Aviary
Request early access

Legal

Privacy Policy

Last Updated: November 4, 2026

This Privacy Policy explains how Recora, Inc. (“Recora,” “Company,” “we,” “our,” or “us”) collects, uses, discloses, and protects information in connection with your access to and use of our Services. This Privacy Policy covers Aviary, our AI agent and organizational knowledge platform. The “Services” include our websites, apps (including the Aviary desktop app, web app, and Slack app), and related services, content, tools, features, integrations with third-party services (“Connected Services”), and communications, as described in our Terms of Service (“ToS”).

By accessing or using the Services, you acknowledge that you have reviewed this Privacy Policy. If you do not agree with the Terms of Service or applicable policies, do not use the Services.

1. Customer Workspaces and Our Role

When an organization (a “Customer”) sets up an Aviary workspace, the Customer controls the content and data that its users submit to or connect with the Services (“Customer Data”), including data from Connected Services. We process Customer Data on the Customer’s behalf, according to our agreement with the Customer and its workspace settings. If you use Aviary through your employer or another organization, direct questions about Customer Data to that organization first. Otherwise, this Privacy Policy describes how we handle information for which we determine the purposes and means, such as account information, website and app usage data, billing information, and communications with us.

2. Information We Collect

A. Information you provide

We may collect information you provide through the Services, such as:

  • Contact and account information (e.g., name, email, phone number, login credentials, preferences)
  • Organization, workspace, and billing information
  • Communications (e.g., messages to support, survey responses, feedback)
  • User Content (as described in the ToS), such as prompts, messages, files, and other information you submit to the Services

B. Information from the desktop app and Connected Services

  • Screen content: when you invoke features of the Aviary desktop app that use screen recording, we capture images of your screen and related context (such as the active application and cursor position) to respond to your request.
  • Voice, audio, and meetings: when you use voice or dictation features, we process audio from your microphone and generate transcripts. If you use meeting transcription for calls (such as Zoom or Google Meet), we also process the audio of other participants and label the transcript by speaker. You are responsible for giving participants any notice and obtaining any consent required by law before transcribing a meeting. When you record a task, we capture your screen, actions, and narration to turn it into a step-by-step guide.
  • Device permissions: if you grant macOS accessibility or input-monitoring permissions, we use them only to detect the shortcut that invokes the app and to perform actions you request.
  • Connected Services data: when you or your organization connect services such as Slack, Google Workspace (Gmail, Calendar, Drive), Notion, or GitHub, we access data from those services within the permissions granted, such as messages, emails, calendar events, documents, and related metadata. We use it to provide the Services, including building an organization knowledge base that authorized users in your workspace can search, based on what each user is permitted to access.

C. Information collected automatically

We and our service providers may automatically collect:

  • Device and browser information
  • Identifiers and logs (e.g., IP address, timestamps, diagnostic data)
  • Usage and interaction data (e.g., pages/screens viewed, features used, session duration, and session recordings that capture clicks, scrolling, and other interactions with our website and apps). Session recordings may include text you type and content displayed in our website and apps, except passwords, which are always masked.
  • Approximate location (e.g., inferred from IP address)

D. Information from third parties

We may receive information from:

  • Your organization (for example, when an administrator invites you or configures your workspace)
  • Service providers (e.g., hosting, security, analytics, customer support tools)
  • Connected Services (if you or your organization connect them)
  • Advertising/measurement partners (subject to your choices and applicable law)

3. How We Use Information

We may use information to:

  • Provide, operate, maintain, secure, and improve the Services
  • Generate AI outputs and take actions, such as answers, summaries, and drafts, and actions in Connected Services (for example, drafting or sending messages and emails, responding to calendar invitations, or updating documents). Some features, such as Shadow, may carry out actions on your behalf according to the rules and permissions you set; actions that reach other people are taken only with your approval or under standing permissions you grant.
  • Create and manage accounts; administer workspaces and subscriptions
  • Provide support and respond to inquiries
  • Communicate with you about authentication, service updates, account notifications, and administrative/security matters
  • Detect, prevent, and address fraud/misuse/security incidents; enforce the ToS
  • Comply with legal obligations
  • Create and use de-identified or aggregated information where permitted by law for analytics, research, and service improvement.

4. How We Disclose Information

We may disclose information:

  • To your organization and its authorized users, consistent with your workspace settings (for example, administrators and members who can access shared workspace content and the knowledge base)
  • To service providers that perform services for us (hosting, support, analytics, communications, security), subject to contractual and legal protections
  • To AI model providers that process inputs and generate outputs on our behalf, under terms that do not permit them to use your data to train their generalized models. A current list of our subprocessors is available at getaviary.com/subprocessors.
  • For legal and safety reasons (lawful requests, protecting rights/safety/security, investigating fraud or violations)
  • In connection with a business transfer (merger, acquisition, financing, reorganization, bankruptcy, or sale of assets), subject to applicable law.
  • With your direction or consent, where required

5. Cookies, Pixels, and Similar Technologies

We and our service providers may use cookies, pixels, SDKs, and similar technologies to:

  • authenticate and maintain sessions (where applicable)
  • remember preferences
  • conduct analytics and performance measurement
  • enhance security and prevent fraud
  • measure whether our emails are opened and links in them are clicked, using pixels and tracked links in those emails
  • support marketing/measurement (see Section 6)

We may provide a cookie banner and/or cookie preference center that allows you to accept, reject, or manage certain categories of cookies and similar technologies (except those that are strictly necessary for the Services to function).

You can also control cookies through your browser settings. Disabling certain cookies may affect Services functionality.

Global Privacy Control / universal opt-out signals

Some browsers or extensions allow you to send an opt-out preference signal (such as Global Privacy Control). Where required by law, we will treat such signals as valid requests to opt out of certain processing, such as “sale” or “sharing” of personal information for targeted advertising.

6. Advertising and Marketing (Targeted Advertising)

We may use certain information (often via cookies, pixels, SDKs, and similar technologies) to:

  • Measure and improve the performance of our advertising and outreach, and
  • Provide information about Aviary and the Services.

Where required by applicable law (including for cross-context behavioral advertising), we provide a “Do Not Sell or Share My Personal Information” link (or similarly titled link) that you can use to opt out of certain disclosures of personal information for targeted advertising purposes.

7. AI and Automated Processing

Some features may use automated processing, including AI, to support functionality (for example, summarizing information you provide or improving user experience). AI outputs may be inaccurate. We use third-party AI model providers to generate outputs, as described in Section 4. Where required by law, you may request a human review of certain decisions.

Google user data and Google API Services (Limited Use)

Some features of the Services allow you to connect your Google account so that the Services can access information from Google APIs (including Google Workspace APIs, such as Gmail and Google Calendar) on your behalf.

The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not retain or use user data obtained through Google Workspace APIs to develop, improve, or train non-personalized (generalized) AI and/or ML models, and we do not permit our third-party AI service providers to do so.

8. Security

We take reasonable measures intended to protect the Services and information processed through them. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for protecting your devices, credentials, and account access.

If you believe your interaction with us is no longer secure, contact us at platform@getaviary.com.

9. Data Retention

We retain information for as long as reasonably necessary to:

  • provide and maintain the Services,
  • comply with legal obligations,
  • resolve disputes,
  • enforce agreements, and
  • protect safety and security.

Customer Data is retained according to the Customer’s workspace settings and our agreement with the Customer. When a Customer deletes its workspace, or a Connected Service is disconnected, we delete or de-identify the related Customer Data, except where we must retain it to comply with law.

10. State Privacy Rights and Choices

Depending on where you live, you may have rights regarding your personal information, which may include:

  • access, correction, deletion, and portability (subject to legal exceptions)
  • opting out of targeted advertising
  • opting out of certain profiling/automated decision-making (where applicable)
  • appealing certain decisions regarding a request (where required by law)

If you use Aviary through an organization, that organization controls its Customer Data, and we may refer requests about that data to the organization.

How to exercise your rights

You may submit requests by:

  • using the “Do Not Sell or Share My Personal Information” link (or similarly titled link) where available; and/or
  • emailing privacy@getaviary.com with the subject line “Privacy Request.”

We may need to verify your identity before processing certain requests. Where permitted, you may use an authorized agent.

California

California residents may have additional rights under the CCPA/CPRA, including the right to opt out of “sale” or “sharing” of personal information (including for cross-context behavioral advertising), and we will process such requests through the opt-out mechanisms described above, including recognition of valid opt-out preference signals where required.

11. Children’s Privacy

The Services are intended for adults and are not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided information to us, contact privacy@getaviary.com.

12. International Users

The Services are operated from the United States and may not be available or appropriate outside the U.S. If you use the Services from outside the U.S., you understand that information may be processed and stored in the U.S., where laws may differ.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information on the following legal bases: to perform our contract with you or your organization; for our legitimate interests in operating, improving, and securing the Services; with your consent (for example, for non-essential cookies); and to comply with legal obligations. You may have rights to access, correct, delete, restrict, or object to processing of your personal information, to data portability, and to lodge a complaint with your local data protection authority. Where we transfer personal information outside these regions, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

You agree that we may provide notices and disclosures (including privacy-related notices) electronically through the Services or via email. Your affirmative act of clicking “I agree,” “Accept,” “Continue,” “Submit,” or similar buttons or checkboxes (including during sign-up/onboarding) constitutes your electronic signature/acceptance of this Privacy Policy and related terms, where applicable.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last Updated” date above indicates when it was most recently revised. If we make material changes, we will provide notice consistent with the ToS and applicable law. Continued use of the Services after changes constitutes acceptance to the extent permitted by law.

15. Contact Us