Privacy Notice — Avylo AI

Avylo Private Alpha Privacy Notice Version: private-alpha-v1 — Effective: 2026-10-30 1. Who is responsible Avylo is operated by Mohamed Habib Allah Bibani, an individual based in Tunisia, who is the data controller. Contact for privacy requests: privacy@avyloai.com. 2. Data we collect - Account data: name, email address, and sign-in method (email/password, or Google/GitHub OAuth identifiers). Passwords are stored only as hashes. - Content you provide: projects, prompts, uploaded files and the AI-generated outputs created for you. - Usage and billing-ledger data: credit grants and consumption, feature usage, feedback you submit, and invitation/consent records (which Terms and Privacy versions you accepted, and when). - Technical data: IP address, device/browser information, and security and error logs. - Discord data: if you join our Discord server, Discord's own terms apply to that platform; we see only what Discord shows server operators. We do not collect payment card data during the private alpha. 3. Why we use it, and legal basis - To provide the service you requested (contract). - To keep it secure, prevent abuse, and debug (legitimate interests). - To measure and improve the product using privacy-safe telemetry (legitimate interests). - To email you about your account, invitations and service changes (contract / legitimate interests). - To keep consent records (legal obligation / legitimate interests). We do not sell your data and do not use advertising trackers. 4. AI processing Content you submit to AI features is sent to Google (Gemini API) to generate results. We have configured this under terms that do not allow your content to be used to train models. Prompts, project content and model outputs are not placed in our telemetry or logs. 5. Service providers Hosting and infrastructure, email delivery (SMTP / Resend), object storage (S3-compatible), Google (AI processing, and Google sign-in if used), GitHub (GitHub sign-in if used). They process data only to provide their service to us. 6. International transfers We are based in Tunisia, and our providers operate in the United States and other countries. By using the service you understand your data is transferred to and processed in these countries, which may have different data-protection rules from yours. We use contractual protections offered by our providers where available. 7. Retention - Account and project content: until you delete it or your account, or the alpha ends. - Billing ledger and audit history: kept indefinitely for integrity and accounting. - Raw privacy-safe telemetry and product events: 90 days. - Aggregates and backup-verification logs: 13 months. - Backups are overwritten on a rolling basis. After deletion, residual copies may persist in backups for a limited period. 8. Your rights Depending on where you live (including Tunisia under Organic Law 2004-63, and for US residents under applicable state laws such as California's CCPA/CPRA), you may request access, correction, deletion, portability, or object to or restrict certain processing. Email privacy@avyloai.com; we aim to respond within 30 days. We may need to verify your identity. You may also complain to your data-protection authority (in Tunisia, the INPDP). 9. Children Avylo is for adults (18+). We do not knowingly collect data from children; contact us to have such data deleted. 10. Security We use access controls, hashed credentials, encrypted connections and tenant isolation. No system is perfectly secure; we will notify you of breaches affecting you as required by law. 11. Cookies We use only essential cookies (session/authentication and security). We do not use advertising or cross-site tracking cookies. 12. Changes We may update this Notice. Material changes get a new version number and require re-acceptance. 13. Contact privacy@avyloai.com