GDPR

Data protection rights under GDPR

If you are in the EU/EEA or otherwise covered by GDPR, this page describes your rights, how we protect your data, and how to exercise those rights.

Last updated: July 27, 2026

How We Protect Your Data Under GDPR

Avo is built on Google Cloud infrastructure. All data is encrypted in transit via TLS and encrypted at rest using Google Cloud platform-managed encryption. We do not sell personal data and do not use it for ad targeting.

Specific technical measures include:

•Authenticated sessions use secure browser cookies and server-side verification for protected requests.
•Protected browser mutations use request validation such as CSRF checks where applicable.
•Firestore rules and server authorization checks enforce account ownership or verified administrative access.
•Content Security Policy, transport security, framing restrictions, and related browser headers reduce common web risks.
•Selected AI, authentication, and integration endpoints use request validation and abuse controls.
•Automated tests cover authentication gates, administrative routes, privacy-sensitive behavior, and known security contracts.

Infrastructure partners (Google Cloud, Firebase, Vercel) operate under contractual data protection obligations. AI processing providers receive the information needed for requests you make or background features you enable. The privacy policy describes current providers and feature-specific data flows.

Your Rights

Under GDPR, you can make the following requests about how your personal data is processed.

Right to Access

Request a full copy of all personal data we hold about you, including workspace content, account metadata, and AI interaction history.

Right to Rectification

Request correction of any inaccurate or incomplete personal data. Profile information can also be updated directly in app settings.

Right to Erasure

Request deletion of your personal data and account. This removes your content from Firestore and associated media from Firebase Storage.

Right to Restriction

Request that we limit how your personal data is processed while a dispute or request is being resolved.

Right to Data Portability

Request your data in a structured, machine-readable format that you can transfer to another service.

Right to Object

Object to certain types of processing. Avo does not use your data for advertising or automated decision-making that affects you legally.

How to Submit a Request

Email us from the address associated with your Avo account so we can verify your identity and protect your data.

•Include your request type (access, deletion, export, correction, restriction, or objection) and identify the account or Avo views involved.
•Provide any context that helps locate relevant data, such as date ranges or entry names, without sending passwords or authentication codes.
•Avo will respond within the period required by applicable law. If additional time or identity verification is permitted and needed, Avo will explain the next step.

For GDPR requests, contact privacy@heyavo.ai.

How We Protect Your Data Under GDPR

Specific technical measures include:

•Authenticated sessions use secure browser cookies and server-side verification for protected requests.

•Protected browser mutations use request validation such as CSRF checks where applicable.

•Firestore rules and server authorization checks enforce account ownership or verified administrative access.

•Content Security Policy, transport security, framing restrictions, and related browser headers reduce common web risks.

•Selected AI, authentication, and integration endpoints use request validation and abuse controls.

•Automated tests cover authentication gates, administrative routes, privacy-sensitive behavior, and known security contracts.

How to Submit a Request

Email us from the address associated with your Avo account so we can verify your identity and protect your data.

•Include your request type (access, deletion, export, correction, restriction, or objection) and identify the account or Avo views involved.

•Provide any context that helps locate relevant data, such as date ranges or entry names, without sending passwords or authentication codes.

•Avo will respond within the period required by applicable law. If additional time or identity verification is permitted and needed, Avo will explain the next step.

For GDPR requests, contact privacy@heyavo.ai.