rate variability, resting heart-rate and calendar summaries (such as the number of events and busy time) to prepare your daily briefing. Apple Health is read-only and only daily summary figures leave your phone. You can disconnect at any time. This is not medical advice and not a medical service.
Personal memory. Notes you save in Personal memory are stored encrypted on our servers, separately for each user. The encryption key is managed by us on the server, so this is not end-to-end encryption. You can view, export and delete your memory.
Camera and video. Video messages that remove the background are processed on your device; only the finished video you choose to send is uploaded.
Website chat widgets and bots. If you write to a business through an AICO chat widget on its website, your messages and the language you use are processed by AICO for that business, whose staff can read them. If you talk to a bot, the bot’s developer receives the messages sent in that chat.

5. Legal Bases

Where applicable, we process personal information on one or more of the following bases:

consent;
performance of a contract;
legitimate interests;
compliance with legal obligations;
other lawful grounds recognized by applicable law.

6. How We Disclose Information

We may disclose personal information to:

hosting, cloud, infrastructure, and storage providers;
authentication, communications, analytics, security, and moderation vendors;
AI service providers supporting product functionality;
professional advisors, auditors, insurers, and transaction counterparties;
regulators, courts, law enforcement, or other authorities when required by law or where legally justified.

Our main service providers are: hosting and infrastructure (our own servers and Railway), email (Resend), push notifications (Expo, Apple and Google), AI services (OpenAI, Anthropic and ElevenLabs, see Section 3) and, when paid plans are available, payments (Stripe).

We do not sell personal information in the ordinary sense unless expressly stated otherwise.

7. International Data Transfers

Personal information may be processed in Canada, the United States, the European Union, and other jurisdictions where we or our service providers operate. Where required, we use appropriate safeguards for cross-border transfers.

8. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security, preventing fraud and abuse, complying with law, resolving disputes, and enforcing our terms.
Our standard operational retention approach includes the following:

account and profile data: while the account is active and generally up to 30 days after a valid deletion request;
private messages and user content: generally 30 to 60 days after a valid deletion request where deletion or de-identification is feasible, with limited longer retention for safety, legal, or dispute-related needs;
security logs: generally 12 months;
support records, deletion requests, and appeals: generally 24 months;
moderation and abuse records: generally 24 months, and up to 36 months for severe or repeat-abuse matters;
marketing consent records: generally 3 years after the last relevant activity or withdrawal of consent;
user-level analytics data: generally 12 months, after which we may aggregate, anonymize, or de-identify it where feasible;
AI prompt and response logs: generally 30 days, and up to 90 days where needed for debugging, safety, or quality purposes;
billing and accounting records: generally 7 years;
backups: rolling cycles of up to 90 days.

If law, fraud prevention, security, dispute handling, or regulatory obligations require longer retention, we may retain relevant information for that purpose.

9. Account Deletion

Users can request account deletion in the app under Profile → Account and security → Delete account and, where provided, through a web-based request method.
Our standard target is to process account deletion requests within 30 days, although some residual data may remain temporarily in backup systems for up to 90 days or be retained longer where legally required or justified for fraud prevention, safety, dispute resolution, or compliance.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, loss, misuse, or disclosure. No method of transmission or storage is completely secure.

11. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, object to, or request portability of your personal information, or to withdraw consent where processing is based on consent. You can withdraw your permission for AI processing in the app under Profile → AI data sharing.
To make a privacy request, contact: aico.app1@gmail.com

12. Age Restrictions

AICO is intended only for users who are 18 years of age or older. We do not knowingly allow users under 18 to create accounts or use the Service. If we learn that we have collected personal information from a user under 18 in violation of this Policy or applicable law, we may suspend or terminate the account and delete the relevant information, subject to legal and safety obligations.

13. Website Analytics and Newsletter

Website analytics. When you visit aicoworld.com we measure visits and clicks on our download buttons so we can understand how people find AICO. We record the page you viewed, the website or campaign tag that sent you (for example a social network), your browser language, and the type of device, operating system and browser. We do not use cookies or advertising trackers for this, we do not store your IP address or your full user-agent string, and we do not build a profile of you. The campaign tag is remembered only inside your browser tab until you close it. Visits are told apart with a one-way hash that changes every day, so we cannot follow you from one day to the next. We respect the “Do Not Track” and Global Privacy Control browser settings. Website analytics records are generally kept for up to 12 months.

Newsletter. If you subscribe on our website, we collect your email address, the date, the page or campaign you signed up from, and the text of the consent you gave. We use this only to send you news about AICO, such as app releases and major new features. You can unsubscribe at any time using the link in every message or by writing to aico.app1@gmail.com. After you unsubscribe we keep your email address and the record of your consent and withdrawal for up to 3 years, so that we do not email you again and can show that your choice was respected. The website, its analytics data and the subscriber list are hosted with a cloud infrastructure provider acting on our behalf.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice through the Service, by email, or by other reasonable means.