Privacy Policy

1. Who we are

Avocado AI is operated by Narius OÜ, a private limited company registered in Estonia.

• Company: Narius OÜ
• Registered address: Liivalaia tänav 28-1, Kesklinna linnaosa, 10118 Tallinn, Harju maakond, Eesti
• Registry code: 16779497 (registered in Estonia on July 18, 2023)
• Email: privacy@avocadoai.co

If you are in the EU/EEA or the UK, Narius OÜ is your data controller.

2. Data we collect

2.1 Information you provide

• Account data: name, email, password (handled by our authentication provider), profile image, organization name, role.
• Billing data: billing name, address, country, VAT/Tax ID, payment method details. Payment card numbers are collected and stored by Stripe, not by us.
• Content you upload: images, video, audio, brand assets, reference materials, URLs you submit for brand extraction, text prompts, project metadata. Where this content depicts a real person's face or voice (for example, AI Avatar or AI UGC features), it may include biometric identifiers as defined under GDPR Article 9. We process this data only with your explicit consent, solely to provide the specific feature you activated, and it is never used to train AI models. See Section 4 for details on AI processing.
• Storyboards, Flows, and collaboration data: canvas and flow state, comments, cursor positions, presence indicators when collaborating in real time.
• Business and onboarding profile: company name, website, team size, goals, social profile links, brand details, products, and other information you give us during onboarding or later in your settings.
• Super Agent conversations and memory: messages you send to Super Agent (in the app, in Claude or other MCP clients, in Telegram, or in Slack), files you attach, and the facts, preferences, products, and brand details Super Agent saves to its memory so it can work for you across sessions. You can view and delete saved memories.
• Likeness consent records: when you use a feature that generates content from a real person's face or voice, we record that you confirmed you have the right to use that likeness, together with the date and where the confirmation was given.
• Communications: messages sent to support, survey responses, replies to our emails.

2.2 Information generated through your use

• Generated content: images, videos, music, voice clips, agent outputs, and intermediate artifacts produced when you use the Service.
• Usage data: features used, generations performed, credits consumed, error logs, session timestamps, device and browser information, IP address, referrer.
• Cookies and similar technologies: session cookies for authentication, analytics cookies (where consent is given), and security cookies. See Section 9.

2.3 Information from third parties

• Authentication providers: if you sign up via Google or another SSO, we receive basic profile information from that provider.
• Telegram: if you use the Telegram Mini App, we receive your Telegram user ID and basic profile information from Telegram.
• Payment providers: Stripe sends us non-sensitive metadata about your transactions (status, amount, last 4 digits of card, country) so we can fulfill your subscription. If you pay with cryptocurrency, we receive the transaction ID, amount, network, and sending wallet address. Blockchain transactions are public and permanent by design; we cannot change or delete them.
• Social accounts you connect: if you connect Instagram, Facebook, TikTok, LinkedIn, X, Threads, or another platform so Super Agent can publish for you, we receive (through our publishing partner Zernio) the account name, account ID, profile picture, the posts we publish, and post and comment statistics.
• Meta ad accounts: if you connect a Meta ad account, we receive ad account names and IDs, campaign, ad set, and ad settings, budgets, and performance data (such as spend, reach, clicks, and conversions). We do not receive your Meta payment details.
• Apps you connect to Super Agent: if you connect apps such as Gmail, Google Drive, Google Sheets, Google Calendar, Notion, Airtable, Dropbox, Pinterest, Shopify, ClickUp, Asana, or Linear (through our integration partner Composio), Super Agent can read and act on data in those apps only when a task you give it needs that data. We do not copy your mailbox, files, or store records into our own database beyond what a task needs, and we do not use data from connected apps for advertising or to train AI models.
• AI assistants you use Avocado from: if you use Avocado AI inside ChatGPT, Claude, or another MCP client, that assistant sends us the requests it makes on your behalf: the tool it calls, the prompt and settings it passes, any image or file you choose to share with Avocado, and basic request information the assistant attaches (such as language or approximate region). We link these requests to your Avocado account through the sign-in you approve. We do not receive your other conversations with that assistant.
• Slack and Telegram: if you add Super Agent to Slack or Telegram, we receive your workspace or user IDs, the messages and files you send to Super Agent, and the thread context needed to reply.
• Partners: if you arrive through a partner integration (for example GIMI) or a referral link, we receive the identifiers needed to link your account, apply partner billing, and credit the referral.

2.4 Information about people who are not our users

Some features process data about other people. When you set up a comment-to-DM automation, the platform sends us (through Zernio) the username and comment text of people who comment on your post, so the automation can reply or send the direct message you wrote. We keep aggregate statistics, not a list of commenters. Content you upload or connect may also include other people's personal data. You are responsible for having a lawful basis to use that data and for following the rules of each platform you connect.

3. How we use your data

We process personal data for the following purposes:

You can withdraw consent at any time where consent is the legal basis.

4. AI processing: how prompts and content are handled

This is the part most AI policies get wrong, so we want to be specific.

• We do not train AI models on your prompts, uploads, or generated content. Avocado AI does not own or train foundation models. We route requests to third-party AI providers (see Section 6) who run inference on our behalf.
• Each provider has its own data policy. When you generate content, your prompt and any uploaded reference material are sent to the provider whose model you selected. Providers we use include OpenAI, Anthropic, Google, fal.ai, BytePlus (ByteDance), Higgsfield, Blazerail, Alibaba Cloud, Fish Audio, and ElevenLabs; review the selected provider's current policy if its data handling matters to you.
• Super Agent: Super Agent uses large language models (routed through OpenRouter and Vercel AI Gateway, among others) to understand your requests, plan work, and call tools. A small classification model (TypeSafe) reads your latest message to decide which tools the agent needs. Super Agent may review generated images with a vision model to check quality before showing them to you. Super Agent only publishes posts, launches or changes ads, or sends messages in connected apps when you ask it to or approve the action.
• Brand DNA extraction: when you submit a URL for brand extraction, we crawl that public page and pass content through vision and synthesis models to extract brand attributes. We store the extracted brand profile against your account; we do not retain the source HTML beyond the extraction step.
• Generated content ownership: subject to our Terms of Service, you own the content you generate, within the limits set by the underlying model providers' terms.
• Biometric data for likeness-based features: some features (such as AI Avatar or AI UGC) generate video or audio from a photo, video, or voice recording of a real person. Processing this data involves treating facial or vocal characteristics as biometric identifiers. Your consent to this processing is given by choosing to use the feature and uploading the material, on the basis of the representations in our Terms of Service (Section 4.5) that you have the right to use that person's likeness or voice. We use this data only for the purpose of that generation and do not use it to train any AI model. If a feature requires the depicted person to complete a live identity or face-verification step, that verification is performed directly between the depicted person and our verification provider; we receive only a pass/fail result and a reference identifier, not the raw verification data.

5. How we share your data

We share personal data only as described below. We do not sell personal data.

• Sub-processors and service providers: see Section 6.
• Within your organization: if you are part of a team workspace, your name, email, and project activity are visible to other members.
• Public sharing you initiate: if you publish a storyboard, share a generation or a Super Agent chat, or post to a public gallery, that content becomes accessible to anyone with the link.
• Platforms you publish to: when you or Super Agent (on your instruction) publish a post, send a direct message, or launch an ad, that content is sent to the platform you chose (for example Instagram, TikTok, LinkedIn, or Meta Ads) and handled under that platform's own privacy policy.
• AI assistants you use Avocado from: when you use Avocado AI inside ChatGPT, Claude, or another MCP client, we return the results of each request (for example generated images or videos, links to them, credit balances, and brand details you asked for) to that assistant. The assistant's provider (for example OpenAI or Anthropic) handles that data under its own privacy policy. You can disconnect Avocado AI from the assistant at any time.
• Partners: if your account is linked to a partner (for example GIMI) or a referral program, we share the usage and billing records needed to settle charges or pay referral rewards. We do not share your prompts or generated content with partners unless you ask us to.
• Legal disclosures: we may disclose data if required by law, court order, or to protect our rights, users, or the public from harm or fraud.
• Business transfers: if Narius OÜ is involved in a merger, acquisition, or asset sale, your data may transfer to the successor entity, subject to this Policy.

6. Sub-processors

We use the following sub-processors to deliver the Service. This list is current as of the date above and may change. Material changes will be reflected here.

7. International data transfers

We are based in Estonia and many of our sub-processors are located outside the European Economic Area, primarily in the United States. When we transfer personal data outside the EEA or UK, we rely on appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy decisions, where available;
• Supplementary technical and organizational measures.

You can request a copy of the safeguards in place by emailing privacy@avocadoai.co.

8. Data retention

You can delete your account from your account settings, or by emailing privacy@avocadoai.co.

9. Cookies and tracking

We use the following categories of cookies and similar technologies:

• Strictly necessary: authentication, session management, security. These cannot be disabled.
• Analytics: PostHog, Google Analytics, DataFast, and Dub, used to understand how the Service is used and where visitors come from. Where required by law (EU/EEA, UK, and Switzerland), these stay off until you accept in our cookie banner. Vercel Web Analytics sets no cookies.
• Marketing: we currently do not run third-party advertising trackers on the Service. If this changes, we will update this Policy and seek consent where required.

You can change your choice at any time with the Cookie settings link in the footer, or through your browser settings. See our Cookie Policy for details.

10. Your rights

Depending on where you live, you have the following rights:

10.1 If you are in the EU/EEA or UK (GDPR)

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing based on legitimate interests
• Withdraw consent at any time
• Lodge a complaint with your local supervisory authority. In Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee.

10.2 If you are in California (CCPA/CPRA)

• Know what personal information we collect, use, and share
• Delete your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (we do not sell personal information)
• Limit the use of sensitive personal information
• Non-discrimination for exercising your rights

10.3 How to exercise your rights

Email privacy@avocadoai.co. We respond within 30 days. We may need to verify your identity before fulfilling certain requests.

11. Security

We use industry-standard technical and organizational measures to protect personal data, including encryption in transit (TLS), encryption at rest for stored content, access controls, audit logging, and regular review of our sub-processors.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

12. Children

The Service is not directed to children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, contact privacy@avocadoai.co and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top reflects the most recent version. For material changes, we will notify you by email or through the Service before the changes take effect.

14. Contact