Working draft generated on 09/28/2026 — have it reviewed by a legal professional before going to production. Fill in the fields [COMPANY], [ADDRESS], [REGISTRATION NUMBER], [EMAIL].
Privacy policy
Last updated: September 28, 2026 · GDPR compliant (EU 2016/679)
1. Data controller
[COMPANY], a [LEGAL FORM] with a share capital of [CAPITAL], registered in [CITY] under number [REGISTRATION NUMBER], with its registered office at [ADDRESS]. Contact: privacy@avisly.app.
2. Data we collect
- Account data: name, email address, business name, password (hashed — never stored in plain text).
- Google connection data: encrypted access tokens (AES-256) giving access to your Google Business Profile. We never see or store your Google password.
- Usage data: imported reviews, generated replies, tone settings and preferences.
- Billing data: fully handled by Stripe — we never store any card number.
3. Purposes and legal bases
- Performance of the contract: providing the review management service (GDPR art. 6.1.b).
- Legitimate interest: audience measurement (only with your consent, through the cookie banner).
- Legal obligations: keeping invoices (10 years).
4. Processors
Data is hosted and processed by: Vercel (hosting, USA — standard contractual clauses), Supabase (database, EU), OpenAI (reply generation, USA — review texts are sent for generation, never include health data; DPA signed), Stripe (payments), Resend (emails). An up-to-date list is available on request.
5. Retention period
- Account data: subscription period + 30 days after cancellation (then deleted).
- Invoices: 10 years (legal obligation).
- Cookie consents: 6 months.
6. Your rights
Under the GDPR, you have the rights of access, rectification, erasure, portability, restriction and objection. Write to privacy@avisly.app — answer within 30 days. You may lodge a complaint with the CNIL (cnil.fr).
8. Security
Encryption in transit (TLS 1.3) and at rest, AES-256-GCM encryption of Google tokens, strict data isolation per customer, rotation of access tokens.
9. Changes to this policy
Any change will be notified by email at least 15 days before it takes effect.