PiViva Privacy Notice

1. Who we are

This notice explains how PiViva Ltd ("PiViva", "we", "us"), a company registered in England and Wales under company number 17357455 with its registered office at 60 High Street, Wimbledon, London, SW19 5EE, collects, uses and protects your personal data when you use the PiViva coaching platform, including the coaching toolkit, the AI companion Viv, Report Room, and the coach directory (the "Service").

PiViva is the data controller for the personal data described here. Contact us at privacy@piviva.com.

Our ICO registration reference is ZC227068.

2. What we do not do

Stated first, because it frames everything else.

• We do not provide healthcare, therapy, counselling or medical treatment. PiViva is a coaching and personal development service.
• We do not ask you for information about your health, and we have not built any field, scale or question designed to collect it.
• We do not sell your personal data, rent it, or share it with anyone for their own marketing.
• We do not use what you write to train AI models, and nor does our AI provider.
• We do not build features that infer things about your health, your mood or your risk from what you write. There is no hidden score attached to your account.
• We carry no advertising and set no advertising cookies.

You may still choose to write about your health, and people do. Section 4 explains how we treat that.

3. What we collect

3.1 Account and profile

• Your name and email address.
• Your password, stored as a hash, never in plain text.
• Your date of birth, and a record that you confirmed you are 18 or over.
• How you have chosen Viv to be presented to you.
• The country your connection appears to come from, used to show you the right support resources and to confirm we can offer you the Service.

3.2 What you create

• Goals, actions, habits, scores and structured answers in the coaching tools.
• Free text you write: reflections, written answers, notes.
• Your conversations with Viv, stored so you can read them again.
• Documents you upload to Report Room.
• A record of what you have shared with a coach, when, and when you stopped sharing it.

3.3 Subscription

• Your tier, status, billing history and payment status.
• We never see or store your card details. Payments are handled by Stripe.

3.4 Technical

• IP address, device and browser information, and session records.
• Logs of administrative access to your data, so we can tell afterwards who looked at what.

3.5 If someone asks us for a sign-in link and has no account

We record every request for a sign-in link, including requests for email addresses that have no PiViva account. We do this because the alternative is telling a stranger whether an address is registered with us, which would be worse. The screen shows the same message either way and the real outcome is recorded on our side.

So we may briefly hold an email address belonging to someone who has never had any relationship with us. The record holds the address, the kind of message, whether it sent, and any error. No password and no credential of any kind. It is readable only by us, it is deleted on a schedule, and if it is your address and you would like it removed sooner, write to privacy@piviva.com.

4. Information about your health

We do not ask for it. We do not need it. But PiViva is a place where people write honestly, and what you write may sometimes reveal something about your physical or mental health.

Where that happens, we treat it as special category data under the UK GDPR. We minimise it, we do not analyse it, we do not draw inferences from it, and we do not build features on top of it.

Report Room is the one place where we knowingly accept documents that may contain this kind of information. It is scoped to occupational and personality instruments, we ask you not to upload clinical or medical records, and we take your explicit consent separately for each document.

5. Why we process your data, and our lawful basis

One basis against each purpose. Nothing is left to be inferred.

Providing the coaching tools and storing entries Contract, Article 6(1)(b) See the Article 9 position in section 3.4

Operating Viv, where the data access setting is on Contract for the conversation itself. The data access setting is relied on as consent for the context, Article 6(1)(a) Explicit consent, Article 9(2)(a), where special category content is involved. Currently unsound: the setting defaults on and no affirmative act is recorded. Build item BP-13 and question Q13

Sharing entries with a coach the user has chosen Contract, initiated by the user Explicit consent at the point of sharing

Report Room upload, storage and retrieval Contract Explicit consent, taken per document at upload

Billing and subscription management Contract, and legal obligation for tax records Not applicable

Transactional email Contract Not applicable

Marketing and lifecycle email Consent, Article 6(1)(a) Not applicable

Security, fraud prevention and audit logging Legitimate interests, Article 6(1)(f) Not applicable

Age verification and underage offboarding Legitimate interests, and legal obligation where applicable Not applicable

Safeguarding and crisis escalation Recognised legitimate interests, Article 6(1)(ea), Annex 1 paragraphs on safeguarding and emergencies. Vital interests, Article 6(1)(d), where life is at risk Article 9(2)(c) where the person cannot consent. Otherwise explicit consent, or the Schedule 1 safeguarding condition if adopted

Product improvement using aggregated data Legitimate interests Not applicable, provided the data is genuinely aggregated

Responding to complaints and rights requests Legal obligation Not applicable

6. Viv

Viv is an AI companion. She is not a person and not a coach, and we tell you so at the start of every conversation.

When you send Viv a message, that message goes to our AI provider, Anthropic, so a reply can be generated. For UK and EEA customers that service is provided by Anthropic Ireland Limited, under a commercial agreement with a data processing addendum. They do not train their models on data submitted through the interface we use.

6.1 What is sent with your message

A setting in your account, called data access, decides how much context goes with it. This is the exact position, because a vague description of it would not be worth reading.

Data access off Your first name, and nothing else. No intake, no pathway, no tool data.

Data access on Your most recent intake text and chosen pathway; one summary line for each tool you have ever completed, taken from your most recent entry for that tool; everything you are currently working on, in full; your active goals and outstanding actions; the aggregated results of any 360 Feedback and Johari Window Blind reveal; and, where Viv asks for it, what you wrote in one named tool's most recent saved entry.

Each of those summary lines carries five things:

Tool name The name of the tool, for example "Wheel of Life"

Category The tool's category, or "Uncategorised"

Date The date you created that entry

Score For scored tools only, the number. Otherwise "No score recorded"

Reflection For unscored tools, your own written reflection, cut off at 200 characters

Availability Whether that entry has writing in it, so Viv knows she can ask. What you wrote is not on this line

Viv also sees the things you are currently working on, and this part is not a summary. It is what you wrote:

Kind What sort of thing it is, for example a limiting belief, a fear or a role model

Title Its title, in full

Everything you wrote Every field you filled in against it, word for word and not shortened

Not sent Anything you have marked done. Only what you are working on now is sent, up to 80 things

In practice that means the following. Everything you have open in your lists, up to 80 things, with the kind of thing it is, its title, and everything you wrote against it. That includes your limiting beliefs and what you said they cost you, and your fears including the worst outcome you named. None of it is shortened. Separately, Viv can ask for one named tool's most recent saved entry and will be given what you typed into it, cut off at 1,500 characters, together with your written reflection for that entry in full.

So it is worth saying plainly what does not happen. We would rather be plain than reassuring here, because earlier versions of this page were reassuring and went out of date. What you write in a tool can be sent. It is not attached to every message: Viv is told only that an entry has writing in it, and she asks for that one tool's entry when she needs it. So less is sent at a time, and there is nothing you have written in a tool that she cannot ask for.

What you wrote into a tool stays in your account. What Viv sees of it is for each tool, its name, its category, a date, and either your score or the first 200 characters of what you wrote, plus a note saying whether that entry has writing Viv can ask for; separately, in full and not shortened, everything you are currently working on, together with your active goals, your outstanding actions and any aggregated feedback results; and when she asks for it, one named tool's most recent saved entry, being its date, its score, your typed answers cut off at 1,500 characters, and your written reflection for that entry in full.

6.2 The setting itself

• You can change it at any time in Settings.
• Turning it off takes effect on her next reply, with nothing carried over from earlier in the conversation.
• It is checked on our servers before any context is assembled, not in the screen you are looking at.
• Viv can read. She cannot create, change, delete or move anything.
• Documents in Report Room have their own separate setting, per document, and are not covered by this one.

Your conversations are stored in your account so you can read them again, and so we can check the quality and safety of Viv's responses.

7. Coaches

If you choose to share an entry or a document with a coach from the directory, you decide what is shared and with whom, and you can stop sharing at any time from inside the app.

Coaches are independent professionals. They are not our employees. Once you share something with a coach, they become responsible for it in their own right, under their own professional obligations and their own registration.

One thing worth saying plainly: stopping a share ends their access immediately, and it cannot unwind what they have already read or written into their own notes. We would rather tell you that than let you assume otherwise.

8. Safety

PiViva is not a crisis service and we do not monitor conversations in real time.

Our systems do look for language suggesting you or someone else may be at risk of serious harm. Where something is flagged, support resources are shown to you, and a member of the PiViva team may look at what triggered it. That review usually happens within two working days.

We will never close or restrict your account because you have told us you are struggling.

In rare circumstances, where there is a risk to someone's life and they are not in a position to agree, we may pass information to emergency services. That decision is taken by a person, recorded, and never made automatically.

If you are in crisis now: Samaritans, 116 123, free, any hour. Or 999 in an emergency.

9. Children

PiViva is an adult service with a minimum age of 18. We do not aim it at children and we do not knowingly collect personal data from anyone under 18. Because the Service is restricted to adults, we do not rely on parental consent under Article 8 of the UK GDPR for any processing.

At signup we ask for your date of birth and ask you to confirm separately that you are 18 or over. We use your date of birth to check eligibility and, in a generalised form, to help Viv respond in a way that suits your stage of life. We do not use it for advertising or profiling.

If we learn, or reasonably believe, that a user is under 18, we will restrict access to the account straight away and review it. Where we cannot satisfy ourselves that the account holder is 18 or over, we will close the account and delete the personal data in it, including tool entries, reflections, conversations with Viv and anything shared with a coach, within 30 days. Any coach who had access will lose it at the point of restriction. We rely on our legitimate interests in protecting children and running our platform lawfully, and on our legal obligations where those apply.

After deleting an account this way we keep a minimal record so the same person cannot immediately sign up again: a one-way encrypted version of the email address, the date of closure and the reason. Nothing else. We keep it for 24 months and then delete it.

If you believe a child has created an account with us, contact safeguarding@piviva.com. You do not need to prove anything to us before we act on a report of that kind.

10. Who we share your data with

Annex A lists every company that processes personal data on our behalf, what each does, and where the data sits. Each acts on our instructions under a written agreement and may not use your data for its own purposes.

We also share data with:

• Coaches you choose to share with, who act as independent controllers.
• Emergency services, only in the exceptional circumstances in section 8.
• Regulators, law enforcement and our professional advisers, where the law requires it or where we need to establish or defend legal rights.

Two things never happen: coaching content is never sent to our email providers, and card details never reach us.

11. International transfers

Your account and coaching data is hosted in Frankfurt, Germany, inside the European Economic Area, which the UK treats as providing adequate protection. AI processing is handled through an Irish entity, also within the EEA.

Where any transfer relies on a safeguard rather than adequacy, we use the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, and we hold a written risk assessment for each transfer.

12. How long we keep things

Every category has a period, a trigger that starts the clock, and a reason. The full schedule is available on request, and the main points are:

Your account and everything in it 30 days Closing your account

Report Room documents 30 days after closure, or immediately when you delete one Closure, or your deletion

Viv conversations 30 days after closure, or immediately when you delete one Closure, or your deletion

Records of consent you gave or withdrew, kept without your name once your account closes 6 years Withdrawal or closure, whichever is later

Billing and tax records 6 years plus the current financial year The end of the accounting period

Authentication logs 12 months Creation

Administrative access logs 24 months Creation

Safeguarding case records, anonymised 6 years Case closure

Complaints 6 years Complaint closure

Backups 35 days The backup being taken

Deletion means the record is removed rather than hidden. When you delete something it leaves the live database straight away and works out of the backups within 35 days. We say 35 days rather than implying it is instant, because instant erasure from backups is not something we could honestly promise.

Where the law requires us to keep a financial record, we reduce it rather than keep it whole: your name and email are removed and the transaction details remain.

13. Security

Encryption in transit and at rest. Row-level security on every table, so your data is visible to you, to Viv where you have allowed it, and to a coach you have chosen, and to nobody else. Administrative access is named and logged. Uploads are restricted by type and scanned.

We are building application-layer encryption of free-text content, with keys held outside the database, so that a copy of the database on its own would be unreadable. Our Trust and Safety page states what is live and what is still being built, and we will not claim a control before it exists.

14. Your rights

Under the UK GDPR you have the right to:

• Get a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased.
• Receive your data in a portable format.
• Restrict or object to certain processing.
• Withdraw consent at any time, where we rely on consent, without affecting what was lawful before you withdrew it.

Most of these you can do yourself in Settings, including exporting and deleting everything. Otherwise email privacy@piviva.com and we will respond within one month.

We will not ask you for more proof of identity than the request needs. If you are logged in and asking for your own data, that is usually enough.

15. Complaining

You have the right to complain to us directly about how we have handled your personal data. Email privacy@piviva.com. We will acknowledge it within 30 days and deal with it without undue delay. In practice we aim to acknowledge within five working days and answer within 30.

If your complaint is about the Service rather than your data, our Terms of Service set out where to send it.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, at any point. You do not have to come to us first, though we would rather have the chance to put it right.

16. Cookies and similar technologies

This section covers cookies and the things that behave like them: local storage, session storage, pixels and software development kits. The law treats them the same way, so we call them all cookies here.

Two places are covered, and the difference matters. Our website at piviva.com may carry statistical cookies. The app at app.piviva.com holds your private reflections and we aim to set nothing there beyond what is strictly necessary to sign you in and keep the Service secure.

Strictly necessary No Keeping you signed in, remembering what is in a form, security and fraud prevention.

Statistical No, but we offer a simple opt-out Measuring how the Service is used, in order to improve it.

Appearance and preferences No, but we offer a simple opt-out Remembering your display choices.

Everything else Yes Advertising, cross-site tracking, profiling. We do not use any of these.

Your browser can block or delete cookies. Blocking the strictly necessary ones will stop you being able to sign in, which is a limitation of how sessions work rather than a choice we have made. We honour a Global Privacy Control signal where your browser sends one.

17. Changes

We may update this notice. Where a change is material we will give you reasonable notice by email or in the app before it takes effect, and where the change affects something you consented to, we will ask you again rather than assume.

18. Contact

PiViva Ltd

60 High Street, Wimbledon, London, SW19 5EE

Company number 17357455 | ICO registration ZC227068

Privacy: privacy@piviva.com | Support: support@piviva.com | Safeguarding: safeguarding@piviva.com

Annex A. Who processes data for us

Last reviewed 19 August 2026. We update this annex before a new provider begins processing personal data, not afterwards. If you want to be told about every change, email privacy@piviva.com. You do not need an account to ask.

Anthropic Powers Viv. Processes the member's message and a summary of their coaching context, where the data access setting is on, to generate a response. Ireland, with onward processing under the provider's own arrangements

Supabase Database, authentication, storage and edge functions. The system of record for all account and coaching data. eu-central-1, Frankfurt, Germany

Stripe Subscription billing, payment processing, customer portal. Ireland and the United States

Resend Transactional email: account confirmations, billing notices, security and safeguarding notifications, sent from send.piviva.com. Ireland

Brevo Marketing and lifecycle email to users who have separately opted in, sent from viv@piviva.com. European Union

Lovable Application development and deployment platform. Since the July 2026 migration it holds no end-user data at rest. Provider-managed

Cloudflare Content delivery, DNS, edge routing and denial of service protection. Global edge network

Two things worth stating plainly

• Coaching content never reaches the email providers. Resend and Brevo receive your name, email address and subscription status. They never receive tool entries, reflections, conversations with Viv, or anything from Report Room. This is a standing build rule, re-checked whenever an email template changes.
• Card details never reach PiViva. Payment card data goes directly to Stripe. We hold a customer reference and a transaction record, never a card number.

Companies we do not use

Stated because the absence is a decision rather than an oversight.

• No advertising networks. PiViva carries no advertising and no advertising pixels.
• No data brokers. We do not buy, sell, rent or enrich personal data.
• No session replay or heat-mapping tools recording what you type or where you move inside the app.
• No third party analytics inside the authenticated app that receives coaching content.

Annex B. If you are in the European Economic Area

PiViva is a United Kingdom company and the Service is aimed at the United Kingdom. We do not restrict signup by location, so if you are in the EEA you can use PiViva, and this annex sets out what that means for you. Everything in the main notice applies as well.

B.1 Our representative in the EU

Under Article 27 of the EU GDPR, a controller outside the EU that offers a service to people in the EEA appoints a representative there. Ours is:

[EU REPRESENTATIVE NAME AND ADDRESS]

You can contact them about anything in this notice, in your own language, and they will pass it to us.

B.2 Where you can complain

As well as the routes in section 15, you may complain to the supervisory authority in the EEA country where you live, where you work, or where you think the problem happened. You do not have to come to us first.

B.3 Artificial intelligence

Article 50 of the EU AI Act has applied since 2 August 2026. It requires us to tell you, clearly and at the point you first interact, that you are dealing with an AI system rather than a person. We do that at the start of every conversation with Viv and keep an indicator visible throughout. Section 6 of this notice and our Trust and Safety page set out the detail.

B.4 Transfers

Your account and coaching data is hosted in Frankfurt, Germany, and AI processing runs through an Irish entity, so the data stays within the EEA for those purposes. Where anything is transferred to the United Kingdom, that transfer relies on the European Commission's adequacy decision for the United Kingdom.

Annex C. If you are in the United States

PiViva is a United Kingdom company and the Service is aimed at the United Kingdom. We do not restrict signup by location, so if you are in the United States you can use PiViva. Several states regulate what they call consumer health data more strictly than the UK does, and this annex sets out our position. Everything in the main notice applies as well.

C.1 Consumer health data

Washington, Nevada and Connecticut treat information that identifies a person's past, present or future physical or mental health as consumer health data, and the definition reaches inferences drawn from other information. Washington's My Health My Data Act allows an individual to bring a claim directly.

Our position is the same one stated in section 2 of the main notice, and it is what keeps this annex short. We do not ask for health information. We have built no field, scale or question designed to collect it. We draw no inferences about your health, your mood or your risk from what you write, and there is no score of any kind attached to your account.

Where you choose to write something that reveals your health, we treat it as sensitive, we minimise it, and we do not analyse it. Report Room is the one place we knowingly accept documents that may contain it, and we take your specific consent for each one.

C.2 Your rights

• Confirm whether we collect, share or sell consumer health data about you, and get a list of anyone we have shared it with. We do not sell it, and we do not share it for anyone else's purposes.
• Withdraw a consent you have given, and have the data deleted.
• Ask us to delete your consumer health data, including from our backups, which happens through the 35-day rotation described in section 12.
• Be free from discrimination for exercising any of these rights.

Use the routes in section 14. We will not ask you for more proof of identity than the request needs.

C.3 Sensitive data, opt-outs and signals

• We do not process sensitive personal information for any purpose beyond providing the Service you asked for.
• We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is nothing to opt out of, and we say so rather than offering a control that does nothing.
• We honour a Global Privacy Control signal where your browser sends one.
• We do not use automated decision-making that produces legal or similarly significant effects.

C.4 Age

PiViva is for adults aged 18 and over, everywhere. Section 9 of the main notice sets out how we check and what happens if we learn that someone is under 18.