GDPR & EU Compliance

For the messages, contacts, and business data you put into Avox, AAIDA Corp. Private Limited acts as a data processor - you (or your business) remain the controller, deciding what data is collected from your customers and why. For your own account details (your name, email, and billing contact), and for how visitors use our own websites and dashboard (site analytics, security and fraud checks, regional prices), we act as the controller. Our Data Processing Agreement sets out the processor relationship in full.

We process your account data to perform our contract with you (running the service you signed up for), and your business's contact data on your documented instructions as our customer. Where we process data for our own legitimate interests - security monitoring, abuse prevention, and service improvement - we do so only where that interest doesn't override your own rights. Our newsletter is sent only with your consent, which you can withdraw at any time with the unsubscribe link in every email, and reactions, votes and read counts on our What's new pages are counted anonymously.

Analytics cookies on our sites (a random visitor ID, city-level location, and linking your browser to your account) are used only with your consent, given and withdrawn in the cookie banner. Anonymous visit counting without cookies, which also keeps the full links that brought you (with private parts removed), relies on our legitimate interest in running and improving our sites; nothing is stored on or read from your device for it. Short-term security records (IP address and browser details, up to 30 days) and reviews of accounts that appear connected rely on our legitimate interest in preventing fraud and abuse; decisions are made by people, not automatically. Showing prices for your country relies on our legitimate interest in offering fair regional prices, and billing on our contract with you. You can object to any processing based on legitimate interests by contacting our Data Protection Officer below. See our Privacy Policy for what is recorded and how long it is kept.

If GDPR applies to you, you have the right to access, correct, delete, export (data portability), object to, or restrict our processing of your personal data. Contact our Data Protection Officer below to exercise any of these - we'll confirm what we hold and act on a valid request within one month, as GDPR requires.

AAIDA Corp. Private Limited's Data Protection Officer can be reached at:
Park Avenue Building, RTO Road, Andheri West, Mumbai 400 053, Maharashtra, India
or by email at hello@theavoxai.com.

AAIDA Corp. Private Limited is based in India, and our sub-processors (Supabase, Meta, PayPal, Vercel, Cloudflare, Fly.io, our email delivery provider, Upstash, ipapi.co and country.is - see our Data Processing Agreement for what each does) may run infrastructure outside the EU/EEA. Our database, hosting and background worker run in Mumbai, India, and Cloudflare handles each request at a location near the visitor, which can be outside the EU/EEA. Where your data crosses borders as a result, we rely on each processor's own published safeguards - including Standard Contractual Clauses where applicable - rather than routing data through infrastructure we run ourselves.

Operational metadata has a real, tenant-configurable retention window today: webhook delivery logs and connection health checks default to 30 days, adjustable per Switchboard to anywhere from 7 to 90 days in Settings. Account, contact, and message data is retained for as long as your account is active, until you delete it. Billing and payment records, coupon-use records, and records of agreement to our policies are kept after deletion for as long as billing, tax, and legal obligations require. Site analytics: detailed visit records 90 days, daily summaries without visitor IDs 25 months, and security records up to 30 days - see our Data Deletion page for exactly what's removed and what's retained.

A restricted set of AAIDA Corp. support/engineering staff can access account data across tenants through internal admin tooling, gated by role at both the application and database level, strictly for support, abuse investigation, and platform operation.