Skip to content
Avaloi

Privacy policy

What Avaloi collects to run your account, how long it keeps it, and how to ask for your data. Draft text.

This is a draft. Counsel has not reviewed this text.

Avaloi collects what it needs to run the account: email, name, company, role, sessions, API key metadata, and the activity log. Avaloi does not sell personal data.

What Avaloi collects

  • Account: email, name, locale, hashed password, passkeys, two-factor secrets.
  • Company: name, slug, members, invitations, SSO configuration.
  • Security: IP, user agent, sign-in events, new-device notices.
  • Support: messages you send to Intercom or [email protected].
  • Analytics: product events in PostHog after you consent. Inputs are masked.

Payment cards and domain registrant contacts arrive with later products. Avaloi will update this notice then.

Processors

Draft list: Neon (database), Google Cloud (control plane), Cloudflare (edge), Resend (email), Intercom (support), Sentry (errors), PostHog (analytics, after consent), HubSpot (marketing forms). A reviewed subprocessor list ships before Phase 5.

Retention

Personal data is purged within 30 days of account deletion. Audit events stay 13 months with the actor labeled deleted user.

Your rights

Email [email protected] to access, correct, or delete your data. Avaloi verifies you before it acts.

Still stuck?

Email [email protected] with your site name and what you tried, or send us a message.