Effective date: October 27, 2026 (version 1.8). Earlier versions are listed under Version history in section 16.
Bervo LLC ("Bervo", "we") is a Florida limited liability company. Bervo provides a private, AI-based executive assistant that reads the email, calendar, contacts, and, where you choose, text messages you connect to it, and produces briefings, reminders, and a searchable record of your commitments and relationships, with an AI layer that summarizes and organizes it and an assistant you direct in chat. This policy explains what we collect, why, where it lives, who can see it, how you control what the assistant sees, and how you delete it.
Account information. Your name; the email address you sign in with, where we send your one-time sign-in codes; your mobile number, if you give it (see "Your texts with Bervo" below); your home time zone; your Bervo address (for example, yourname.bervo.ai); and your settings, including what you choose to exclude (§5).
Setup answers. The choices you make during setup, such as which accounts to connect, how much history to load, and your privacy and notification settings, are kept on your own server.
Connected-account data. With your authorization, the service reads from the accounts you connect:
| Source | What we read | What we do not read |
|---|---|---|
| Email (Gmail, Microsoft 365, Outlook.com, or a hosted Exchange mailbox) | Message headers, bodies, and folder placement for the mailbox you connect. Connecting an account also connects its calendar and contacts: the three come together | Bervo doesn’t save your attachments. If you ask about a specific attachment, Bervo fetches that one file from your email provider at that moment, uses it to answer you, and then discards it. If it's a document with text in it (such as a PDF or Word file), your name and address hiding choices (§5) are applied before the AI reads it; if it's a scanned document, the AI reads it in full, including any names or contact details it shows. Bervo does not open pictures, in your email or your texts. If you ask Bervo to save a summary of the attachment, only the summary is kept. No other mailbox |
| Email on your Mac (any account set up in Apple Mail — for example iCloud, Yahoo, or a work account that does not allow Microsoft's connector) | Read from your Mac's local mail data by the Bervo Mac app, if you install it: the same headers, bodies, and folder placement as above | Attachments; any account you do not select |
| Calendar | Event titles, times, attendees, locations, and responses for the calendars you connect, from your Google or Microsoft account or, if you choose, from Apple Calendar through the Bervo Mac app | Nothing outside the calendars of the accounts you connect |
| Contacts | From Google and Microsoft: names, email addresses, phone numbers, company, and job title. From Contacts on your Mac, if you choose, through the Bervo Mac app: your contact cards are copied to your server whole (including any addresses, notes, or photos on them), and Bervo uses only names, phone numbers, and email addresses from them | Bervo does not use addresses, notes, or photos from your contacts |
| Text messages (optional) | Messages you send and receive, synced from your own Mac by the Bervo Mac app, subject to the exclusions in §5 | Photos, videos, and other attachments (a photo appears only as "[Photo shared]"); texts with contacts you exclude, which your server deletes the moment they arrive; your own conversation with Bervo's number |
Your texts with Bervo. You can text Bervo's number to ask questions, add tasks and notes, or ask Bervo to text you a reminder, and Bervo texts you the notifications you choose. We use your mobile number only for texts between you and Bervo. Bervo never texts anyone else, and we never use your number for marketing. Those texts are stored on your instance like your other conversations with Bervo.
Data we generate. Summaries, extracted tasks, initiatives, and deadlines, relationship and attention scores, briefings, notes you write in Bervo, your conversations with the assistant (in chat and by text), and the instructions you give it: corrections ("Tell Bervo"), notes on items, and watches you ask it to keep ("keep me in the loop on…"). All of it is generated from your data after your privacy choices (§5) have been applied.
Feedback and questions. Feedback and setup questions you send the Bervo team (§10, §11).
Technical data. Server logs, error reports, and pipeline health records needed to operate your instance. Your server sends the Bervo team routine health reports (whether its jobs ran, whether your Mac has synced recently); they contain no email, text, calendar, or task content. These are not analytics products; they exist so your instance keeps working.
Sanitization is our word for the masking you choose to apply before any of your data (email, calendar, contacts, or messages) reaches the AI model or is stored in summaries: last names and email addresses. You set the level; each level costs the assistant some precision.
You set these during onboarding and can change them at any time. Each choice is explained with a concrete example of what the assistant sees with and without it, and with its cost, because every exclusion makes the assistant less useful in a specific way.
You may invite people to work in your instance with you, such as an assistant or a colleague. For each person we collect their name, email address, and login, and we record which of them did what, so actions in your instance are attributed to the person who took them. People you add can see the data in your instance; they are users of your instance, not sources of data, and Bervo never reads their own email, calendar, or messages. You are responsible for adding only people who are permitted to see the data you have connected, including under any obligation you have to your employer or clients, and for removing them when that permission ends. To remove a person, contact us and we end their access immediately; it takes effect on their very next request.
Bervo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google Workspace User Data and Developer Policy, including the Limited Use requirements.
What we request. When you connect a Google account we ask only to read your Gmail, Google Calendar, and Google Contacts. Bervo never sends, changes, or deletes mail, events, or contacts.
How we use it. We use Google user data only to provide the assistant features you see in Bervo. We do not transfer it except to provide those features (including to the AI provider as described in §9), for security purposes, to comply with law, or as part of a merger, acquisition, or sale of assets with notice to you. We do not sell it or use it for advertising. We do not use it to develop, improve, or train generalized or non-personalized AI or machine-learning models; the only learning is your own instance's, for you alone (§9). Humans do not read it except with your explicit consent (for example, when you ask us to look at something specific), when necessary for security, to comply with law, or in aggregated, anonymized form for internal operations.
When you connect a Microsoft account, we request delegated permissions to read mail, calendars, and contacts. We request no permission to write or send mail. Your organization's administrator may need to approve Bervo for your tenant; that approval covers only the permissions listed on the consent screen.
Summaries and answers are produced by sending the relevant text to a large-language-model provider (Anthropic) over an API. Where you supply your own API key, those requests are made under your account with that provider and are governed by its terms. Where Bervo supplies the key during a trial, requests are made under Bervo's account and the provider's API terms, which do not permit training on API inputs. We apply your privacy choices (§5) on your server before anything is sent to the provider: text exclusions and name and address hiding. Search indexing uses a model that runs on your own server, so it sends nothing to the provider. Nothing excluded is sent to the provider.
What learns, and what doesn't. Your Bervo instance learns from your data and your corrections: how you write, who matters to you, what you want to be told about, and what you've committed to. That learning stays on your server, is never used for another customer, and is destroyed when you delete your instance. The AI model provider does not learn from you: requests are sent under API terms that do not permit training on them, and no data of yours is used to train any model, by us or by anyone.
Voice (optional, off unless you turn it on). If you turn on Voice in Settings, what you say in Bervo's voice mode, and voice memos you send to Bervo's text line, are sent to Deepgram, Inc. to be turned into text. If you also use Bervo's natural voice, Bervo's spoken answers, which can include details from your email, texts, calendar or attachments, are sent to Deepgram to be read aloud; if you choose your phone's own voice instead, answers are read aloud by your phone and are not sent to Deepgram. We ask Deepgram not to use this audio or text to improve its models, and Deepgram keeps it only as long as it takes to process it. Bervo does not keep the audio: it is deleted as soon as it has been turned into text or played. The text of the conversation is kept in your chat like typed messages. Each person turns Voice on separately, and turning it off takes effect immediately.
Setup screens have a Questions box. What you type there goes to the Bervo team, and a person replies. It is kept with your other feedback (§11).
Feedback you send. During the beta you can send feedback to the Bervo team in three ways: by text (just tell Bervo something is wrong, confusing, or could be better), with the Feedback button, or by ticking "Also send to the Bervo team" on a comment. Feedback you write to us yourself (the Feedback button, or the Questions box during setup) reaches the Bervo team as you wrote it, with your name and address hiding choices (§5) applied, plus basic context (which screen, how many messages) but never your conversations. When you tell Bervo something went wrong by text, in chat, or in a Tell Bervo note, Bervo first decides whether it is about how you work or something to fix in Bervo for everyone. If it is for everyone, Bervo sends the team only a general description of the problem (which feature, what went wrong), never the content of your messages, data, or tasks, and tells you it has done so; the details stay on your server. Each report is labeled with the account it came from, so the Bervo team can follow up with you about it or let you know when it’s fixed. If Bervo can’t tell, the Bervo team may be shown that same general description to decide, never your note itself. The Bervo team keeps it outside your instance, on Bervo's message service, until you ask us to delete it, and may be alerted to a problem report by text. If the Bervo team texts you asking for more detail about a problem you reported, what you send back reaches the team as you wrote it, except that people’s names are shortened (for example “Jane D”) and phone numbers and email addresses are removed. The question always tells you your reply goes to the Bervo team.
What you teach Bervo about how you work (for example, that a calendar block marks time booked elsewhere) is kept as a personal habit on your own server. It is used only for you. You can see, edit, or remove each one on the Learning page under Tell Bervo.
Beta Conversation Improvement Program (only with your consent). An opt-in beta feedback program that helps us improve how Bervo handles your chats and texts with it. If you join, an automatic nightly check runs on your own server, using your own AI key, and reviews your conversations with Bervo (your chats and texts with Bervo only, not your email or your texts with other people) to find problems. It sends the Bervo team only a general description of each problem it finds (which feature, what went wrong), never the exchange itself or any of your content.
Joining is separate from agreeing to these terms. It is off unless you choose it, you can decline it and still use Bervo, and you can join or leave the program at any time by telling Bervo, by text or in the dashboard chat, or with the switch in Settings; a change applies from the next nightly check. You can also email privacy@bervo.ai and a team member will switch it off for you. It ends when the beta ends.
Outside your instance, feedback and setup questions are kept as described in §11. - When you leave: during the private beta, deletion is by request: email privacy@bervo.ai, and a person handles it. We confirm the request is yours, then destroy your server and its backups within 7 days, and we confirm completion in writing. What we hold about you outside your server is deleted at the same time: your feedback and setup questions, and your phone number's link to Bervo's text line. Once paid plans exist, if your subscription ends without a deletion request, we do the same 30 days after it ends. - Your source data is never changed. Bervo only reads. Nothing Bervo does modifies or deletes anything in your email, calendar, contacts, or messages; they remain yours, at their source, before, during, and after you use Bervo. Deleting your Bervo instance deletes Bervo's copies and what Bervo generated, nothing else. - When you delete a message at its source. If you move a message to Trash, Deleted Items, Spam or Junk in a connected Gmail, Microsoft 365 or hosted Exchange mailbox, Bervo removes its copy at its next sync (usually within the hour) and closes any task it made only from that message. Copies in your server's backups go when those backups expire. - Export. Everything Bervo generates for you — tasks, notes, initiatives, summaries, and your conversations with the assistant — is yours. Ask us and we will send you a copy of your server's databases and your notes, and we offer it before any deletion. - Revocation without deletion: removing Bervo's access in your Google or Microsoft account, removing your Mac in Settings → Devices, or uninstalling the Mac app stops new data immediately; existing data remains on your instance until you ask us to delete it or you leave.
Your server has no open ports to the internet. Traffic reaches it only through an encrypted tunnel, after you enter a one-time code we email to your sign-in address, and your Bervo password sits on top of that. Credentials to your connected accounts are stored on your instance only, never in a shared store: Google and Microsoft accounts as revocable tokens, and a hosted Exchange mailbox as its password, encrypted. Your AI key is stored the same way, on your instance only. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay and within any period required by law.
Bervo is for business use by adults. We do not verify anyone's age. You are responsible for who you allow to use your instance.
We honor access, export, and deletion requests from anyone, regardless of where you live, because your data sits on a dedicated server we can hand you or destroy. Depending on where you live you may also have rights to correct or restrict your personal information, and to object to certain processing; we honor those too. Contact privacy@bervo.ai.
We will post changes here with a new effective date and, for material changes, notify you by email or in the app before they take effect.
Bervo LLC · privacy@bervo.ai