Privacy Policy

The controller of the personal data described in this policy is Sen Balance Limited, registered in Ireland under company number 792973, with its registered office at 77 Camden Street Lower, Dublin, Dublin, D02 XE80, Ireland.

For any privacy question or to exercise your rights, email senlimitedie@gmail.com. We are not required to appoint a Data Protection Officer, and we have not done so. That email address reaches the person responsible for data protection at AOVA.

• Account data: your email address and a password. We don't see your password: it is managed by our authentication provider (Amazon Cognito), which stores it only in a securely hashed form.
• Billing data: your plan, purchases, invoices, credit balance and usage history. Stripe collects your payment details, such as your card, name and billing address, and gives us only limited information, such as the card brand, last four digits and payment status.
• Content you add: documents, audio and video files and their transcripts, Knowledge Base content, assistant instructions and channel settings. Your files may contain personal data about you or other people.
• Conversation data: the messages exchanged with your assistants, including tests in the dashboard. It also includes the identifiers of your end users that a channel provides, such as a Telegram chat ID or a WhatsApp phone number. For your end users' conversations we act as your processor (see section 3).
• Messages to our own assistant: if you use the chat widget on aova.app, the messages you send it and the answers it gives.
• Communications: emails and support requests you send us.
• Technical data: IP address, browser and device type, pages requested, timestamps and error logs, recorded automatically by our servers and content delivery network for security and troubleshooting.
• Analytics data, only if you consent: how you use our websites, such as pages viewed, clicks, sign-ups and purchases. This is collected through Google Analytics (see section 6).
• Promotion data: if you arrive through a promo link, the promo code, so we can apply it to your account.

We collect this data from you directly, from your use of the Service, and from Stripe (payment status). You don't have to give us personal data, but we cannot create an account or process purchases without an email address.

We are the controller for data about our own customers and website visitors: account, billing, communications, technical and analytics data, and messages to our own assistant. For content you upload and for your end users' conversations with your assistants, we are your processor. We process that data only on your instructions under our Data Processing Addendum, and you, as controller, are responsible for informing your end users and having a lawful basis.

• AI models are accessed through Amazon Bedrock, run by Amazon Web Services. Under AWS's terms, prompts, documents and answers are not used to train models, and they are not shared with the model developers (such as Anthropic, Amazon or xAI).
• We do not use your content or conversations to train AI models.
• Most models run on AWS infrastructure in the EU. Some models are available only through AWS's global inference, which may process a request in an AWS region outside the European Economic Area. Currently this applies to xAI's Grok models. If you need all processing to stay in the EU, choose a different model.
• We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Under the Irish ePrivacy Regulations (S.I. 336/2011), we use only strictly necessary storage without asking you. Analytics cookies are set only after you accept them in our cookie banner. You can change your choice at any time using the “Cookie settings” link in the footer.

Until you consent, we use Google's Consent Mode. In this mode Google may receive cookieless signals that do not identify you, which it uses to model aggregate statistics.

We do not sell your personal data. We share it only with the following recipients:

• Amazon Web Services EMEA SARL, our hosting provider, which processes data on our behalf. This covers storage, databases, authentication, email delivery, AI models (Amazon Bedrock) and transcription (Amazon Transcribe). Data is stored in the AWS Europe (Ireland) region.
• Stripe Payments Europe, Limited (Ireland), our payment processor. For some processing, such as fraud prevention and regulatory compliance, Stripe acts as an independent controller under its own privacy policy.
• Google Ireland Limited, for Google Analytics, only if you consent.
• Messaging platforms you connect, such as Telegram and WhatsApp (Meta). When you connect a channel, messages pass through that platform under its own terms and privacy policy.
• Professional advisers, such as lawyers and accountants, bound by confidentiality.
• Authorities, such as the Revenue Commissioners, regulators, courts and law enforcement, where the law requires us to share data.
• A buyer or successor, if our business is sold or reorganised, subject to this policy.

We store data in the EU. Some recipients may process data outside the European Economic Area. Examples are Google and Stripe's US affiliates, and AWS global inference for the models described in section 5. Where that happens, the transfer is protected by an adequacy decision, such as the EU-U.S. Data Privacy Framework for certified companies, or by the European Commission's Standard Contractual Clauses with supplementary measures. You can ask us for a copy of the relevant safeguards at senlimitedie@gmail.com.

We protect personal data with appropriate technical and organisational measures. These include encryption in transit (TLS) and at rest, access restricted to authorised personnel on a need-to-know basis, separation of each customer's data, and monitoring and logging. No online service can be completely secure. If a personal data breach is likely to put your rights at risk, we will notify the Data Protection Commission and, where required, you.

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict our processing in certain circumstances;
• receive data you provided to us in a portable format (data portability);
• object to processing based on our legitimate interests;
• withdraw your consent at any time, for example through “Cookie settings”. This does not affect processing that took place before you withdrew it.

To exercise these rights, email senlimitedie@gmail.com. We will reply within one month, which we can extend by two months for complex requests, and we may need to verify your identity first. Exercising your rights is free.

You also have the right to lodge a complaint with the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland (dataprotection.ie), or with the supervisory authority in the EU country where you live or work. We would appreciate the chance to address your concern first.

AOVA is not intended for anyone under 18, and we do not knowingly collect children's personal data for our own purposes. If you believe a child has given us personal data, contact senlimitedie@gmail.com and we will delete it.

We may update this policy. We will show the date of the latest version at the top of this page. If we make material changes, we will notify account holders by email before they take effect.