EU Data Act

2. Switching or leaving

You can ask to switch to another provider, move your data to your own systems, or erase it and leave. You do not need our help for any of these: the data download and the account deletion are in your dashboard. If you want the terms of this section to apply, tell us:

• How to ask. Write to support@avonao.com with "Data Act switching" in the subject line, from the email address of your account, or for a business from the address of an owner of the business account. Say which of the three you want and, if it matters to you, the date on which to start.
• Notice. None is required. The switch starts when we receive your request, or on a later date you name, no more than two months ahead.
• Transition period. Up to 30 days, during which your account, your plan and these terms stay in force. We help you and the provider you name, keep the Service running as your terms provide, tell you of any risk to its continuity we know of, and keep your data secure, including while you transfer it. If 30 days is technically impossible, we tell you within 14 working days of your request, with our reasons and an alternative period of no more than seven months. You can extend the transition period once, for as long as you need.
• Retrieval period. At least 30 days after the transition period ends. Everything in the register in section 3 stays available to export.
• End of the contract. Your contract ends when the switch is complete, or, if you asked only for erasure, when the transition period ends. We confirm it by email.
• Erasure. When the retrieval period ends, or at a later date you agree with us, we erase all the exportable data listed in section 3 and confirm it by email. We keep only the records the law requires, and the records we keep to protect the Service and others, as the Privacy Policy describes: the security log, which is anonymised when the account is purged, and moderation decisions about businesses. Copies in our hosting provider's point-in-time recovery data expire on its schedule, up to 30 days, and are not used for any other purpose. An account cannot be deleted while a paid subscription on an Avonao platform is running; you end it on that platform first.

No charges. We charge nothing for switching, for exports or for data transfer. Fees of a paid plan for the period in which you still use the Service, including the transition period, apply as usual.

3. Register of exportable data and formats

You can export all of the following during your contract and the retrieval period, yourself, at any time and without asking us:

What you cannot export, and why:

• Secrets. We store tokens, sign-in links and codes, and client secrets that only need to be checked as hashes, and we hold the secrets the service must read, such as second-factor secrets and connection client secrets, encrypted. Create new credentials and secrets with your new provider.
• Our signing keys. The private keys that sign ID tokens are held as platform secrets that only our service can use. The public keys are published, which is all an app needs to check a token.
• Data about how the Service runs internally. Rate-limit counters and our service logs describe our systems rather than your use of them, and exporting them would expose how we protect the Service. Leaving them out does not hold up or delay a switch.

Formats and standards

Because Avonao ID signs members in with the open OpenID Connect standard, an app that has been connected to Avonao ID can be connected to another OpenID Connect provider.

4. Where each part of the Service runs

A location hint is a placement request to Cloudflare, not a guarantee. The Privacy Policy gives the detail, and the Sub-processors page lists every provider.

5. Protection against access by governments outside the EU

AVONAO, INC. is a United States company, and our main providers, Cloudflare and Stripe, are United States companies too. We are subject to United States law, including laws that allow authorities to ask for data a US company controls, wherever the data is stored. We cannot promise that no such request will ever reach us. These are the measures we take to prevent access to, or transfer of, your data held in the EU where it would conflict with EU law or the law of a Member State:

• Data minimization. Apps receive only the scopes a member allowed, with a separate identifier for each business and never the account id. No passwords are stored, passkeys store only the public key, and tokens are stored only as hashes.
• EU storage. Account data in the three European regions is stored under Cloudflare's EU jurisdiction.
• Review of every request. We check each request from a government or court for its legal basis, for its scope and for conflict with EU or Member State law, and challenge one that is unlawful, too broad or in conflict with EU law. A request from outside the EU for data held in the EU is met only where an international agreement in force, such as a mutual legal assistance treaty, provides for it, or where Article 32 of the Data Act otherwise allows it.
• The least data. Where we must comply, we disclose only the minimum the request lawfully requires.
• Telling you. We tell you of a request before we act on it, unless the law forbids it or the request serves law enforcement and telling you would defeat its purpose for as long as that lasts.
• Contracts. Our agreements with our providers rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, as the Sub-processors page shows, and our Data Processing Agreement binds us to the same approach for personal data we process for businesses.

6. Changes and contact

We update this page when our switching process, our formats or the location of a service change, and tell members and businesses by email of any change that reduces their rights. Questions: support@avonao.com.

EU notices

• Reporting a business: notice and action
• Ranking rules of Avonao Business Circle
• Digital Services Act
• EU Data Act

Corporate transparency

• Imprint
• Impressum
• Modern Slavery and Human Trafficking Statement

Program terms

• Startup Program Terms