Privacy Policy
Via (“Via”, “we”, “us”, “our”) is a task, calendar and planning app. This policy explains what personal data we collect when you use the Via apps for Android, iOS, Apple Watch and web (together, the “Service”), why we collect it, who we share it with, how long we keep it, and the choices and rights you have.
Via is provided by Daton Software Limited, a company registered in Ireland (company number 793501), The Hatch Lab, M11 Business Campus, Gorey, Co. Wexford, Y25 A8H2, Ireland.
For personal data we process to run the Service for you, Daton Software Limited is the data controller. Where an organisation (for example, your employer) invites you into a shared Via workspace, that organisation decides what content is shared inside it, and workspace members and admins can see content that is shared with them.
Privacy contact: privacy@usevia.io.
3.1 Account information (you provide)
3.2 Content you create
Everything you put into Via, including tasks, notes (and their revision history), events, routines, comments, projects, categories, labels, goals and plans, focus sessions and time tracked, and files, images and documents you attach or upload (for example PDFs, Word and Excel files). When you attach a file we may extract its text so you can search it and so the assistant can use it.
AI conversations: messages you send to the Via assistant and its replies.
Voice (iOS and Apple Watch only): if you use voice capture, we process your recording to turn it into text. We keep the transcript; the audio recording is deleted within 7 days (Apple Watch recordings within 1 hour).
Feedback: messages (and any voice note) you send us through in-app feedback.
3.3 Google Calendar (optional)
If you connect a Google account, we receive:
See section 6 for how we handle Google data.
3.4 Usage, device and diagnostic information (collected automatically)
We use PostHog (EU-hosted) for product analytics. When you use Via we collect:
These events are linked to your Via account (user ID) so we can understand how the product is used and help you when you contact support.
The Via apps do not use mobile advertising identifiers or advertising SDKs. For how we measure our ads on the web, see section 3.9.
3.5 Purchase information
If you subscribe, payment is handled by Google Play (Android), Apple App Store (iOS), or Paddle (web), who act as the merchant or payment processor. We never receive your full card number. We receive and keep records of your plan, trial, purchase and renewal dates, subscription status, transaction IDs, country and price, so we can give you access to paid features. On mobile we use RevenueCat to manage subscription status.
3.6 Integrations you set up
If you create API tokens, connect Via to an AI tool through our MCP server, configure webhooks, or add your own AI provider key (“bring your own key”), we store those tokens, keys and settings (keys are encrypted) and a log of requests made through them.
3.7 Device permissions
Via only asks for a permission when you use the feature that needs it:
3.8 Marketing email choices
If you tick “Email me tips and offers from Via” when you sign up or check out, we record that you agreed, when, where (sign-up or checkout) and which version of the wording you saw, so that we can show you gave consent. If you later unsubscribe, we record when and how.
3.9 Ad measurement (web only)
a scrambled (hashed) copy of your email address and of your Via user ID;
the IP address and browser details (user agent) from when you signed up;
the ad click identifier, if there is one;
for trials and subscriptions, the subscription ID, plan value and currency.
Meta uses this to match the event to the ad and to tell us how our ads perform. Meta may also use it under its own terms to improve how ads are delivered; see Meta’s Privacy Policy at https://www.facebook.com/privacy/policy. We do not send Meta your tasks, notes or any other content, and we send nothing from the iOS, Android or Apple Watch apps.
Purpose
Data used
Legal basis (GDPR)
Create and secure your account, sign you in
Account information
Performance of our contract with you
Store, sync and show your tasks, calendar and other content across devices
Content, calendar data, preferences
Contract
Scheduling, planning and AI features you use (assistant, brain dump, voice-to-text, smart search)
Relevant content, calendar data, “Your context”
Contract
Subscriptions, trials and access to paid features
Purchase information
Contract; legal obligation (tax and accounting records)
Customer support and service messages (e.g. sign-in codes, workspace invites, billing notices)
Account information, content you share with support
Contract
Understand how Via is used, fix bugs, improve features
Usage, device and diagnostic information
Our legitimate interest in improving Via — you can object (section 11)
Keep Via safe: prevent abuse, fraud and harmful content
Account, usage and AI inputs (automated moderation)
Legitimate interests; legal obligation
Product news, tips and offers by email, including a short series of follow-up emails after you sign up
Email address, first name, time zone, whether you have started a trial or subscribed, consent record
Your consent, given by ticking the opt-in when you sign up or check out — you can unsubscribe at any time (section 12)
Measure how well our Facebook and Instagram ads work (section 3.9)
Hashed email and user ID, IP address, browser details, ad click identifier, sign-up, trial and subscription events
Measure which marketing emails help people get started with Via
Email send records, link clicks, whether you later started a trial or subscribed
Our legitimate interest in understanding which emails are useful — unsubscribing stops it
Attribute sign-ups to partners who referred you
Referral ID from the link you used
Comply with the law and enforce our terms
As needed
Legal obligation; legitimate interests
Apart from the ad measurement in section 3.9, we do not use your data for advertising, and we do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
Via’s AI features only run when you use them. To produce the result you asked for, we send the relevant data to our AI service providers:
Feature
What is sent
Provider
Assistant chat, brain dump, planning and goal mode
Your message, relevant tasks, notes, schedule (including synced Google Calendar events), attachments you add, “Your context”, time zone and language, and names of members of your workspace
Anthropic (Claude)
Voice to text (iOS / Apple Watch)
The audio recording
OpenAI
Talk (a spoken conversation with the assistant)
Your voice, streamed live while you talk, and the same context the assistant chat uses
Safety checks on text you send to the assistant
Your message
OpenAI (moderation)
Smart search
Text of your tasks and notes (title, content, category, project) to create search indexes
OpenAI (embeddings)
No training: our agreements with these providers do not allow them to use your data to train or improve their models.
Provider retention: providers may keep inputs for a limited period (up to 30 days) solely for abuse and safety monitoring, then delete them.
Bring your own key: if you add your own Anthropic key or connect your own OpenAI-compatible AI endpoint, your AI requests are sent to that provider under your own agreement with them, and their privacy terms apply.
AI output can be wrong. Review suggestions before relying on them.
Via’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
What we access: read-only access to the calendars you select (calendar.readonly); your Google email address; and, only if you turn on publishing, the ability to manage the separate “Via” calendar that Via creates (calendar.app.created).
How we use it: to show your calendar events alongside your tasks, to plan your schedule around them, and — if you use the AI assistant — to let the assistant take your calendar into account when you ask it to plan your day. Calendar data is shared with our AI provider (Anthropic) only to generate that response.
What we don’t do: we do not sell Google user data, use it for advertising, use it to train or improve generalised AI or machine-learning models, or let people read it, except with your permission, for security, or to comply with the law.
Storage: synced event data and your Google access tokens are stored on our servers; tokens are encrypted with Google Cloud Key Management Service.
Disconnecting: go to Settings → Integrations and disconnect Google. We then delete the synced calendar data from our systems, delete the “Via” calendar we created in your Google account, and discard the access tokens. You can also revoke access at https://myaccount.google.com/permissions.
We do not sell or rent your personal data. We share it only with:
Service providers who process data on our behalf under contracts that limit their use of it to providing their service to us:
Provider
Purpose
Location
Supabase
Database, authentication and file storage
EU (Ireland)
Google Cloud / Firebase
Application servers, background jobs, encryption keys, web hosting
EU (Belgium)
PostHog
Product analytics and session recordings
EU
Anthropic
AI assistant and planning
United States
OpenAI
Voice transcription, Talk, content moderation, search indexing
United States
Resend
Service emails (e.g. sign-in codes, workspace invites) and, if you have opted in, marketing emails, including counting link clicks
EU
Meta Platforms Ireland
Measuring our Facebook and Instagram ads (section 3.9), web only
Ireland / United States
Mailchimp (Intuit)
Our marketing email list, if you have opted in
United States
RevenueCat
Mobile subscription management
United States
Paddle
Web payments (merchant of record)
United Kingdom / EU
Google Play, Apple
App store payments
Per their privacy policies
People in your workspace. Content you create in a shared workspace is visible to its members according to the workspace’s access settings.
Services you connect. When you connect Google Calendar, an AI tool through MCP or the API, a webhook, or your own AI provider, we send data to that service at your instruction.
Legal and safety. If required by law, court order or valid legal request, or to protect the rights, safety or property of our users, the public or us.
Business transfers. If Daton Software Limited is involved in a merger, acquisition or sale of assets, your data may transfer to the new owner, who will remain bound by this policy, and we will tell you before that happens.
We store and process most data in the European Union. Some providers (listed in section 7) process data in the United States or other countries. When data leaves the European Economic Area we rely on an adequacy decision (such as the EU–US Data Privacy Framework, where the provider is certified) or the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. Contact us for a copy of the relevant safeguards.
Data
Kept for
Account information and content
Until you delete it or delete your account
Items you move to Trash
Permanently deleted after 30 days
Voice recordings (audio)
Up to 7 days (Apple Watch: 1 hour); transcripts are kept as content
Google Calendar data and tokens
Until you disconnect Google or delete your account
Marketing consent records (including when you unsubscribed)
Until you delete your account, so we can show we had your consent and that we respected your choice
Marketing email send records, link clicks and personal offers
Until you delete your account
Ad measurement data (IP address, browser details, ad click identifier)
API/MCP request logs
30 days
Analytics events
Up to 1 year, or until you delete your account, when we delete your analytics profile and its events
Session recordings
30 days
Purchase and billing records
As long as required by tax and accounting law (up to 7 years in Ireland), and to prevent repeat use of free trials
Backups
Overwritten on a rolling basis within 30 days
You can delete your account at any time:
your profile, private workspaces and their content, uploaded files, AI conversations, voice transcripts, calendar connections and integration tokens are permanently deleted within 30 days; copies in backups expire on the backup schedule above;
your email address is removed from our marketing list and your analytics profile is deleted;
content you created in a workspace shared with others remains available to that workspace, shown as authored by “Deleted user”;
we keep limited records we are legally required to keep, or need to prevent abuse (such as billing records and a one-way hash of your email to prevent repeat free trials).
Deleting your account does not cancel a Google Play or App Store subscription. Cancel it in Google Play (Payments & subscriptions → Subscriptions) or your Apple ID settings first. If you have an active subscription or own a workspace that other people still use, the app will ask you to resolve that before deleting.
If you are in the EEA, UK or another place with similar laws, you have the right to:
access your personal data and get a copy of it;
correct inaccurate data;
delete your data;
restrict or object to how we process it, including for analytics and direct marketing;
data portability — receive the data you gave us in a machine-readable format;
withdraw consent at any time, where we rely on consent, without affecting earlier processing.
To exercise these rights, email privacy@usevia.io. We will reply within one month (extendable by two months for complex requests) and may need to verify your identity. You also have the right to complain to the Data Protection Commission (www.dataprotection.ie) or your local data protection authority.
We send service emails (sign-in codes, invites, billing and important account notices) as part of running the Service. You can’t opt out of these while you have an account, because they’re needed to run it.
We send product news, tips and offers only if you ticked “Email me tips and offers from Via” when you signed up or checked out. Leaving it unticked has no effect on your account. If you opt in and haven’t yet started a trial or subscription, we may send you a short series of follow-up emails over your first few days, which can include a personal, time-limited offer. The series stops as soon as you start a trial or subscribe, or if you unsubscribe.
You can withdraw your consent at any time, without deleting your account:
click Unsubscribe at the bottom of any marketing email, or use your email app’s built-in unsubscribe button; or
email privacy@usevia.io.
Unsubscribing stops all marketing email from Via, including from our mailing list, and doesn’t affect the service emails above.
We protect your data with encryption in transit (HTTPS/TLS) and at rest, encryption of access tokens and API keys with a managed key service, access controls that limit staff access to what is needed to support and operate Via, and regular security updates. Staff access to an account for support purposes is logged. No system is completely secure; please keep your sign-in email account secure.
Via is not directed to children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
We may update this policy as Via changes. We will change the “Last updated” date and, for material changes, notify you in the app or by email before they take effect.
Daton Software Limited
The Hatch Lab, M11 Business Campus, Gorey, Co. Wexford, Y25 A8H2, Ireland
Privacy: privacy@usevia.io · Support: support@usevia.io