1. About this policy
This policy describes AVENYQ's website and personal AI assistant, including the invite-only beta. Features and data handling differ between local development and signed-in cloud use. The operating legal entity and final operational policies are awaiting confirmation; this is a review draft, not a certification of compliance.
2. Information you provide
We process information you choose to submit to operate the assistant and respond to your requests.
- Account information: your email address, authentication identifier and information supplied through the sign-in provider. Invitation records identify accounts allowed into the beta.
- Prompts, conversations, responses, feedback and information sent in support enquiries.
- Uploaded documents, files, images, file names, extracted text, page images and links you ask the assistant to analyse.
- Voice input and transcripts when you use voice features.
- Saved memories, projects, study cards, generated work, preferences and settings.
- Information about other people that you include. Share it only when you have a lawful basis and permission where required; avoid unnecessary sensitive data.
3. Usage and device information
The service records account-linked usage counters and workspace update information for quotas and synchronisation. Application rate limits use the verified account identity. Application error logs record fixed event names, error categories and HTTP error status codes; they omit raw error messages, stack traces, credentials and submitted content. Hosting, authentication and model services may receive network and device information such as IP addresses, browser headers and request times.
No analytics, advertising pixel or session-replay integration was found in the current application. Hosting and provider-side logging, settings and retention still need separate operational verification.
4. How information is used
Information is used to authenticate accounts, manage invitations, deliver AI and voice responses, process attachments, retain workspace history, personalise responses with enabled memories, run requested tools, synchronise data, enforce limits, troubleshoot errors and respond to support or privacy requests.
Handling legal obligations or preventing misuse may also require processing information. Any additional purpose, including future improvement programmes, needs an appropriate notice and any consent or other legal basis required by applicable law. This draft does not treat use of the service as blanket consent to unrelated purposes.
5. AI processing and external services
Your message and relevant conversation context are sent through AVENYQ to the configured AI provider to generate a response. Context can include saved memories, instructions, tool results and attached material. Messages and responses become part of your workspace history.
Documents can be converted into extracted text and page images; images can be sent to a vision-capable model. Extracted content, image data and attachment metadata may be saved with your workspace. A link you submit can be fetched from its source. Do not upload material you are not authorised to share.
The application supports OpenAI and Groq, and can be configured for an OpenAI-compatible endpoint. The provider used depends on the deployment and feature. Cloud accounts and workspace storage integrate with Supabase. These are supported integrations, not a verified list of every service currently used by the live deployment.
Web research may send a query to OpenAI's web-search service and fetch public source pages. Image search can use Wikimedia Commons, and weather requests use Open-Meteo. External websites receive the requests needed to fetch their content; displayed third-party media can also make browser requests. Only use these features with information you are comfortable sending to the relevant services.
Service providers supporting authentication, hosting, storage and AI processing receive information needed for their functions. Their own terms and privacy practices also matter. The live provider list, processing agreements, locations and any other subprocessors must be verified before this policy is finalised.
6. Voice and audio
Voice input uses microphone permission. Depending on the selected mode and browser support, speech may be processed by the browser's speech-recognition service or sent to AVENYQ's transcription provider. Transcripts can become conversation messages. Response text may be sent to a speech provider or read by browser speech synthesis. AVENYQ's current workspace schema does not save raw microphone recordings; this is not a promise about provider or infrastructure retention.
You can stop voice input and revoke microphone permission in your browser. Turning off spoken responses does not by itself delete existing transcripts.
7. Training and improvement
The current application calls models to generate responses; it does not contain an AVENYQ model-training pipeline. That does not establish a no-training policy for AVENYQ or its providers. Provider retention, training settings, contractual terms and any future improvement use require confirmation. Do not assume that a provider has zero retention or that all submitted content is excluded from improvement use.
8. Storage and retention
In local development mode, workspace records use this browser's local storage and attachment data uses IndexedDB. Local mode does not mean offline processing: AI and other enabled features still make external requests. Signed-in cloud mode stores workspace records and attachment payloads through Supabase. An explicit local import copies browser data to the account and leaves the local originals on the device.
No automatic time-based workspace or usage-record expiry was identified in the application. Data can remain until removed through available controls or an operational deletion process. A retention schedule for accounts, invitations, usage, support, logs, backups and provider records has not yet been confirmed. The final policy must define retention based on service needs and applicable obligations, rather than promising an unsupported period.
9. Deletion and account closure
Individual conversations can be removed from history, and Settings includes a conversation-history deletion control. Related attachments are queued for removal when no longer referenced. Saved memories, projects and study cards are separate records. Cloud deletion requires a successful save; browser copies, backups and third-party records are not automatically erased by this action. Full account deletion is not self-service yet.
A workspace backup is available in Settings. It is not a complete export of authentication, invitation, usage, support, log or provider records. Contact the privacy address for access, correction, deletion or account-closure requests. Identity verification may be needed. Do not send passwords, access tokens or full sensitive documents by email.
Legal requirements, security investigations and backup processes may affect what can be removed and when; no guaranteed deletion deadline is stated in this draft. Signing out does not delete a cloud account or a separate local copy.
10. Security
The application includes authenticated account checks, invitation restrictions, server-side request validation and database access policies. Production session cookies are configured with Secure, HttpOnly and SameSite attributes. These controls depend on correct deployment and do not guarantee security.
AVENYQ does not claim end-to-end encryption: servers and model providers must process submitted content to provide the service. Encryption-at-rest specifications, security certifications and independent audit status are not asserted.
11. International processing
Your information may be processed outside your country by configured providers. Specific processing locations and transfer arrangements have not been verified. Where Singapore's PDPA applies, overseas transfers must meet its applicable protection requirements. The operator must confirm appropriate arrangements with providers before this policy is finalised; this notice is not evidence those arrangements are in place.
12. Your privacy choices and rights
Depending on applicable law, you may have rights to access or correct personal data, withdraw consent, or request deletion and other controls. Under Singapore's PDPA, access and correction and withdrawal of consent are subject to applicable conditions and exceptions. Withdrawal can affect features that need that processing. This policy does not promise a universal right to erasure or portability.
Use the privacy contact to make a request or raise a concern. If a concern is not resolved, you may contact the relevant data-protection authority, including Singapore's Personal Data Protection Commission where applicable. The operator's accountable privacy contact and request-handling process require confirmation.
13. Children and minors
The proposed private-beta minimum age is 18. This eligibility policy requires founder and legal approval before adoption. AVENYQ is not being presented as a service for children. If you believe a child has submitted personal information, contact the privacy address so the situation can be reviewed. No additional age-verification system is implied by this statement.
14. Changes and contact
The review date above identifies this version. Material changes to data practices should be explained before they take effect, with any consent required by law. Questions about this draft or your information can be sent to the privacy contact. Contact addresses must be confirmed as monitored before launch.