Privacy Policy
Last updated: 22 September 2026 · Applies to avorezaai.com and the AvorezaAI services
Short version: we collect as little as possible, we only contact businesses (never private individuals for consumer marketing), every message we send has a working opt-out, we never sell personal data, and we never touch your card details.
1Who is responsible for your data
The data controller is AvorezaAI, based in Stockholm, Sweden. Questions, requests and complaints: [email protected].
2What we collect, why, and on what legal basis
a) If you visit our website
Our server logs standard technical data: IP address, browser and device type, the page requested and the time. We use it to keep the site up and stop abuse. Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).
We set no tracking or advertising cookies, and we run no analytics on this site. The embedded payment window is provided by Whop and may set its own cookies once you open it — see Whop’s privacy policy.
b) If you become a customer
We process what we need to deliver the service: name, business name, email, phone number, the tools and accounts we need access to (for example calendar, phone, CRM and mail), plus billing and transaction records. Legal basis: performing our agreement with you (Article 6(1)(b)), and our legal duty to keep accounting records (Article 6(1)(c)).
Card details are handled by Whop. They never reach us and we do not store them.
c) If we reach out to your business
We contact businesses only, using business contact details (business name, business email, business phone, address and category) that are publicly available — typically from your own website or a public business directory. We may automatically read a business’s own public website to understand what they do, so the message we send is relevant instead of generic.
Legal basis: our legitimate interest in marketing our services to businesses (Article 6(1)(f) GDPR), balanced against your interests — which is why every message identifies us, is relevant, and carries a one-click opt-out. We do not buy personal data, we do not contact private individuals for consumer marketing, and we do not sell or rent contact data to anyone.
d) If you call a business that uses our AI receptionist
When one of our customers uses our AI receptionist, we process the incoming phone number, call details and — where the customer has enabled it — a recording or transcript, so the call can be answered and the customer notified. In that case our customer is the controller and we act as their processor on their instructions. Questions about such a call should go to that business; we help them answer within the law.
3Opting out — and never hearing from us again
Reply “stop”, “unsubscribe” or “remove” to any message from us, or email [email protected] with the address you want removed.
Your address goes onto a permanent do-not-contact list and we will not contact you again from any of our addresses or domains. The suppression record is kept so it can actually be honoured — that is the one piece of outreach data we keep without a time limit.
Every marketing message we send includes this option. We honour it immediately on receipt, not on a schedule.
4Who we share data with
We share personal data only with service providers that help us run things, and only as much as each one needs. We never sell personal data, and we never share it for advertising.
| Provider | What for |
|---|---|
| Whop | Payments, subscriptions, receipts and store access |
| Supabase | Database and application hosting (customer, prospect and message data) |
| Cloudflare | DNS, website hosting and email routing for our domain |
| Amazon Web Services (SES) | Sending email on our behalf |
| Resend | Sending transactional email (notifications, confirmations) |
| Mailboxes we send and receive from, and calendar access where you give it | |
| AI providers (Google Gemini, OpenAI) | Drafting and analysing message text, and answering calls for the AI receptionist |
| Telephony providers (Vapi, Twilio, Zadarma) | Voice calls, numbers and call routing where a service uses them |
We may also disclose data if a law, a court or an authority requires it — and if that happens we tell you, unless we are legally barred from doing so.
5Where your data is processed
We are based in the EU and prefer EU storage where we can. Some providers we rely on are US-based, so data can be transferred outside the EEA. When that happens we rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, plus the provider’s own safeguards.
6How long we keep it
- Website logs: 90 days, then deleted.
- Prospect and outreach data: while it is relevant, and then deleted; the do-not-contact record is kept indefinitely so we can honour it.
- Customer data: while our agreement is active, plus 30 days after it ends so you can export it — then deleted. Accounting material is kept as long as Swedish bookkeeping law requires (currently 7 years).
- Call recordings and transcripts (AI receptionist): 90 days by default, or the retention our customer has configured with us.
7Your rights
Under the GDPR you have the right to:
- know whether we process data about you, and get a copy of it (access);
- have wrong or incomplete data corrected (rectification);
- have data deleted, where we are not required to keep it (erasure);
- ask us to limit what we do with it (restriction);
- object to marketing at any time — that one needs no justification (objection);
- receive your data in a portable format (portability);
- complain to a supervisory authority — in Sweden, IMY, the Swedish Authority for Privacy Protection (imy.se) — or to the authority where you live.
Email [email protected] and we answer within 30 days. If you object to marketing, we act immediately.
8Security
Data is encrypted in transit, access is limited to what each part of the system needs, credentials are stored server-side and are never exposed to browsers, and no card data ever enters our systems. If a breach ever affects you, we notify you and the relevant authority as required by law.
9Children
Our services are for businesses. We do not knowingly collect data from children, and our site and marketing are not directed at anyone under 16.
10Compliance with marketing law
We market to businesses, and we build our outreach to meet the rules that apply to it — including the GDPR, Sweden’s Marketing Act with its requirement that every marketing message carries an opt-out, and the US CAN-SPAM Act, where every message identifies the sender, uses honest subject lines, gives a physical business address and provides an opt-out we honour. We keep records showing when and to whom we sent a message, so any opt-out can be verified.
If you believe we have contacted you wrongly, tell us — [email protected] — and we deal with it immediately.
11Changes to this policy
If we change how we handle personal data we update this page and change the date at the top. Material changes are announced on the site or by email before they take effect.
No tracking cookies. No data selling. Business contacts only, from public sources. One reply of “stop” ends all contact permanently. Card details stay with Whop. You can ask to see, fix or delete your data at any time.