Privacy Policy

What personal data Avonao ID collects, why, who receives it, how long we keep it and how to exercise your rights.

1. Who is responsible

AVONAO, INC., 254 Chapman Rd, Ste 208 #21918, Newark, Delaware 19702, USA (a corporation formed in the State of Delaware, entity file number 10121895) is the controller of the personal data described in this policy.

Privacy questions and requests: privacy@avonao.com or the privacy rights request form on avonao.com. People in the European Economic Area, the United Kingdom, Switzerland and Brazil use the same channels, and we handle their requests at that address.

Our representative in the European Union. Our representative in the European Union under Article 27 GDPR, and our data protection officer for the European Union, is NUICORN, Chausseestraße 86, 10115 Berlin, Germany. You can contact them, and us at privacy@avonao.com, on all matters about your personal data.

This policy applies to Avonao ID, the passwordless account and sign-in service at id.avonao.com, and to the Avonao websites (the "Service"). Read it with the Terms of Service, the Cookie Policy and the list of Sub-processors.

Avonao platforms. Agined, Intramedial, Trustvice and GoPlainly are separate services, all operated by AVONAO, INC. Each has its own privacy policy for the data you create there, and each is responsible, as a separate controller, for what it does with the data it receives from Avonao ID. For sign-in and the account data held in Avonao ID, Avonao ID is an independent controller, whichever Avonao platform you use it for.

Businesses and their apps. A business whose app you allow is responsible for the data it receives from that moment on. Its own privacy policy applies, and the consent screen links to it. When a business uses an enterprise connection or signs in its own staff, we process that sign-in on the business's behalf as its processor, under the Data Processing Agreement that forms part of the business's agreement with us; the business is the controller. For account, security and website data, and for our own purposes described below, we are the controller.

In plain language: we collect what we need to run and secure your Avonao ID. An email address, a confirmed email and your answer to the age question are all we need to create it; everything else is optional and used only for the feature that needs it. Apps of other businesses get only what you allow on the consent screen. We do not sell your data and we never show ads. You can download your data and delete your account at any time, and section 7 explains exactly what that means.

2. What we process, and where it comes from

If you are a person named in an app's data by someone else, that business is the source. You can use the rights in section 8 against us for the data we hold.

What an app of another business receives. Only after you allow it on the consent screen: an identifier for you that is the same for all apps of that business and different for every other business, plus technical sign-in information (time of sign-in, sign-in method, a session identifier specific to that business). With email: your primary email address, marked as confirmed. With profile: your display name and language. An app never receives your account id, your other email addresses, your sign-in methods or your security log. Avonao's own platforms (Agined, Intramedial, Trustvice and GoPlainly) receive your account id, primary email, name and language without a consent screen, because you create or use your account on those services with your Avonao ID and their own policies tell you so.

Verified. Verified is optional and switched off at launch. When it is on and you choose it, Stripe, our provider, asks you to photograph an identity document and take a live selfie, and compares the face on the document with the selfie. That face comparison uses biometric data, which is special category data under Article 9 GDPR, so we start the check only after your separate, explicit consent, given by ticking an unticked box beside the full text (Verified consent). We never receive or keep document images, selfies, biometric templates or document data. Stripe receives only a reference number from us, not your email, name or account id. You can withdraw consent at any time, in one step and without signing in again, in your dashboard under Verified; we then stop any check still running, remove your Verified status, the record of your checks and the proofs you have not used, ask Stripe to delete what it collected, and email you a confirmation. Withdrawing does not affect what was done before.

3. What we do not store

We do not store:

• your password, because accounts have none;
• your card number, which is entered at Stripe only;
• your date of birth, because we ask only whether you are at least the minimum age;
• the document images, selfies, biometric templates or document data of a Verified check, which stay with Stripe;
• your Avonao ID account id, email address, name or IP address in the events we send to any analytics tool;
• the request bodies, cookies and sign-in secrets of an error report, which are removed before it is sent; or
• any sign-in link, code, authorization code or challenge for longer than the minutes in section 7.

We do not build profiles of your use of other businesses' apps.

4. Why we process it, and on what basis

Where we rely on legitimate interests you can object (section 8). Where we rely on consent you can withdraw it at any time.

California and other US states. We collect the categories above for the business purposes listed in this section. In the language of the CCPA, we collect identifiers (email, name, IP address), customer records and commercial information (subscription state, purchase outcome), internet and network activity (requests, logs, analytics if you consent) and approximate location derived from IP address. The only sensitive personal information we handle is the biometric data of a Verified check, which Stripe processes only with your explicit consent and which we never receive; we do not use sensitive personal information to infer characteristics about you. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or profiling.

5. Who receives it

• Service providers that process data on our behalf, listed on the Sub-processors page: Cloudflare (hosting, databases, network, DNS, service logs, email delivery and the Turnstile bot check), Stripe (payments through Avonao Billing and, only if Verified is switched on and you choose it, Stripe Identity), and Microsoft 365 (our company mailboxes, which hold what you write to us and our replies).
• Apps and businesses you allow. They receive only what you consent to on the consent screen, as described in section 2. They get more only if you choose to share more.
• Providers you choose to sign in with. Google, Microsoft and GitHub take part only when you choose to sign in with them or connect them. They learn that you are signing in to Avonao ID, and we receive your account identifier, your verified email address and your name if you allow it. Their own privacy policies apply, and each is a separate controller of its own account.
• Avonao platforms. The platform you use receives your account id, primary email, name and language, and tells us whether your subscription is none, free or paid, its renewal date and where to manage it. No prices and no billing data pass between us.
• A parent or guardian, only if you are below the age of digital consent: the address you gave for them receives an email naming you (your name as typed and your email address with most of it hidden), the service, the country and the texts they are asked to agree to. They learn nothing else about your account.
• Businesses you report receive a statement of reasons; your identity is not shared with them.
• Authorities and advisers. Courts, regulators and law enforcement where the law or a valid legal process requires, for example a valid order or a legal duty under the Digital Services Act, and our professional advisers (lawyers, accountants, auditors, insurers) under confidentiality. We check that a request is valid and limit what we give to what it requires, and where the law allows we tell the person concerned.
• A successor, if we merge with or sell the business, or to a buyer or investor and their advisers in a financing, under confidentiality, on terms that keep this policy's protections for your data and with notice to you as the law requires.
• Analytics and monitoring providers. None is live today. This policy and the Sub-processors page are updated, with the provider, its company and where it runs, before any is switched on. We never let such a provider use your data for its own advertising.

We do not sell personal data to anyone, and we do not share it for advertising.

6. International transfers

We are based in the United States. When you sign up you choose one of seven data-hosting regions: US East, US West, Europe Central, Europe West, Europe North, Asia-Pacific or Oceania. Your account data (profile, email addresses, sign-in methods, sessions, app connections, consent records, follows and security log) is stored in a database in that region, and the part of Avonao ID that handles your sign-in runs in a separate service for that region. For the three European regions the database is held under Cloudflare's EU jurisdiction, which keeps the data in the European Union; we do not choose the city. For the other regions we ask Cloudflare to place the database in the region, but that is a request and not a guarantee. A sign-up that is waiting for a parent or guardian, including the guardian's email address, is stored in the region you chose and nowhere else.

Some records are kept in our home region, US West, whatever region you chose: (1) a pseudonymous index (your account id, the region, and keyed hashes of your email addresses and sign-in identifiers, not the addresses themselves), which is how we find your region when you sign in; (2) records that belong to businesses (business accounts, apps, moderation decisions, our signing keys), including an invitation to join a business, which holds the invited email address, and a report about a business, which holds the reporter's email address if the reporter gave one; and (3) short-lived records created before we know who is signing in: a pending sign-in request from an app (up to 30 minutes; the app may have suggested an email address in it), sign-in state for passkeys and social sign-in (minutes), and the log entry of a failed passkey attempt with its IP address (13 months, like the security log). Everything else about you, including your security log, stays in your region.

Your connection reaches Cloudflare's network at the location nearest to you and our front service runs there, so your request, including your IP address, can pass through servers outside your region on its way to your data. Some actions (signing in with Google or Microsoft or with your company's single sign-on, using a business console, or us suspending an app) are handled by our home service, which then reads or changes the data in your region. Cloudflare's own network, security and logging systems are not limited to your region.

If you are in the EEA, the UK or Switzerland, your personal data is transferred to the United States and, depending on the provider, to other countries when you use the Service. Where personal data goes outside the EEA, the UK or Switzerland, we rely on the EU-US Data Privacy Framework (and its UK Extension and the Swiss-US Data Privacy Framework) where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses with the UK addendum (and, for Switzerland, the Swiss adaptations of the clauses). Cloudflare, Stripe and GitHub state in their data protection terms that they rely on the Data Privacy Framework first and the Standard Contractual Clauses as a second basis. The Sub-processors page shows each provider's company and transfer basis. You can ask for a copy of the safeguards at privacy@avonao.com.

7. Retention

See the Cookie Policy for the cookies and local storage we use.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy, and know the categories, sources, purposes and recipients;
• correct inaccurate data;
• delete your personal data (erasure), subject to the retention rules in section 7;
• port data you gave us in a structured, machine-readable format;
• object to processing based on legitimate interests, and restrict processing;
• withdraw consent at any time, without affecting earlier processing;
• opt out of sale, sharing and targeted advertising (we do none of these);
• limit use of sensitive personal information (we do not use it to infer characteristics);
• not be subject to a decision based solely on automated processing with legal or similarly significant effects (we make none);
• not be discriminated against for using your rights; and
• complain to a supervisory authority.

These rights come from the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA/CPRA), the comparable laws of other US states, the LGPD and PIPEDA, and apply to the extent those laws apply to you.

8.1 How to make a request

Most of this works directly in your dashboard: download your data as a JSON file (your account, sign-in methods, sessions, security log, connections, data receipts, businesses, follows, reports you filed, the record of your parent's or guardian's agreement, if any, and Verified results); correct your name and language and add or remove email addresses; revoke an app under "Your apps" and unfollow a business; and delete your account (28-day restore window).

For anything else, use the privacy rights request form on avonao.com, which covers GDPR requests and requests under California and other US state laws, or write to privacy@avonao.com.

• Verification. We confirm that the request comes from you, by email, before we act, so no one else can see or delete your data. We ask for no more than we need. If we cannot verify you, we tell you why.
• Response times. GDPR and UK GDPR: one month, extendable by up to two further months for complex or numerous requests. CCPA/CPRA and other US state laws: 45 days, extendable by 45 further days. LGPD: 15 days. We tell you before the first deadline if we need longer, and why. If you rely on more than one law, we commit to the shortest deadline among them.
• Cost. Free.
• Authorized agents. An agent may act for you with your signed permission, and we may verify that with you.
• If we say no. We give our reasons. You can appeal by replying to our answer or writing to privacy@avonao.com with "Appeal" in the subject.
• Complaints. You may complain to the data protection authority where you live, work or where you think an infringement occurred, for example your national authority in the EEA, the Information Commissioner's Office in the UK, the Federal Data Protection and Information Commissioner in Switzerland or, in California, the California Privacy Protection Agency (Art. 77 GDPR). Avonao has no establishment in the EU or the UK, so there is no lead supervisory authority. We would appreciate the chance to resolve it first.

9. Information for people in particular countries

9.1 Brazil

For people in Brazil, the Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018) applies to the processing described in this policy. The rights in section 8 include the rights in Article 18 LGPD, among them confirmation that we process your data, anonymisation, blocking or deletion of unnecessary or excessive data, information about the public and private entities we share it with, and information about the possibility of refusing consent and what follows from refusing.

For LGPD requests, including the rights in Article 18, use the privacy contact at privacy@avonao.com. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD). Personal data is transferred to the United States and to the data region you chose, with the safeguards described in section 6.

9.2 Japan

For people in Japan, the Act on the Protection of Personal Information (APPI) applies.

• Business operator. AVONAO, INC., 254 Chapman Rd, Ste 208 #21918, Newark, Delaware 19702, USA, represented by the Chief Executive Officer named in the Imprint.
• Purposes of use. The purposes in section 4.
• Your requests. You can ask us to disclose the personal data we hold about you, including records of its provision to third parties, to correct, add to or delete it, to stop using or erase it, and to stop providing it to third parties, as described in section 8.1. We charge no fee.
• Security control measures. Sign-in codes and recovery codes are stored only as hashes and authenticator secrets are encrypted. Account data is kept in the region you chose, in the data centres of Cloudflare, which is responsible for their physical security, and we keep a security log of account events, as described in section 14.
• Transfers to other countries. Personal data is stored and processed in the data region you chose and, for the records in section 6, in the United States. The service providers that receive it are bound by contract to handle it with measures equivalent to those the APPI requires of business operators. On request we provide information about those measures and about the data protection systems of the countries concerned.
• Questions and complaints. privacy@avonao.com. You can also contact the Personal Information Protection Commission of Japan.

10. Global Privacy Control and tracking

We honor the Global Privacy Control signal as an opt-out. A browser that sends it, or a Do Not Track signal, is treated as "no" for the optional tools, and we do not ask again. Tools that use cookies or device storage, and all session recording, run only after you agree in the cookie banner, and never on sign-in, sign-up, second-factor, recovery, passkey, age or guardian pages. You can change your choice at any time with "Cookie settings" in the footer. See the Cookie Policy.

11. California "Shine the Light"

California Civil Code section 1798.83 lets California residents ask which categories of personal information a business has disclosed to third parties for their direct marketing. We make no such disclosures. You can still write to privacy@avonao.com to ask.

12. Children

Avonao ID is not for anyone under 16: at sign-up it asks whether you are at least 16 and does not ask for a date of birth. If we learn that someone under 16 created an account, we delete it. A guardian-consent flow for younger members is built but switched off, and this policy is updated before it is switched on. The minimum age of 16 is at or above the age of digital consent in every EU country; national rules on contracts with 16 and 17 year olds can still apply, and in the UK the Children's code covers everyone under 18 who is likely to use the service. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to privacy@avonao.com and we will delete what we can, as described in section 7.

13. Automated decisions

We make no decision about you that has legal or similarly significant effects based solely on automated processing. The order of the directory follows published, fixed rules (Ranking rules); reports are decided by a person.

14. Security

We protect personal data with technical and organizational measures, including hashed sign-in links and codes, hashed recovery codes, encrypted authenticator secrets, separate regional services and databases for account data, a bot check on sign-up and business creation, and a security log of account events. No system is perfectly secure. If a personal data breach affects you, we notify you and the authorities as the law requires. Report suspected incidents to security@avonao.com.

15. Changes to this policy

We will tell you about important changes by email before they take effect.

16. Contact

• Privacy and data requests: privacy@avonao.com
• General questions: support@avonao.com
• Security: security@avonao.com
• AVONAO, INC., 254 Chapman Rd, Ste 208 #21918, Newark, Delaware 19702, USA (legal address)
• Mailing address, for general correspondence only: AVONAO, INC. • 2261 Market Street PMB 10671, San Francisco, CA, 94114, United States. It is not our legal address: all legal correspondence must be sent to the legal address in Delaware, and legal correspondence sent only to the mailing address is not treated as received by us.
• EU representative: NUICORN, Chausseestraße 86, 10115 Berlin, Germany
• Imprint