Privacy Policy

Avenos is an AI receptionist that helps service businesses (salons, clinics, fitness, consulting and others) communicate with their clients and book appointments. This Policy describes what data we process and for what purposes.

1. Data controller

The data controller is PROZONE AI DOO (below, "Prozone AI"), Novo Selo 3, 75, 21208 Sremska Kamenica, Srbija (tax number 115321246, company number 22141694). Send any privacy question or request to exercise your rights to support@avenos.ai.

A note on roles: for end clients' data (the people who message the business), the controller is the business itself (the salon or clinic) using Avenos, and Prozone AI acts as a processor, processing that data on the business's instructions. For business owners' data (account, subscription) the controller is Prozone AI.

2. What data is processed

• Business owners - name, email, basic business details and access tokens for connected integrations (Instagram, WhatsApp, Google Calendar), stored encrypted.
• End clients - the content of messages sent over Instagram DM or WhatsApp, the name shown on the profile, a phone number (if the client shares one voluntarily), a date of birth (if entered for a birthday message) and the history of booked appointments.

Special categories of personal data (Serbian Data Protection Act art. 17, GDPR art. 9) are data concerning health, genetic and biometric data, data on racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and data on sex life or sexual orientation. Avenos neither asks for nor systematically processes them. A client may voluntarily mention a health detail in a message (an allergy or a contraindication before a treatment, say) - such a detail stays part of the conversation and is processed solely in order to reply and to book, on the instructions of the business as controller, which is responsible for the legal basis of that processing; the AI is configured to hand medical questions to staff. Separately, we do not ask for national identification numbers, payment card numbers, CVV codes or passwords - if a client sends one, it is stripped from the message automatically before AI processing.

3. How the data is used

• generating AI replies to end clients' questions about booking, services and prices
• creating and syncing appointments with the business owner's Google Calendar
• sending reminders and follow-up messages

Legal basis for processing: performance of a contract (providing the Service), legitimate interest (communication and reminders), and consent where applicable (birthday messages, for example).

4. Data sharing and sub-processors

We share data only with trusted processors whose use is necessary for the Service to work. We do not sell or rent data to third parties. Current processors:

• OpenAI (USA) - processing message content to generate AI replies. The content is not used to train their models, under their terms for business APIs.
• Meta Platforms (USA/Ireland) - the Instagram and WhatsApp channels messages arrive and are sent through, and, on the marketing site, the Meta pixel for measuring ad performance (see point 9).
• Google (USA/EU) - syncing appointments with Google Calendar (see point 5), and, on the marketing site, Google Tag Manager together with the visit- and ad-measurement tools switched on through it (see point 9).
• Clerk (USA) - sign-in and user account management for business owners: email address, password and two-factor protection. No messages and no client data pass through Clerk.
• Paddle.com Market Ltd (United Kingdom/EU) - subscription billing. Paddle acts as our authorized reseller (merchant of record) and, for payment data, is an independent controller rather than our processor: it processes the payment, calculates tax and issues your invoice. Card details are entered only on Paddle's payment page and never reach our servers - we do not store a card number or any part of one. From Paddle we take only what we need in order to know whether a subscription is active: the customer and subscription identifiers, the chosen plan, its status and the next billing date.
• Telegram (Ireland/UAE) - sending the business owner alerts about new messages, appointments and escalations, when the owner switches that channel on. An alert may contain a client's name and appointment details.

Some processors process data outside the EU/EEA (in the USA, for example). In those cases the transfer relies on appropriate safeguards (Standard Contractual Clauses or equivalent). We update the processor list as needed; you can request the current version at the email in point 1.

5. Google API Services - Limited Use

Avenos's use of Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar data is used solely to create and manage appointments in the business owner's calendar. We do not transfer it to third parties, do not use it for advertising, and do not allow humans to read it, except with explicit consent, for security purposes, or where the law requires it.

6. Retention

Client, message and appointment data is kept while the business account exists, that is, until the business or the client deletes it. After a subscription is cancelled the account stays read-only for another 90 days; once that period passes the data remains in the database until a deletion request arrives (point 7). On top of that we apply automatic deletion:

• technical records of received messages are deleted after 30 days;
• internal analytics events are deleted after 90 days.

Some data may be retained longer where the law requires it (accounting records, for example). You can request deletion at any time (see point 7 and the Data deletion page).

7. Your rights

Under the Serbian Personal Data Protection Act and the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing and withdrawal of consent. Send your request to support@avenos.ai. For deletion of data collected through Meta platforms, see the Data deletion page.

8. Security

We apply appropriate technical and organisational data protection measures, including encryption of sensitive access tokens (AES-256-GCM) in the database and protection of data in transit (TLS).

9. Cookies

In the business owner's app we use only the cookies necessary for sign-in and session handling and for remembering the selected business. These are technically required for the app to work, and consent is not requested for them.

If you arrive through an ad or a link carrying campaign tags (utm parameters, Meta's fbclid), we keep those tags for 30 days in a first-party cookie (avenos_attr) on avenos.ai so that, if you register, we can record where the account came from. Alongside them it holds the default measurement setting for the country you arrived from (only "on" or "off", not the country itself). If you continue signing up in another browser (for example, from Instagram into Chrome) and measurement is allowed, the same cookie also carries the Meta pixel identifier from the browser where you opened the ad, so that Meta can connect the registration to that ad. The cookie is not set when no campaign tags are present.

On the marketing site we use Google Tag Manager, and through it Google Analytics to measure visits and the Meta pixel to measure ad performance. They set analytics and advertising cookies. What happens before you answer depends on where you are visiting from:

• European Economic Area and the United Kingdom - no such cookie is set until you consent. On your first visit you are offered a choice between Accept all and Decline all, and until you answer, every one of them is off.
• Everywhere else, Serbia included - measurement is on from the start of the visit, because local law here does not require prior consent. You are still offered the same choice and can switch measurement off at any time: when you choose Decline all we stop collecting and delete the cookies set until then.

We remember your decision in your browser and it applies wherever you visit from later. You can change it by clearing the site's data.

Regardless of consent, merely loading these tools means Google and Meta see your IP address, browser type and page address. That is why both are also listed in point 4.

10. Artificial intelligence

The Service uses artificial intelligence to answer messages automatically. The business is obliged to inform the client that they are communicating with an AI system; by default the AI identifies itself in its first message. A client can ask to speak to a person at any time.

11. Changes

We will tell you about any material change to this Policy at least 30 days before it takes effect.

12. Contact

PROZONE AI DOO
Novo Selo 3, 75, 21208 Sremska Kamenica, Srbija
Tax number: 115321246  ·  Company number: 22141694
Email: support@avenos.ai
Full company details: Contact.