privacy/

Delvry is survey infrastructure for AI agents. We try to collect as little as possible while still running the service. This page tells you what we do collect, why we collect it, where it lives, and how to get rid of it.

#What we collect

Two categories of data move through Delvry — account data (about the human or agent operating Delvry) and recipient data (about the people your agent surveys).

Account data: the email you signed up with, the account name you chose, hashed credentials for the dashboard if you set a password, and a hashed copy of every API key you mint. Plain-text keys are shown to you exactly once at creation and never stored.

Recipient data: when your agent invites someone to answer a survey or thread inquiry, we store their email address and an optional display name so we can send the invite, render the form, and attribute their response back to them. We also store the responses themselves — answers to your agent's questions, in whatever shape your agent specified.

We log technical metadata to operate the service: request IPs (for rate-limiting), timestamps, response status codes, and similar. We do not run third-party trackers or advertising pixels. The marketing page uses Plausible, which is cookieless and aggregate-only.

#Why we collect it

To run Delvry. Email goes out so recipients can answer; responses come back so your agent can read them; usage counters drive plan quotas; logs catch abuse and bugs. We do not sell data, and we do not use your account or recipient data to train models. Full stop.

#How long we keep it

Retention is tier-dependent. The plans catalog at /v1/plans is the source of truth — each tier has a retention_days field that defines how long persisted Receipt Snapshots stick around.

• Tier A (Live). Knowledge Receipts are returned during a thread but not persisted. Once the thread closes, the receipt is gone from our side.
• Tier B (Starter / Growth / Scale). Closed-thread receipts are persisted per the plan's retention window — see the catalog for current numbers.
• Recipient PII attached to closed surveys is purged 90 days after close, regardless of tier.
• Account records live until you delete the account.

#Who else touches the data

Two subprocessors:

• Cloudflare — hosts the Worker, D1 database, and KV. Data lives in their iad-1 region (US-East) by default. Cloudflare also terminates TLS.
• Resend — sends transactional email (survey invites, thread inquiries, nudges, completion receipts). Recipient email addresses and display names are passed through Resend's API.

That's it. No analytics warehouses, no ad networks, no third-party JS embedded in the recipient form.

#Your rights

You can export and delete your data. Today this is a CLI surface — delvry receipts export dumps your full corpus as NDJSON, and delvry receipts delete <id> removes a single Receipt Snapshot. Web tooling for both is on the roadmap. If you want everything erased, email hello@delvry.ai and we'll do it manually within seven days.

If you're a recipient and you want your responses removed from a survey or thread you participated in, contact the account owner who invited you, or email us — we'll route the request.

#Contact

Privacy questions, deletion requests, anything else: hello@delvry.ai. Security disclosures go to security@delvry.ai (see /security).

#Changes to this page

If we materially change what we collect or who we share it with, we'll bump the last updated stamp at the top and email account holders. The current version is always at this URL.