1. Who we are
AvaReply is a service of Automation Studio, a sole proprietorship (eenmanszaak) established in the Netherlands and registered with the Dutch Chamber of Commerce (KvK) under number 42184050.
For anything about privacy, email privacy@avareply.com.
2. Our role for your data
AvaReply lets businesses and individuals (our customers) put an AI assistant on their own website. That gives us two different roles:
- Controller for our customers' account and billing data, for messages sent to us through our own website, and for everything we do to run, secure and bill the service.
- Processor for the content customers add to their assistant and for the data of their website visitors: chats, contact details, booking details and feedback. The customer decides what goes in and is the controller for it; we handle it only to provide the service for them.
If you chatted with an assistant on someone else's website, that business is responsible for your data. Please contact them first. We will help them answer your request.
Where we act as a processor, we do so under our data processing agreement with the customer (article 28 GDPR).
3. What we collect
For proactive messages we count per day how often each message was shown, opened or closed. These counts contain no personal data.
Account data
- Your email address, your name (if you give it), and a password. We store only a salted Argon2 hash of the password, never the password itself.
- Your organization's name, plan, and team members with their roles.
- Session records: when you signed in and the IP address used. We also keep an audit log of important actions (for example sign-up, linking a Google account, deleting a chatbot), which includes the IP address.
Google sign-in
If you choose "Continue with Google", Google shares your name, email address, whether Google has verified that email, your Google account ID and a link to your profile photo. We store your name, email and Google account ID. We don't store your photo. Sign-in gives us no access to your Gmail, contacts or files. Calendar access is separate and optional; see section 6.
Chatbot content: crawled websites and uploaded documents
What customers put into their assistant: text and settings they type in, files they upload, and the public pages of websites they tell us to crawl. Our crawler (AvaReplyBot) reads only publicly reachable pages, respects robots.txt and never logs in. Website pages and documents can contain personal data (for example staff names or contact details on a team page). We process them only as part of that customer's knowledge base.
Website visitor chats
- The messages a visitor sends to an assistant and the assistant's replies.
- A random visitor ID created in the visitor's browser, the web page the chat started on, and, when our network provider supplies it, a two-letter country code. We don't store visitors' IP addresses with conversations.
- An automatically generated summary of longer conversations.
Contact details and requests for a person (leads)
If the customer has set the assistant up for it, a visitor can leave contact details (name, email, phone number and a message) or ask for a person to follow up. We store what the visitor submits, linked to the chatbot and conversation.
Lead and handover notifications by email
Customers can choose to receive these submissions by email. We then send the submitted details to the notification address the customer configured, and we keep a delivery record (recipient, status, time and the provider's status) to retry and show delivery results.
Outbound webhooks
Customers can connect a webhook endpoint of their choice. For each new lead or handover request we send the submitted contact details, the chatbot, the conversation ID and the page address to that endpoint, and keep the event and delivery records (status, attempts, response status) for retries and reporting. The receiving system is chosen and controlled by the customer; it is not one of our sub-processors.
Conversation feedback
Visitors can rate an answer as helpful or not and add an optional comment (up to 1,000 characters). We store the rating and comment with the answer they refer to.
Messages to us through our website
If you use the contact form on our website, we receive your name, email address and message by email so we can reply.
Technical data
To stop abuse we count requests per IP address over short windows (from about a minute up to an hour). Our servers write technical logs (for example the requested path, status code and timing) to find and fix errors.
Payment data
Paid subscriptions are billed through Stripe. Payment details are entered on Stripe's own pages; we never see or store full card numbers. We receive and keep the Stripe customer and subscription identifiers, the plan, the billing period and the subscription status. Stripe processes payment data as described in its own privacy policy.
4. Why, and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Create and run your account, sign you in, provide the assistant | Account data, Google sign-in data, chatbot content | Contract (6(1)(b)) |
| Answer website visitors, collect leads, book appointments, send notifications and webhooks, and record feedback on a customer's behalf | Visitor chats, leads, booking details, feedback, chatbot content | We process this for the customer, under the customer's legal basis and our data processing agreement (art. 28) |
| Service emails: verify your email, reset your password, trial notices | Email address | Contract (6(1)(b)) |
| Reply to messages sent through our contact form | Name, email address, message | Legitimate interest in answering questions (6(1)(f)) |
| Security, abuse prevention, audit trail, backups | IP addresses, session and audit records, logs | Legitimate interest in a safe, reliable service (6(1)(f)) |
| Billing and bookkeeping | Account and payment data | Contract, and legal obligation (6(1)(c)) for tax records |
We don't sell personal data, we don't use it for advertising, and we don't use customer content or visitor chats to train AI models ourselves.
5. AI processing
AvaReply's answers are written by third-party AI models. This means data leaves our servers:
- When a chatbot's knowledge base is built or refreshed, the text of the content is sent to an embedding model, which turns it into searchable vectors.
- When a visitor asks a question, their message, recent messages from the same chat and the most relevant parts of the knowledge base are sent to a language model to write the answer.
- Longer conversations are sent to a language model to create a summary.
We currently use models from OpenAI (gpt-4o-mini for answers, text-embedding-3-small for search), reached directly or through OpenRouter, which forwards each request to the company that runs the model. The models customers can choose from are set by us for all plans. The AI providers process these requests under their own API terms. Answers are generated automatically and can be wrong.
6. Google Calendar bookings
Customers can connect a Google Calendar so their assistant can offer appointment times. When they connect, we ask Google for three permissions only:
- read the list of calendars, so the customer can choose one;
- read free/busy times, never the details of existing events;
- create events on calendars the connected account owns.
We store the connected account's email address and the access tokens; the tokens are stored encrypted. When a visitor books, we store the booking (time, time zone and the details the visitor gives, such as name, email and phone number), create the event in the customer's calendar and send the visitor a confirmation email. Customers can disconnect the calendar at any time.
7. Who else handles data
We use these service providers (sub-processors). Each only gets the data it needs for its task.
| Provider | What for | Where |
|---|---|---|
| Hostinger | The server (VPS) that runs AvaReply and stores its database and files | EU |
| Brevo | Sending emails: verification, password reset, trial notices, lead and handover notifications, booking confirmations and contact-form messages | EU |
| Stripe | Payment processing for paid subscriptions | EU and United States |
| OpenAI | Generating answers, embeddings and summaries (see section 5) | United States |
| OpenRouter | Routing AI requests to the model provider, where used (see section 5) | United States |
| "Continue with Google" sign-in; Google Calendar for customers who connect it; storage of our encrypted backups (Google Drive); web fonts on our public pages (your browser loads them from Google) | EU and United States | |
| Let's Encrypt | TLS certificates for HTTPS (it only sees our domain names, no personal data) | United States |
8. Transfers outside the EEA
Our server is in the EU, but AI processing, payment processing and some Google services also take place in the United States, so personal data is transferred outside the European Economic Area. For these transfers we rely on the safeguards offered by each provider, such as certification under the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
9. How long we keep it
AvaReply does not yet delete data automatically after a fixed period. Unless stated otherwise below, data is kept until it is deleted in the dashboard or the account is closed.
- Account data: as long as your account exists. When you ask us to close your account we delete it, together with your organization's chatbots, conversations and related data.
- Chatbot content and embeddings: until the customer deletes the source, the page or document, or the chatbot. Deleting a chatbot permanently removes its content, embeddings and conversations.
- Visitor conversations, summaries and feedback: until the customer deletes the conversation or the chatbot, or the account is closed.
- Leads and handover requests: until the chatbot is deleted or the account is closed. Deleting a single conversation doesn't remove the contact details from it yet. To have them removed sooner, email us.
- Calendar bookings, notification and webhook delivery records: until the chatbot is deleted or the account is closed.
- Calendar connection: until the customer disconnects it or the account is closed.
- Session records and audit log entries: as long as the account exists. A sign-in session is valid for 14 days; signing out ends it straight away.
- Email verification and password-reset links: they expire after 72 hours and 2 hours.
- Rate-limit counters: from about a minute up to an hour.
- Contact-form messages: in our mailbox for as long as needed to handle your question.
- Backups: encrypted nightly backups of the database and uploaded files are kept for up to about 8 weeks (14 daily and 8 weekly copies). So deleted data can stay in a backup until that backup expires.
- Billing records: 7 years, as Dutch tax law requires.
10. Security
- All traffic to AvaReply is encrypted with HTTPS.
- Passwords are hashed with Argon2. Session tokens are stored only as keyed hashes, so a database copy alone can't be used to sign in.
- Google Calendar tokens and webhook signing secrets are stored encrypted.
- Each organization's data is kept separate, and every request is checked against the organization it belongs to.
- Backups are encrypted before they leave the server.
- Our crawler only reads public pages, always respects robots.txt, and never logs in to websites.
No system is perfectly secure. If a breach affects your personal data, we will tell the customers concerned and, where required, the Dutch Data Protection Authority.
11. Your rights
Under the GDPR you can ask us to:
- access the personal data we hold about you;
- correct data that is wrong;
- delete your data;
- export your data in a machine-readable format;
- restrict or object to processing based on legitimate interest.
Organization owners can export their chatbots and conversations as JSON themselves, from the Account page in the dashboard. They can also delete individual conversations, knowledge sources, pages, documents and whole chatbots there. The export does not yet include leads, bookings or account data; to receive those, or to close your account, email privacy@avareply.com. We may ask you to confirm your identity, and we answer within one month.
Website visitors: please send your request to the business whose website you used. We will help them with it.
12. Cookies and local storage
We use only cookies that are needed for the service to work. There are no analytics, advertising or tracking cookies, so we don't ask for cookie consent.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
cb_session | Cookie (www.avareply.com) | Keeps you signed in to the dashboard | 14 days, or until you sign out |
cb_google_flow | Cookie (www.avareply.com) | Protects "Continue with Google" sign-in against forgery | 10 minutes |
cb_org | Local storage (www.avareply.com) | Remembers which organization you last opened | Until you clear it |
avr_lang | Cookie (www.avareply.com) | Remembers the website language you chose, so the site opens in that language next time | 1 year |
cbw_teaser_…, cbw_pm_…, cbw_pme_… | Session storage (the customer’s website) | Remembers that a greeting or proactive message was shown, opened or closed during this visit, so it is not repeated | Until the browser tab is closed |
cbw_visitor, cbw_conv_… | Local storage (the customer's website) | Lets the chat widget keep a visitor's conversation when they move between pages | Until the visitor clears it |
cbw_lang_…, cbw_human_… | Local storage (the customer's website) | Keeps the chat's language and an open contact option for the current conversation | Until the visitor starts a new conversation or clears it |
Our public pages load fonts from Google Fonts, so your browser connects to Google and shares your IP address with Google when you visit them. Stripe's payment pages are hosted by Stripe, which sets its own cookies there.
13. Contact and complaints
Questions or requests: privacy@avareply.com.
If you're not happy with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the data protection authority in the EU country where you live.
We may update this policy. If a change matters to you, we will tell customers by email before it takes effect.