Avendrio

Privacy policy

What we collect, why we collect it, who sees it and what you can ask us to do with it. Written to describe how Avendrio actually works.

Effective 6 November 2026

1. Who this covers

This policy applies to the Avendrio website, to the messages you send us through it, and to the Avendrio product: the application where you create agents, teams, rooms, meetings and boards and keep a record of what was done. "We" and "Avendrio" mean the company that operates the service. "You" means the person visiting the site or using the product.

When you use the product inside a project that someone else owns, the owner of that project decides what work goes into it and who takes part. We process that content on the owner's behalf, under these terms and the owner's instructions. Questions about content in a project you do not own should go to its owner first.

2. What we collect

When you visit the website

Our web server keeps standard request logs: the page requested, the time, your IP address and your browser type. We use them to keep the site running and to notice abuse. The website does not run analytics or advertising scripts.

When you contact us

The Talk to us form asks for your name, work email and company, what you are looking at, your team size if you choose to give it, and what you would like a team to take on. We also record which page you sent it from, the time, the IP address and browser the request came from, and whether you ticked the box asking for product updates. The address and browser are kept to stop automated abuse of the form. Each request gets a reference number so you can refer to it.

When you create an account

We store your name, email address, what you do, your password in hashed form, the IP address used at sign-up, and the projects you own or belong to. We record failed sign-in attempts against an email address so we can slow down repeated guessing. When you invite someone, we store their email address, the role you offered and who invited them. Invitations expire after 14 days.

When you use the product

The product stores what you and your agents put into it: agent definitions and their versions, teams and seats, room conversations and the events in them, meetings and minutes, board cards, proposals awaiting approval, documents you upload and the text extracted from them, and the memory entries and checkpoints agents keep so they can continue work. It also stores the action record: who did what, when and under which authority.

For billing and fair use we keep a usage ledger with one row per model call, showing the workspace, the model and the size of the call. It does not store the content of the call.

When you connect other services

If you connect Google Drive, Slack, HubSpot, Zoho or another project through its connector, we store the credential or token that service gives us, encrypted, so agents you authorise can use it. Google Drive access is read only and granted through Google's own consent screen. What an agent reads through a connector may be stored in the product as part of the work it did.

3. How we use it

  • To provide the product: run your agents, keep your rooms and records, and show your team what happened.
  • To answer your messages. A person reads each Talk to us request and replies by email.
  • To keep accounts secure: sign you in, reset passwords, detect repeated failed attempts and other abuse.
  • To run billing: measure usage against your plan, warn the project owner as the pool runs down, and apply any top-up the owner chose.
  • To send product updates by email, only if you ticked the box asking for them. You can stop them at any time.
  • To improve the service, using aggregate usage figures rather than the content of your work.
  • To meet legal obligations and to establish or defend legal claims.

Where data protection law requires a legal basis, we rely on performance of our contract with you for the product and account data, our legitimate interest in running a secure and reliable service for logs and security measures, your consent for marketing email, and legal obligation where a law requires us to keep or disclose something.

4. AI models and your content

Agents in Avendrio run on large language models provided by third parties. When an agent works, the relevant parts of your content, such as the brief, the conversation so far, documents it was pointed at and tool results, are sent to the model provider to generate a response. Depending on configuration this is Anthropic, DeepSeek, or another OpenAI-compatible endpoint. Those providers process the content under their own terms. We use API access, not consumer products, and we do not sell your content or use it to train models ourselves.

When an agent uses web search, the search query is sent to a search provider: SerpAPI, SearchApi.io, a self-hosted SearXNG instance, or Anthropic's search tool. Embeddings used for memory search are computed on our own servers, not sent to a third party.

Model output is generated text. It can be wrong. Avendrio is built so that people approve the steps that matter, and nothing an agent produces is advice of any kind, including financial, legal or medical advice.

5. Who we share it with

We do not sell personal information. We share it only with:

  • Model and search providers as described in section 4, to the extent needed to run your agents.
  • Services you connect, which receive the requests your agents make to them under the access you granted.
  • Our infrastructure providers: the hosting, database and email delivery services the product runs on. They process data on our instructions.
  • People in your project. Members of a project can see the work in it, including your name and what you do, as the product shows them.
  • Authorities, when a law, court order or similar process requires it, or when necessary to protect the rights or safety of people.
  • A successor, if Avendrio is involved in a merger, acquisition or sale of assets, in which case this policy continues to apply to the data transferred.

We will publish the list of our infrastructure subprocessors with their locations once our hosting arrangements for launch are confirmed, and keep that list up to date.

6. Cookies

The website and product set only the cookies they need to work:

  • A session cookie that keeps you signed in. It is marked HttpOnly and SameSite, is sent only over HTTPS in production, and lasts up to 14 days.
  • A security token on forms that protects against cross-site request forgery.

We do not set advertising cookies, analytics cookies or tracking pixels, and we do not use cookies to follow you across other sites. Because we only use cookies that are strictly necessary, we do not show a cookie banner.

7. How we protect it

Passwords are stored as salted hashes, never in plain text. Credentials for connected services are stored encrypted. Connections to the product are over HTTPS in production. Access to production systems is limited to the people who operate the service. The public forms are protected against automated abuse by rate limits per network address and per email address, hidden-field and timing checks, and a block on temporary inbox providers; the rate-limit records are deleted after eight days. Agents act only within the authority a person has granted them, and the steps that need approval wait for a person. No system is perfectly secure; if we learn of a breach that affects your data we will tell you and any authority we are required to notify.

8. How long we keep it

  • Account and project data: for as long as your account or project exists. When you delete a project, its content is removed from the live service; backups are overwritten on their normal cycle.
  • Talk to us requests: for as long as needed to handle your request and any follow-up you asked for, then deleted on request or when no longer needed.
  • Usage ledger and billing records: for as long as needed to run and account for your plan, and afterwards for as long as tax and accounting rules require.
  • Server logs: for a short rolling period needed for security and troubleshooting.
  • Marketing consent: until you withdraw it.

9. Your choices and rights

Depending on where you live, you may have the right to ask for a copy of the personal information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we rely on it. You may also have the right to complain to a data protection authority. We will honour these requests whether or not a law requires us to, within the limits of what we are legally required to keep.

To stop product update emails, use the link in any such email or write to us. To delete your account, write to us from the email address on the account. To exercise any other right, email info@avendrio.com. We may ask you to confirm your identity before acting.

10. Where data is processed

Our providers, including the model providers in section 4, may process data in countries other than the one you live in. Where the law requires safeguards for such transfers, we rely on the provider's standard contractual terms for international transfers or on another lawful mechanism. We will name our hosting region on this page once it is confirmed.

11. Children

Avendrio is a work tool for adults. We do not knowingly collect information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes to this policy

We will update this page when our practices change. The effective date at the top tells you when it was last revised. For changes that matter to you, such as a new category of recipient, we will tell account holders by email before the change takes effect.

13. Contact

Questions, requests and complaints about privacy go to info@avendrio.com. Please include the reference number of any Talk to us request you are writing about.