Privacy Policy

avatarx is a platform for building AI avatar agents that talk with visitors on your website. This policy covers the avatarx website, the dashboard at avatarx.net, the API, and the embeddable chat widget.

The data controller for account data is [Company legal name], [registered address], reachable at [privacy@avatarx.net]. If we have appointed a data protection officer or an EU representative, their contact details are [contact].

Two different relationships exist, and your rights differ between them:

Account and security data

What you build

Conversations and the people in them

We do not collect special category data (health, biometrics, political opinions and similar) deliberately, and agents should not be configured to ask for it. Anything a visitor volunteers in a conversation is stored in the transcript as typed or spoken.

We do not sell personal data, and we do not use it for advertising or profiling.

• Application data lives in a PostgreSQL database on a dedicated virtual server rented from Contabo, located in [data-centre region — confirm before publishing].
• Uploaded documents, media and avatar files are stored on that same server's disk.
• Redison the same server holds short-lived job and queue state. Both the database and Redis listen only on the server's loopback interface — they are not reachable from the internet.
• Some processing necessarily leaves that server: see the sub-processors below.

To answer a visitor in real time, parts of a conversation are sent to specialist providers. We use only what the product needs:

Speech recognition runs on our own server rather than a third-party service. Where a provider is outside the UK/EEA, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision — see [link to your transfer documentation].

• Replies are generated by the model provider you select per agent. Prompts, retrieved knowledge and recent conversation turns are sent to them for that purpose.
• Under those providers' API terms, content sent through the API is not used to train their models by default. Confirm the current terms of the provider you choose.
• Agents can be configured with memory, which lets them recall a returning visitor's earlier conversations with the same agent — or, if the account holder enables sharing, with their other agents.
• Automated replies are not used to make decisions with legal or similarly significant effects.

If you are in the UK or the EEA you have the following rights. They apply to personal data we hold about you as a controller; for data inside an account holder's agents, ask that business.

• Access — a copy of the personal data we hold about you.
• Rectification — correct anything inaccurate. Most fields are editable in the dashboard.
• Erasure — ask us to delete your data. Deleting an agent or closing the account does most of this immediately.
• Restriction — ask us to pause processing while a dispute is resolved.
• Portability — receive your data in a machine-readable form. Leads export to CSV in the dashboard, and the API returns agents, knowledge and conversations as JSON.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing relies on consent, withdraw it at any time without affecting past processing.
• Complain— to your local supervisory authority. In Germany that is the data protection authority of your state; in the UK, the Information Commissioner's Office.

Write to [privacy@avatarx.net] and we will respond within one month, as the GDPR requires. We may ask you to confirm your identity first.

These are the measures actually in place:

• In transit — HTTPS everywhere, with HSTS and an automatic redirect from plain HTTP. Certificates renew automatically.
• Passwords — hashed with bcrypt; we cannot read them.
• Sessions — only a SHA-256 hash of each session token is stored, in an HttpOnly, Secure cookie, with a sliding expiry, an idle timeout and instant revocation.
• Brute-force protection — accounts lock after five failed sign-ins, with a backoff that grows on repetition.
• Secrets at rest — SMTP passwords, Google refresh tokens and custom-tool credentials are encrypted before they are stored, and are never returned by the API.
• Tenant isolation— every request is scoped to the account that made it; another account's data returns “not found”.
• Outbound guard — custom tool URLs must be public HTTPS; requests to internal or private network addresses are refused, so a tool cannot be used to reach our infrastructure.
• Hardening — database and cache bound to loopback only, the application running as an unprivileged user, and security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) on every response.
• Audit logging — administrative actions are recorded with actor and IP address.

Being straight about the limits: transcripts and knowledge content are stored unencrypted at the field level, so a person with database access could read them. Access is limited to those who need it to operate the service. No system is perfectly secure; if a breach affects your data we will notify you and the relevant supervisory authority as the GDPR requires.

• One strictly necessary cookie — a session cookie set when you sign in. Without it you cannot stay signed in.
• Browser storage— the dashboard keeps your session token and small preferences (such as the last agent you were configuring) in your browser's session and local storage. They never leave your device except as the session token on requests you make.
• No advertising or analytics cookies, and no third-party tracking scripts on this site. Usage statistics in your dashboard are computed from your own conversations on our own servers.

The business running that agent decides what it asks for and why — they are the controller, and we process it for them. What is typically stored: the conversation transcript, any name, email or phone you provided, appointment details if you booked one, and technical session information.

To access or delete that data, contact the business whose site you were on. If you cannot reach them, write to [privacy@avatarx.net] and we will help identify the right controller and support their response.

avatarx is not intended for children under 16 and we do not knowingly collect their personal data. If you believe a child has provided data through an agent, tell us and we will delete it.

We will update this policy when the product changes, and the date at the top will change with it. Material changes will be announced in the dashboard.

Questions, requests or complaints: [privacy@avatarx.net], or write to [Company legal name, registered address]. See also our Terms of Service.