TEMPLATE — NOT YET REVIEWED BY A LAWYER. This draft must be reviewed by a licensed attorney and the bracketed placeholders filled in before Averon accepts paying customers.
Last updated: [DATE]
This policy explains what information [LEGAL ENTITY NAME] ("Averon", "we") collects when businesses use the Averon service, how we use it, and the choices you have.
Account data (your name, email, business name, plan): we are responsible for it. Customer Data you enter about your own leads and customers (names, emails, phone numbers, notes): we process it only on your behalf and on your instructions, as a "service provider"/"processor". You are responsible for having a lawful basis and giving any notices required to your own customers.
Text you type into AI features is sent to our AI model provider ([PROVIDER NAME, e.g. Cloudflare Workers AI / OpenAI]) to generate a response. AI assistant conversations are saved to your account so you can continue them; you can delete any conversation at any time, and they are deleted with your workspace. Writer drafts are not stored. Onboarding answers are stored with your company profile and sent to the AI provider only to generate a workspace proposal. AI pipeline insights send only aggregate numbers (counts and dollar totals), not names or contact details. Do not enter passwords, payment card numbers, government IDs or health information into AI features. [CONFIRM PROVIDER DATA-RETENTION AND NO-TRAINING TERMS BEFORE LAUNCH.]
If you connect third-party tools (for example Slack, HubSpot or Stripe), we store the access token or key you provide, encrypted at rest (AES-GCM), and use it only to perform the actions and reads you configure. Disconnecting deletes the stored credential; you should also revoke it in the provider.
If you connect third-party tools (for example Slack, HubSpot or Stripe), we store the access token or key you provide, encrypted at rest (AES-GCM), and use it only to perform the actions and reads you configure. Disconnecting deletes the stored credential; you should also revoke it in the provider.
If you connect third-party tools (for example Slack, HubSpot or Stripe), we store the access token or key you provide, encrypted at rest (AES-GCM), and use it only to perform the actions and reads you configure. Disconnecting deletes the stored credential; you should also revoke it in the provider.
If you connect third-party tools (for example Slack, HubSpot or Stripe), we store the access token or key you provide, encrypted at rest (AES-GCM), and use it only to perform the actions and reads you configure. Disconnecting deletes the stored credential; you should also revoke it in the provider.
If you connect third-party tools (for example Slack, HubSpot or Stripe), we store the access token or key you provide, encrypted at rest (AES-GCM), and use it only to perform the actions and reads you configure. Disconnecting deletes the stored credential; you should also revoke it in the provider.
If you connect third-party tools (for example Slack, HubSpot or Stripe), we store the access token or key you provide, encrypted at rest (AES-GCM), and use it only to perform the actions and reads you configure. Disconnecting deletes the stored credential; you should also revoke it in the provider.
If you connect third-party tools (for example Slack, HubSpot or Stripe), we store the access token or key you provide, encrypted at rest (AES-GCM), and use it only to perform the actions and reads you configure. Disconnecting deletes the stored credential; you should also revoke it in the provider.
If you connect third-party tools (for example Slack, HubSpot or Stripe), we store the access token or key you provide, encrypted at rest (AES-GCM), and use it only to perform the actions and reads you configure. Disconnecting deletes the stored credential; you should also revoke it in the provider.
If you connect third-party tools (for example Slack, HubSpot or Stripe), we store the access token or key you provide, encrypted at rest (AES-GCM), and use it only to perform the actions and reads you configure. Disconnecting deletes the stored credential; you should also revoke it in the provider.
If you connect third-party tools (for example Slack, HubSpot or Stripe), we store the access token or key you provide, encrypted at rest (AES-GCM), and use it only to perform the actions and reads you configure. Disconnecting deletes the stored credential; you should also revoke it in the provider.
To provide, secure and support the Service; to enforce plan limits; to prevent fraud and abuse; to communicate about your account; and to comply with law. We do not sell personal information and do not use Customer Data to advertise to your customers.
Only with sub-processors that help run the Service (hosting and database: Cloudflare; payments: Stripe; AI: [PROVIDER]), when required by law, or as part of a business transfer with equivalent protections.
Encrypted HTTPS connections, salted and hashed passwords (PBKDF2-SHA256), HttpOnly secure session cookies, strict separation of each business's data, role-based permissions, rate limiting, security headers and an audit log of sensitive actions. No system is perfectly secure; we will notify affected customers of a breach as required by law.
We keep data while your account is active. Account owners can permanently delete their workspace in Settings; this removes users, leads, usage and audit records immediately from the live database. Backups held by our hosting provider expire on their normal schedule. Rate-limit counters are temporary.
Depending on where you live (for example California or the EU/UK), you may have rights to access, correct, delete or port your personal information. Contact [PRIVACY EMAIL]. If you are a customer of one of our business users, please contact that business first.
The Service is for businesses and is not directed to anyone under 18.
We will post updates here and notify account owners of material changes. Contact: [LEGAL ENTITY NAME] · [MAILING ADDRESS] · [PRIVACY EMAIL]