The short version
- This website sets no cookies, runs no analytics and loads nothing from other companies. Even our fonts are served from our own site.
- Avaro Core holds data in the United Kingdom, in London.
- The client records a firm keeps in Avaro Core belong to that firm. We act only on its instructions.
- We never sell personal data, and we don't use customer data to train AI models or to build other products.
- Questions or requests: privacy@avarotechnologies.com.
1. Who we are
Avaro Technologies Ltd, registered in England and Wales, company number 17073861. Registered office: C/O Wainwrights Accountants, Faversham House, Old Hall Road, Bromborough, Wirral, CH62 3NX, United Kingdom.
We are registered with the Information Commissioner's Office (ICO) under reference ZC103328.
This policy covers this website (avarotechnologies.com) and our product, Avaro Core, including its client portal and mobile app. Optional Avaro One modules, when they become available, are covered by this policy too.
2. Our two roles
Avaro Core is business software sold to firms, so we handle personal data in two different capacities. Your rights depend on which one applies to you.
- We are the controller for the data of people who visit this website, contact us, hold an Avaro Core account, or pay for a subscription. We decide how that data is used.
- We are a processor for the records a customer keeps in Avaro Core: its clients, contacts, deals, contracts, projects, timesheets and invoices. The customer is the controller and decides what to collect and why. We act only on its instructions, under our Data Processing Agreement.
If you are a contact held in a firm's Avaro Core account and want your details changed or removed, please ask that firm. We will help them act on your request.
3. What we collect, and why
This table covers the data we are responsible for as controller.
| When | What we collect | Why, and our lawful basis |
|---|---|---|
| You visit this website | Standard server logs kept by our web host: IP address, browser type, the page requested and the time. | To keep the site running and secure. Legitimate interests. |
| You send an enquiry or book a demo | Your name, work email, what you're interested in, and anything else you choose to tell us. | To reply to you and arrange what you asked for. Legitimate interests, or steps you asked us to take before a contract. |
| You create or use an Avaro Core account | Your name, email address, organisation, role, sign-in and security settings (such as two-factor and passkeys), session records, and an audit trail of what you do in the product. | To provide the service and keep it secure. Performance of our contract with your organisation, and legitimate interests in security. |
| You sign in with Microsoft or Google | Your name, email address and an account identifier from your provider. We never receive your password. | To sign you in. Performance of contract. |
| Your organisation pays for a plan | Billing contact, organisation name and address, VAT number, plan, seat count and payment history. Card details go straight to Stripe; we never see or store them. | To bill for the service. Performance of contract, and legal obligation (tax records). |
| You contact support | Your messages and our replies. | To help you and improve the service. Legitimate interests. |
Marketing. We don't currently send marketing emails. If we start, we will only send them to people who have agreed to receive them or, for existing customers, about similar products, and every email will have a one-click unsubscribe.
We don't make decisions about you by automated means that have legal or similarly significant effects.
4. Records our customers keep in Avaro Core
A firm using Avaro Core stores records about its own clients, prospects, staff, contractors and suppliers. These typically include names, contact details, job titles, notes and activity history, quotes, contracts and signatures, project assignments, timesheets, expenses and invoices.
When a firm sends a contract for e-signature, we record what's needed to make the signature reliable evidence: the signatory's name and email, the time, their IP address, confirmation of the one-time code, and the signature certificate. We do this on the firm's behalf.
We process these records only to provide the service and on the customer's instructions, under our Data Processing Agreement, which every paying customer signs with its subscription. To read it before signing up, email privacy@avarotechnologies.com.
Customers must not store special category data (such as health information) or criminal offence data in Avaro Core unless we have agreed it in writing.
5. Who else processes data
We use a small number of suppliers. Each is bound by contract to process data only on our instructions and to protect it.
| Supplier | What for | Where |
|---|---|---|
| Supabase | The Avaro Core database and uploaded files | London, UK |
| Vercel | Hosting and delivering the Avaro Core application | Served from the London region |
| Stripe | Taking payment for paid plans. Receives billing contact and payment details only, never the contents of an account. | UK, EU and US, under recognised safeguards |
| Resend | Sending email: invitations, password resets, notifications and replies to website enquiries | May process outside the UK, under recognised safeguards |
| IONOS | Hosting this website and handling the enquiry form | UK, EU |
Xero. If a customer connects its own Xero organisation, Avaro Core sends the details an invoice is made of (contact name and email, invoice number, dates, currency and line items) to Xero at the customer's instruction. That is the customer's own connection and Xero acts for the customer, not as our supplier. We don't read anything else in Xero.
We may also disclose data where the law requires it, or to a buyer if our business is sold, in which case we will tell you.
We give paying customers at least 30 days' notice before adding or replacing a supplier that processes their data.
6. Where data is held
Avaro Core's database and uploaded files are held in the United Kingdom, in London. Some suppliers are based outside the UK. Where personal data is accessed or processed outside the UK, we make sure a transfer mechanism recognised under UK law is in place: an adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
7. How long we keep it
| Data | How long |
|---|---|
| Website server logs | Up to 30 days |
| Enquiries that don't lead to a customer relationship | 24 months after our last contact |
| Account data and customer records | For as long as the subscription lasts. When it ends, data stays available for 30 days so the customer can ask for a copy. It is then deleted from our live systems and falls out of backups within a further 30 days. |
| Billing records | Six years, as HMRC requires. These are contact and transaction details, not the contents of an account. |
| Support correspondence | 3 years |
The audit trail. Avaro Core keeps a tamper-evident record of who did what. Entries are chained together cryptographically, so they are never deleted while the account exists. They hold identifiers, actions, times and IP addresses, not the contents of records. If you ask us to erase a personal detail held inside an entry, we can remove that detail without breaking the chain, and the removal itself is recorded. A contract signature is the exception: it is evidence the signatory created to be durable, so we keep it as part of performing the contract.
8. How we protect it
- Data held in the UK, encrypted in transit and, for personal data, encrypted at rest.
- Each organisation's records are separated by the database itself, as well as by the application.
- Sign-in with passwords protected by lockout, passkeys, two-factor codes, or Microsoft or Google. Organisations can require two-factor for everyone and set how long sessions last.
- Avaro staff can't see a customer's records unless the customer grants access, one occasion at a time, and every visit is recorded in the customer's audit trail. Our staff must use multi-factor authentication to reach our operator tools, with no exceptions.
- Entries captured offline in the mobile app are encrypted on the device until they sync.
No system is perfectly secure. If you think you have found a security problem, please tell us at security@avarotechnologies.com. We will not pursue anyone who reports an issue in good faith and doesn't exploit it.
10. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data
- correct it
- delete it
- restrict or stop how we use it, including objecting to processing based on legitimate interests
- give it to you, or another provider, in a portable format
Email privacy@avarotechnologies.com. We will respond within one month and won't charge you. We may need to confirm who you are first.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office. We would appreciate the chance to put things right first.
11. Children
Avaro Core is business software for people at work. It isn't intended for anyone under 18, and we don't knowingly collect children's data.
12. Changes to this policy
When we change this policy we update the version and date at the top. If a change affects how we handle personal data, we will email account holders before it takes effect. We will not make a material change quietly.
13. Contact us
Privacy questions and requests: privacy@avarotechnologies.com
Security reports: security@avarotechnologies.com
By post: Avaro Technologies Ltd, C/O Wainwrights Accountants, Faversham House, Old Hall Road, Bromborough, Wirral, CH62 3NX