Private Alpha Privacy

Avylo Private Beta Privacy Notice (version private-alpha-v1) 1. Controller. Mohamed Habib Allah Bibani (individual, Tunisia) operates Avylo during the private beta. Contact for privacy requests: contact@avyloai.com. 2. Data we process. (a) Account data from GitHub sign-in: GitHub ID, name, email address and avatar. (b) Your Content: projects, descriptions, architecture decisions, uploaded source documents and review comments. (c) Usage and security data: request logs, AI usage records, credits and limits, error and performance metrics, and email delivery events. 3. Why. To provide, secure and improve the service, to apply limits and credits, to send service emails (verification, invitations, security and operational notices), and to comply with law. 4. AI processing. To generate results we send relevant parts of Your Content to Google Gemini through its API. We have turned off provider-side storage of API requests and responses, and we confirm that data sent through our API configuration is not used to train Google's models. We do not send your data to other AI providers. 5. Where data is stored and who processes it. Application data is stored on our servers at FelCloud (Tunisia). Source documents are encrypted by Avylo before being placed in FelCloud object storage. Database backups are encrypted and stored in FelCloud object storage. Email is sent through Resend. GitHub authenticates you. These providers act as our processors. 6. Retention. Projects and account data are kept until you ask us to delete them. Deleted source documents are purged after a retention window of up to 30 days. Raw AI usage records are kept for 90 days and aggregated usage statistics for 13 months. Encrypted backups are kept for 30 days, so deleted data can remain in backups for up to that period. 7. Security. Access is limited, traffic is encrypted, secrets and backups are encrypted, and each project is isolated to its owner. No system is perfectly secure; tell us promptly if you suspect a problem. 8. Your rights. You may ask to access, correct, export or delete your data, or object to processing, by emailing the contact above. We will respond within a reasonable time. 9. Cookies. We use only the cookies needed to keep you signed in and secure the session. 10. Changes. We will publish a new version here and ask you to accept it when changes are material.