Privacy policy

Who we are

Avenyo (“we”, “us”) runs the marketing service at marketing-agent.avenyo.app. It researches a business's website, competitors and public customer conversations, turns that into a marketing plan, and then does the work that plan asks for. This policy covers that service. We are the controller of the personal data described here. You can reach us at tim@avenyo.app.

What we collect

• Account details. When you sign in with an email link or with Google, we receive your email address and a user ID, and we add that email to our contact list so we can reach you about your account. Signing in with Google requests basic profile access only (email, name and profile picture); we never receive your Google password, and signing in gives us no access to your Gmail, Drive or anything else in your Google account. Sending from your Gmail is a separate connection you have to switch on yourself, described below.
• What you submit for an analysis. The website address, and any details you choose to add, such as visitor, signup or customer numbers, acquisition channels and your biggest problem.
• Your numbers and notes. The weekly counts you add (visitors, people who got in touch, new customers) and any note with them, the checkup fixes you add to your plan, and the emails you ask us to write, including what you asked for.
• Connected Google data (Pro, only if you connect it). If you connect Google Search Console or Google Analytics for a business, we store an encrypted access token, the Google account email that granted access, the property you chose, and a summary of the last 28 days: search clicks, impressions, average position and top searches, or visitors, visits, key events and where visits came from. Access is read-only. Disconnect any time and we delete the token and the numbers and revoke our access.
• Your Gmail, only if you connect it for sending (Pro). If you want the team to send its emails from your own address, we store the Google account email you connected and an encrypted refresh token. We ask for one permission, gmail.send, which lets us send a message and nothing else: we cannot read, search or delete anything in your mailbox, and we don't ask to, on purpose. We use it only to send emails you approved, one at a time. Disconnect any time in the app and we delete the token and revoke our access.
• Other connected tools (Pro, only if you connect them). If you connect X, or paste a read-only key for Stripe, Lemon Squeezy, Paddle, Polar, PostHog or Plausible, we store that key or token encrypted, along with the account or project you chose and a summary of the numbers we read from it. Disconnect any time and the key and the numbers go.
• Businesses the team finds for you (Pro). When you ask the team to find businesses that could buy from you, we search Google's business listings and read the public websites of the businesses that come back. For each one we store its name, address, category, website, a business contact address published on that site or listing, a fit score and the reasons for it, short quotes from the site that a personalised email can lean on, and then the emails drafted for it, whether you approved and sent them, and what you recorded happening next. This is business contact information, but it can include a person's name in an address such as a founder's. More on how we handle it below.
• Billing. Payments are handled by Stripe. We store your Stripe customer and subscription IDs, the subscription status and renewal date. We never see or store your card details.
• Reports and projects. The analyses, reports, growth plays and campaign drafts we generate for you, and the projects they belong to. A report's link is hard to guess but not secret: anyone who has it can see the report's summary, so share links with care. The full report and your projects are only visible to your account.
• Contact requests. If you ask about a paid plan or leave your email to hear about a feature (for example connecting analytics or payment data), we store that email and what you asked about.
• Abuse prevention. To limit free analyses, we turn your IP address into a salted one-way hash. The raw IP address is never stored.
• Cookies and local storage. Only what the service needs: sign-in session cookies, a cookie that lets you claim a report you ran before signing in, and your light/dark theme choice. If you arrive through a link we shared, or from an AI assistant, we ask before setting one more cookie (av_c): it keeps only that link's code for 30 days, so we can tell which link brought you if you sign up, and your answer is remembered in this browser (av_consent). Changed your mind? Remove it and don't ask again. We don't use advertising cookies.
• Site analytics. We count visits to avenyo.app's public pages (not the app behind sign-in) with PostHog in cookieless mode: it sets no cookie and stores nothing in your browser. PostHog tells visits apart with a one-way hash of your IP address and browser that changes every day, and records the page, where you came from, and your browser and rough location. When an account is made, we send PostHog a signup event without your email or account id.
• Visits from our links. When you arrive through one of those links, our site tells us which link and which page you landed on. It sends no name, address or page title. To count each person once a day we combine your IP address and browser type with a secret that changes daily and keep only the resulting hash, which can't be traced back to you; the IP address itself is not stored.

When we research a business we read publicly available web pages, including the submitted website, competitor sites and public discussions such as Reddit threads. Those sources may contain names or usernames that people posted publicly. We use them only to understand the market, and we quote them in reports as evidence.

How we use it and why we're allowed to

• To provide the service: sign you in, run analyses, save your projects, show your reports, and do the work your plan asks for. Legal basis: performing our contract with you.
• To keep the service working and fair: rate limiting, preventing abuse, fixing errors. Legal basis: our legitimate interest in running a secure service.
• To find businesses that could buy from yours, and to draft the emails you then approve. Legal basis: the legitimate interest of you and of us in business-to-business marketing, balanced against the interests of the people at those businesses — which is why we use published business addresses only, keep the amount we hold small, and never send anything without your approval.
• To see which of our links bring people: counting visits from them, and signups when you allowed the cookie. Legal basis: our legitimate interest in knowing whether our marketing works, and your consent for the cookie.
• To count visits to this site, without cookies (PostHog, above). Legal basis: our legitimate interest in knowing how many people visit and where they come from.
• To contact you about your account, or about features you asked to hear about. Legal basis: contract, or your consent, which you can withdraw at any time.
• The Monday email (Pro) with your week's to-dos. Legal basis: performing our contract with you. Turn it off with one click in the email or in settings.
• We don't use your data, or the content of your mailbox or your reports, to train AI models.

Businesses we find for you

This part is about people who never signed up for Avenyo: the businesses the team finds as possible customers for yours. We think it's worth its own section.

• We collect from two places only: Google's public business listings, and the business's own public website.
• We look for a business address published for exactly this purpose. We don't guess addresses, buy lists, or hunt for personal or private ones.
• Nothing is sent automatically. The owner of the Avenyo account reads and approves each email, and it goes from their own mailbox, so they are the sender. For that sending, they decide what happens and we act on their instructions.
• One follow-up at most, four working days later, and it stops the moment the owner records a reply.
• If you got an email you didn't want, replying to the sender and asking them to stop is the fastest fix, and they have to honour it. You can also email us at tim@avenyo.app and we'll delete what we hold about your business and mark it so it isn't found again.

Visitors to sites that use our line

Businesses using Avenyo can put a line of code on their own site that counts who arrives through the links our team wrote for them. If you visit such a site, the business running it decides whether and how it's used, and we process what it sends only on their behalf and on their instructions.

• It reports a visit only when you arrived through one of those links or from an AI assistant: which link or assistant, the page, and the site's address. Nothing else about your visit is sent.
• To count each person once a day we keep only a hash of your IP address, browser type and a secret that changes daily. The IP address itself is not stored.
• The site may keep the link's code in a cookie (av_c) for 30 days, and whether you signed up in another (av_s), so a later signup is credited to that link. Sites that ask for cookie consent set these only once you agree.
• For questions or requests about your data, contact the business whose site you visited; you can also write to us at tim@avenyo.app and we'll pass it on and help them answer.

Google user data

Data we receive through Google sign-in is used only to create and identify your Avenyo account. Data we receive from Google Search Console or Google Analytics, when you connect them, is used only to show you your own numbers inside Avenyo for the business you connected them to. The gmail.send permission, when you connect your Gmail, is used only to send the individual emails you approved, from your own address.

Avenyo's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We don't sell Google user data, transfer it to anyone except the infrastructure providers listed below where it's needed to run the service, use it for advertising, or use it to develop, improve or train generalised AI models. No human reads your Google user data except where you ask us to for support, where it's needed for security, or where the law requires it.

Who we share it with

We don't sell personal data. We share it only with service providers that process it for us:

• Supabase for authentication and database hosting.
• Vercel for hosting the website and running the analysis jobs.
• Anthropic, whose AI models analyse the website content and research we collect and write the report. Anthropic does not use this data to train its models.
• Brave Search to find competitors and public discussions. We send search queries built from the business being analysed, not your account details.
• Google, if you choose to sign in with Google, connect Search Console or Analytics, or connect your Gmail for sending. We also use the Google Places API to find businesses that could buy from you: we send it the kind of business and the town to look in, never your account details.
• PostHog (United States) to count visits to this site and signups, without cookies.
• Stripe to take payments. Stripe receives your email and payment details directly.
• Resend to send the Monday email. It receives your email address and the email's content.
• X, Lemon Squeezy, Paddle, Polar, PostHog and Plausible, but only the ones you choose to connect, and only to read the numbers you connected them for.

Some of these providers are based in the United States. Where data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. We may also disclose data if the law requires it.

How long we keep it

• Your account, projects, reports and campaigns: for as long as you have an account. Ask us to delete your account and we'll do it within 30 days; everything tied to it, including emails you left with us, is removed at the same time.
• Reports run without an account and never saved to one: deleted after 12 months.
• Connected tokens and keys (Google, Gmail, X, and the read-only keys you paste): until you disconnect them, remove the business, or delete your account, whichever comes first.
• Businesses the team found for you, and the emails drafted for them: for as long as the business they belong to is in your account, or until you or they ask us to delete them.
• Visits and signups counted through a tracked link (the link's code, the page, the daily hash): for as long as the business they were counted for is in its owner's account.
• Hashed IP addresses: cleared after 30 days.
• Emails in our contact list (from signing up, asking about a paid plan or asking about a feature): deleted after 24 months, when you delete your account, or sooner if you ask.
• Billing records: kept as long as tax and accounting law requires, which is longer than the rest.

Your rights

You can ask to access, correct, delete or export your personal data, object to or restrict how we process it, and withdraw consent at any time. Email tim@avenyo.app and we'll reply within 30 days. You can also remove Avenyo's access to your Google account at any time from your Google account settings.

If you think we've handled your data wrongly, you can complain to your local data protection authority. In Slovenia, that's the Information Commissioner (Informacijski pooblaščenec).

Security

Data is encrypted in transit, connected tokens and keys are encrypted before they're stored, access to the database is restricted to our servers, and each account can only reach its own projects. No system is perfectly secure, but we'll tell you promptly if a breach affects your data.

Children

Avenyo is a tool for businesses and isn't meant for anyone under 16. We don't knowingly collect their data.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll also tell signed-in users by email or in the app before it takes effect. What you pay for and what we owe you is in our terms of service.