Privacy Policy

At AvaroAI (“we”, “us”, “our”), we value the privacy of our users (“you”, “your”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our real estate operations management platform.

By using our services, you acknowledge the processing described in this policy. Where consent is the applicable legal basis, you may withdraw it subject to the limits of applicable law.

Information we collect

We may collect the following types of personal information when you interact with our services:

• Personal Identification Information: Name, email address, and profile avatar.
• Organization Information: Organization name, email, phone number, public website domain, country, networking setting, and organization logo/watermark.
• Branch Information: Branch name, email, phone number, address, time zone, and connections to other organizations’ branches.
• Contact and Customer Data: Names, email addresses, phone numbers, postal addresses, company information, websites, professional details, property requirements, notes, and communication history for contacts managed within your organization.
• Property Listing Information: Property details including addresses, coordinates, descriptions, pricing, seasonal rental prices, deposits, commission, management fees, photos, floor plans, property features, portal-specific fields, and transaction information (instruction dates, agreement dates, completion dates).
• Lettings and Property Management Data: Lettings, including the tenant, their lawyer, dates, rent, deposit, commission, number of occupants, and notes; inspections, including inspectors, times, and findings; contractor work agreements, including the contractor, price, and status; and alerts.
• Payment Records: Rent, deposit, commission, fee, contractor, and refund records that your organization enters, including amounts, due and paid dates, status, and the related listing, letting, or work order. AvaroAI records these payments but does not process them.
• Forms and Custom Fields: Responses to forms, such as inspection checklists or viewing feedback, and values in custom fields that your organization defines.
• Integration Credentials: Property portal branch identifiers, certificates, and private keys that Managers provide to connect to third-party platforms.
• Subscription Payment Information: Credit card details and payment methods for your AvaroAI subscription (handled securely by Stripe, our payment processor). We store only non-sensitive payment information such as card type and last four digits.
• Subscription and Billing Information: Subscription status, billing periods, payment history, tax identification numbers, and credit usage.
• Usage Information: Information about reminders, appointments, viewings, alerts, calendar activity, AI conversations and operations, team collaboration, and system usage patterns.
• Device and Technical Information: IP address, browser type, device information, and interaction data with our platform.
• File Uploads: Property photos, organization documents, contact, letting, and payment import files, and other files you upload to our platform.

Much of this information concerns people other than our users, such as buyers, tenants, landlords, contractors, and their representatives. Your organization decides what to record about them and is responsible for having a lawful basis to do so.

How we use your information

We may use the information we collect for the following purposes:

• Service Delivery: To provide contact and listing management, offers, viewings, lettings, inspections, work orders, payment tracking, alerts, reminders, appointments, forms, reports, calendar feeds, file storage, and team collaboration features.
• Property Portal Integration: To publish your sales and rental listings to portals when you choose to, and to remove them when you ask.
• Public Website and Developer API: To show listings you mark for publication on your organization’s public website and through the developer API.
• AI-Powered Features: To provide semantic matching, the AI Assistant, file analysis, spreadsheet imports, form completion, public-web research, content generation, and AI-assisted operations requested by users.
• Payment Processing: To process subscription payments, manage billing, handle credit purchases, and maintain your account’s payment methods through our payment processor, Stripe.
• Communication: To send you account notifications, team invitations, password reset emails, subscription updates, credit balance alerts, and other service-related communications.
• Team Management: To manage team memberships, role-based access control, and collaboration features within your organization.
• Customer Support: To assist with any queries, technical issues, or support requests related to our platform.
• Improvement of Services: To analyze usage patterns, enhance our platform features, improve user experience, and develop new functionality.
• Legal Compliance: To comply with applicable laws, regulations, and legal obligations.

Sharing your information

While we do not sell or rent your personal information, we may share certain details with trusted third-party partners for the following reasons:

• Payment Processors: Payment information is processed through Stripe, our secure third-party payment processor. Stripe receives your payment details, billing address, tax information, and subscription data. We do not directly store your complete card information.
• AI Service Providers: OpenAI processes prompts, relevant organization data, and content submitted to AI features, including lettings, payments, inspections, work orders, and forms the AI Assistant reads or changes, and spreadsheets submitted for import. Files submitted in ‘Analyze’ mode remain usable for 28 days, as shown in the product. OpenAI retains submitted files for at least 30 days, and often deletes them shortly after that. Ordinary record attachments are not sent for content analysis unless ‘Analyze’ mode is enabled.
• Property Portals: When you publish a listing to a portal, we send that portal the listing’s property details, description, price, rental terms, photos and floor plans, visible custom fields, and agent information so it can advertise the property. Changes are sent only when you re-publish. Each portal handles this data under its own privacy policy.
• Public Website and Developer API: Listings you mark for publication, including their photos and visible custom fields, are publicly accessible on your organization’s website and to anyone holding one of your developer API keys.
• Calendar Feeds: Your personal calendar feed contains appointments, viewings, listing milestones, and alerts. If you subscribe to it in a calendar application, such as Google Calendar, Apple Calendar, or Outlook, that provider receives the feed’s contents.
• Connected Organizations: If your organization enables networking, contacts and listings you mark as shared are visible to connected AvaroAI organizations.
• Email Service Providers: We use Cloudflare to deliver transactional emails, notifications, and service communications. They receive email addresses and message content necessary for delivery.
• Cloud Storage Providers: We use Cloudflare to store uploaded files, photos, and documents.
• Mapping Services: We use Google Maps to provide address search and coordinate selection functionality. Google receives address queries and location data when you use these features.
• Error Tracking: We use Sentry to monitor application errors and performance. Sentry may receive technical information such as IP addresses, browser type, and error context to help us diagnose and fix issues.
• Legal Compliance: If required by law, we may disclose your personal information to comply with legal obligations, protect our rights, or respond to valid legal requests.

Data security

We implement comprehensive security measures to protect your information:

• Secure Connections: All data transmission uses SSL/TLS encryption (HTTPS).
• Password Protection: User passwords are hashed using bcrypt, an industry-standard one-way hashing algorithm.
• Encryption at Rest: Sensitive integration credentials are encrypted using AES-256 encryption.
• API Key Protection: Developer API keys are stored only as one-way hashes and are shown once, when they are created.
• Access Controls: Role-based access control ensures team members only access data appropriate to their role (manager or associate).
• Secure File Storage: Files and photos are stored in separate public and private storage clouds with appropriate access restrictions.
• Payment Security: We are PCI-compliant through our use of Stripe. We do not store complete card numbers or security codes.

However, please note that no security system is completely foolproof, and we cannot guarantee the absolute security of your data. We continuously monitor and update our security practices to protect your information.

Your rights and choices

You have the right to:

• Access: Request a copy of the personal information we hold about you, including your user profile, organization data, contacts, listings, and usage history.
• Update or Correct: Request that we update or correct any personal information. You can also update most information directly through your account settings.
• Delete: Request deletion of your personal information. When an organization is closed, its contacts, listings, lettings, payment records, inspections, work orders, alerts, forms, photos, files, reminders, appointments, viewings, AI conversations, and team memberships are scheduled for deletion, subject to legal retention requirements.
• Export: Request a copy of your data in a portable format (subject to technical feasibility).
• Opt-Out: You may opt out of non-essential communications. Note that certain service-related emails (password resets, subscription notifications, critical account alerts) cannot be opted out of while maintaining an active account.
• Object: Object to processing of your personal information for specific purposes where we rely on legitimate interests.

To exercise any of these rights, please contact us through the AvaroAI website.

Retention of your information

We retain your personal information as follows:

• Active Accounts: Personal information is retained while your account remains active and for a reasonable period afterward to comply with legal and business requirements.
• Deleted Accounts: When you delete your account, we will remove your personal information. However, some information may be retained in backup systems for up to 90 days.
• Organizations: When an organization is deleted, its associated operational data is removed from active systems.
• Expired Data: Appointments are automatically deleted 90 days after their end date. AI conversations are deleted 28 days after they were started. Identity verifications with a result, and their reports, are deleted from AvaroAI and from our identity verification provider 5 years after the result. Analyze-mode files are available in AvaroAI for up to 28 days, but OpenAI retains them for at least 30 days and often deletes them shortly after that. Other temporary or expired operational data is purged according to the service’s retention schedules.
• Legal Requirements: We may retain certain information longer when required by law, regulation, legal proceeding, or to protect our legal rights.
• Aggregated Data: We may retain anonymized, aggregated data indefinitely for statistical analysis and service improvement.

Once your information is no longer needed, we will securely delete or anonymize it.

International data transfers

AvaroAI may store and process your personal information in various locations to provide our services. If you are located outside the country where our servers are located, please note that your information may be transferred to, stored, and processed in a different jurisdiction. We take appropriate measures to ensure your data receives adequate protection wherever it is processed.

Cookies and tracking technologies

We use cookies and similar tracking technologies to provide functionality and enhance your experience:

• Session Cookies: Essential cookies that maintain your logged-in session and enable core platform functionality.
• Remember Me: Optional persistent cookies that keep you logged in across browser sessions when you select “remember me.”

Children’s privacy

AvaroAI is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will take steps to delete such information.

Data breach notification

If a personal-data breach occurs, we will notify regulators and affected individuals when and within the times required by applicable data-protection law. Any user notification will explain the nature of the breach, the data affected, and appropriate protective steps.

Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or for other operational reasons.

For material changes that significantly affect your rights or how we process your personal information, we will provide prominent notice through email notification or a notice on our platform before the changes take effect.

We encourage you to review this policy periodically to stay informed about how we protect your personal information.