Skip to content
Avo Ops

Privacy policy

Last updated: 2026-09-24

1. Who is responsible

The controller of your personal data in connection with Avo is:

Cesar Gabriel Gutierrez Medina
Rotenhofgasse 30/32
1100 Vienna
Austria
Email: privacy@avoops.com

AVO is a platform for running and organising hospitality businesses (‘Avo’, ‘we’). It currently includes the Avo Marketing app, the avoops.com website and the connection pages at conectar.avoops.com.

2. What this policy covers

This privacy policy explains what personal data we process, for what purposes, where the data is stored, which service providers are involved and what rights you have. It applies to:

  • the Avo apps and the services behind them,
  • the avoops.com website, including the avoops.com/marketing page, where you can take out a subscription, and the checkout (section 6),
  • the contact form on avoops.com (section 7),
  • the connection pages at conectar.avoops.com.

3. Our role: controller and processor

For your account data, in particular your name, email address and sign-in details, and for the operation of the platform, we act as controller.

For business content that a restaurant stores in the app, such as media, contact details of team members or performance metrics, the restaurant operator decides which data is stored and for what purpose. In that respect we process this data on behalf of the restaurant.

If a restaurant operator invited you to a workspace, that operator is responsible for the decision to add you. We process your data according to the principles described in this privacy policy.

4. Data we process

Account data. When you create an account or take out a subscription on avoops.com (section 6), we store your name and email address. You can sign in with a one-time code sent by email, with an email address and password, or with Google Sign-In. Passwords are managed by our authentication service, Supabase Auth, and are not stored in our own application tables. Google Sign-In is used for sign-in only. It does not connect your Google Business Profile, and apart from basic profile data such as your name and email address, it gives us no access to any other Google data.

Business data. We store details of the restaurant you manage, including the organisation and restaurant name, address, time zone, currency and the roles of the team members you invite.

Purchase and billing data. When you take out a subscription, you enter at checkout your name, your email address, your billing address, the name of your restaurant and, where applicable, a company name and your VAT number (UID). Your billing address, company name and VAT number stay with Stripe and appear on your invoice; we do not store them in our own database. We store the plan you chose, the status and start date of your subscription, and the identifiers Stripe uses for your customer record and your subscription. We keep copies of the invoices we issue to you, as described in section 11. You enter card numbers and other payment details directly with Stripe. They do not reach our servers. See section 6 for details.

Newsletter, enquiries and customer story. As a customer, you occasionally receive news about Avo at the email address you gave at checkout, if ‘Yes, please’ was selected in the ‘Avo news by email’ field when you completed your purchase, and until you unsubscribe (sections 6 and 7). If you write to us through the contact form, sign up for the newsletter there or agree to a customer story, we process the data described in section 7.

Content you create. This includes photos, videos, captions, drafts, brand voice and positioning, scheduled and published posts, and uploaded documents such as menus that help the assistant create suitable content for your business.

Connected platform data. If you connect Instagram, Facebook or Google Business Profile, we store the access credentials needed to communicate with these platforms on your behalf. These credentials are stored encrypted; see section 10 for details. We also process performance data that the platforms provide, for example views, clicks, calls and requests for directions.

Technical data. The app does not use any third-party analytics, crash reporting or advertising trackers. Our infrastructure providers do, however, keep standard technical logs needed for operation and security. Supabase, our backend service, and Vercel, for our websites, log requests including IP addresses. When you view the plans on avoops.com/marketing or choose a plan, your browser asks our servers at Supabase directly whether seats are still available and starts the checkout there; your IP address is logged in this case too. Expo's update service receives basic device and app version information when the app checks for updates.

5. Purposes and legal bases for processing

  • Providing the service: managing your account, storing your content, publishing to platforms you have connected and showing your metrics. Legal basis: performance of a contract under Art. 6(1)(b) GDPR.
  • Taking out and administering your subscription, setting up your account and your restaurant automatically after purchase, and the welcome email. Legal basis: performance of a contract under Art. 6(1)(b) GDPR.
  • Collecting your billing address and VAT number for invoicing. An invoice must show the recipient's name and address and, for invoices over EUR 10,000 and where the tax liability is reversed (reverse charge), for example for restaurants in other EU countries, also the recipient's VAT number. Legal basis: compliance with legal obligations under Art. 6(1)(c) GDPR in conjunction with § 11 UStG, and performance of a contract under Art. 6(1)(b) GDPR.
  • Keeping copies of invoices and accounting records. Legal basis: compliance with legal obligations under Art. 6(1)(c) GDPR in conjunction with § 132 BAO and § 11(2) UStG.
  • Keeping the identifiers from Stripe's notifications that we need to evidence invoices, payments, refunds or adjustments. Legal basis: compliance with legal obligations under Art. 6(1)(c) GDPR in conjunction with § 132 BAO.
  • Storing the remaining details of those notifications for 30 days, so that we do not process the same notification twice. Legal basis: our legitimate interest under Art. 6(1)(f) GDPR.
  • Creating content and insights with AI: drafts, captions and plain-language explanations of your metrics. Legal basis: performance of a contract.
  • Sending transactional emails, such as sign-in codes, invitations, account notices and the welcome email after purchase. Legal basis: performance of a contract.
  • News about Avo for customers who have taken out a subscription (direct marketing for our own similar products). Under § 174 (4) TKG 2021, these emails may be sent without prior consent; the legal basis for the processing is our legitimate interest in direct marketing under Art. 6(1)(f) GDPR. You can object at any time (sections 7 and 13).
  • Newsletter via the contact form: your consent under Art. 6(1)(a) GDPR (section 7).
  • Customer story with the founder price: your consent under Art. 6(1)(a) GDPR, which we ask for in a personal conversation (section 7).
  • Handling enquiries via the contact form: for the legal bases, see section 7.
  • Protecting the service and preventing abuse. Legal basis: our legitimate interest under Art. 6(1)(f) GDPR.

We do not sell your data and do not use it for third-party advertising. We only send you information about our own products as described in section 7.

6. Taking out a subscription on avoops.com

Checkout. On avoops.com/marketing you can take out a subscription to Avo Marketing. When you choose a plan, we redirect you to a payment page operated by our payment provider, Stripe. There you enter your name, your email address, your billing address and the name of your restaurant. Optionally, you can enter a company name and your VAT number. We do not ask for a phone number. Stripe needs your billing address, company name and VAT number for VAT and for the invoice; they stay with Stripe and on the invoice.

News about Avo. On the payment page we tell you: ‘We occasionally send you emails about news and similar products from Avo. You can opt out at any time, free of charge, here at checkout and with the unsubscribe link in every email (§ 174 (4) TKG 2021).’ On the same payment page where you enter your email address, you will find the field ‘Avo news by email’. It is set to ‘Yes, please’; if you do not want any news, choose ‘No, thanks’. Only if ‘Yes, please’ is selected when you complete the purchase do we send you emails at the address you gave at checkout, and then only news about Avo and similar products of our own, never third-party advertising. Every one of these emails contains an unsubscribe link. Before each mailing we check your address against the RTR's ECG list; if you are on it, you will not receive these emails.

Payment methods. You can pay by card or with Apple Pay. You enter card numbers and other payment details directly with Stripe; they do not reach our servers. If you pay with Apple Pay, Apple's privacy policy also applies.

What happens automatically after purchase. As soon as Stripe confirms that your payment was successful, we set up your account without any further action on your part:

  • We create an account with your email address, unless one already exists.
  • We create your business and your restaurant under the name you gave at checkout and register you as the owner. We derive the time zone from the country of your billing address and the currency from the checkout. If you did not give a name, we temporarily use the part of your email address before the @; you can change it in the app.
  • We store the plan, status and start date of your subscription, and Stripe's identifiers for your customer record and your subscription.
  • Of the notifications Stripe sends us, we store only the event type and the identifiers, not the details you entered at checkout. This applies to that event log only; sections 4 and 11 describe what we store for your account and for the copies of your invoices.

Welcome email. We then send you, via our email provider Resend, a welcome email with the name of your restaurant and the email address you sign in with.

Cancelling. If you leave checkout without completing your purchase, we do not create your account or restaurant.

7. Contact form, newsletter and customer story

Contact form

You can send us an enquiry through the contact form on avoops.com. In doing so we process the following data: name, the name of your restaurant, city, email address, the product or topic you are interested in, and your message. Giving a phone number is optional.

Purpose: handling and answering your enquiry and, where applicable, starting a business relationship.

Legal basis: taking steps at your request prior to entering into a contract under Art. 6(1)(b) GDPR. Where your enquiry is not aimed at concluding a contract, we base the processing on our legitimate interest in answering enquiries under Art. 6(1)(f) GDPR. We do not need your consent to submit the form and answer your enquiry; below the button we simply refer you to this privacy policy. The checkbox is only for signing up to the newsletter.

Retention: We keep your enquiry and the data submitted with it for up to three years from the last contact. It is then deleted, unless statutory retention obligations require otherwise. If a contract is concluded, the periods in section 11 apply.

Recipients: A notification about your enquiry is sent to our internal email address. The enquiry itself is stored in our database. The service providers involved are listed in section 8.

The fields marked as required must be completed so that we can handle your enquiry. Without this information we cannot reply to you.

Newsletter

You can receive news about Avo in two ways, with different rules:

As a customer after a purchase. If you have taken out a subscription on avoops.com and left ‘Yes, please’ selected in the ‘Avo news by email’ field when you completed your purchase, we send news about Avo and similar products of our own to the email address you gave at checkout, without prior consent, as § 174 (4) TKG 2021 allows for existing customers. Conditions: the address comes from the purchase, it only concerns our own similar products, you were able to opt out free of charge at checkout and can do so with every email, and you are not on the RTR's ECG list, which we check before each mailing. The legal basis for the processing is our legitimate interest in direct marketing under Art. 6(1)(f) GDPR.

Via the contact form. The contact form has its own box for the newsletter, which is not ticked by default. If you tick it, you are signed up straight away, and we immediately send you a newsletter welcome email with a clearly visible unsubscribe link that lets you unsubscribe with one click. The email may also contain a confirmation button; you stay signed up even if you do not click it. If you have unsubscribed, you can sign up again at any time by ticking this box in the contact form. The legal basis is your consent under Art. 6(1)(a) GDPR.

Purpose: sending information about our products and updates.

Record: When you sign up via the contact form, we record the date and time, the exact wording of the box and whether you clicked ‘Confirm’ in the welcome email. For customers, we record that the address comes from a purchase and whether ‘Yes, please’ was selected at purchase; any other value and an empty field count as an objection.

Unsubscribing and objecting: You can unsubscribe or object at any time, free of charge: with the unsubscribe link in every email or by emailing privacy@avoops.com. This withdraws any consent you gave, with effect for the future; the lawfulness of processing carried out until then is not affected.

Retention: We keep your email address for this purpose until you unsubscribe or object. After that we keep your email address with the date you unsubscribed, and the record of the emails we sent you before (date, subject and delivery status), for as long as we send news about Avo. This lets us honour your unsubscribe and demonstrate that we complied with the rules (Art. 5(2) GDPR).

The newsletter is independent of the handling of your enquiry and of your subscription. You can submit the contact form without signing up for the newsletter, and objecting does not change anything about your subscription.

Customer story with the founder price

If you use the founder price, we ask you in a personal conversation whether you would like to take part in a customer story: we would publish your experience with Avo, where applicable with metrics from your use, as a customer story, and you tell us what works and what does not. Taking part is voluntary. The founder price does not depend on it.

Legal basis: your consent under Art. 6(1)(a) GDPR. You confirm your agreement in writing, for example by replying by email; we keep this message as a record. Without your written agreement there is no customer story.

Retention: We publish the customer story for as long as your consent applies. If you withdraw it, we take the customer story down from our own channels. We keep your written agreement for as long as the customer story is published, and for three years after that. If the customer story is never published, we keep your written agreement for three years from the day you gave it; if you withdraw it before anything is published, for three years from your withdrawal.

Withdrawal: You can withdraw your consent at any time with effect for the future, by emailing privacy@avoops.com. Withdrawing does not change your price.

8. Service providers and processors

We use the following service providers. Where they process personal data on our behalf, they do so under data processing agreements. Stripe also acts as an independent controller for certain purposes, as described below.

  • Supabase: database, authentication and file storage. Your data is hosted in the European Union.
  • Anthropic: AI processing. When the assistant writes a caption, the text you enter, your brand voice, your business knowledge and the photos concerned are sent to Anthropic's Claude API. Photos are retrieved from our storage via short-lived signed links. When you upload a menu so that the assistant can take information from it, the document is sent for processing and is not stored by us afterwards. For explanations of your metrics, only aggregated values without your business name are sent. We do not send your email address or the names of individuals. Anthropic may store API inputs and outputs for a limited period; by default they are deleted within 30 days. Different retention periods may apply depending on the service used, contractual arrangements, or legal or security requirements. This data is not used to train Anthropic's models.
  • Stripe: processing of payments and subscriptions, and invoicing. Our contractual partner is Stripe Payments Europe, Limited, based in Ireland. Stripe receives the checkout details directly from you (section 6). Stripe acts in two roles: as our processor, where Stripe processes the data on our behalf to operate the platform and provide its services; and as an independent controller, where Stripe selects banks and payment method providers, prevents and detects fraud, manages risk, meets legal obligations (for example on anti-money laundering, customer identification and towards authorities) and improves its products. Stripe's privacy policy applies to this processing: https://stripe.com/privacy. Stripe also transfers data to Stripe, LLC in the United States.
  • Resend: sending transactional emails such as sign-in codes, invitations, account notices and the welcome email after purchase, the newsletter welcome email and newsletter messages, and notifications about enquiries from the contact form.
  • Vercel: hosting of avoops.com, including the purchase page avoops.com/marketing, and of the connection pages at conectar.avoops.com.
  • Expo: delivery of app updates via EAS Update.

Transfers outside the EEA. Some of these providers are based in the United States or may process data there. Where personal data is transferred outside the European Economic Area, we base the transfer either on an adequacy decision of the European Commission, for the United States the EU-U.S. Data Privacy Framework, where the provider is certified accordingly, or on appropriate safeguards under Art. 46 GDPR, in particular the European Commission's standard contractual clauses. You can request a copy of the safeguards applicable to the transfer by emailing privacy@avoops.com.

9. Connected platforms

Instagram, Facebook (Meta) and Google Business Profile are not processors of AVO. If you connect one of these platforms, its use is based on your express authorisation and on the platform's own terms of use and privacy policy.

Connecting is optional. We only request the permissions needed to publish content you have approved and to retrieve the related performance data. Nothing is published without the owner's express approval within the app.

You can disconnect a connected platform at any time within the app. This revokes our access.

During onboarding we also use the Google Places service to look up your restaurant's address. This lookup is carried out server-side and does not connect to any Google account.

To connect with Facebook and Instagram, our connection page loads Meta's JavaScript SDK directly from Meta's servers. This is technically necessary to carry out the login and happens only on that page and only when you actively use the connection.

10. Security

Access to data is separated per restaurant at database level. Row-level security rules deny access by default unless the corresponding permission exists. Purchase and subscription data cannot be accessed through the app, not even by you; only our servers access it.

Credentials for Instagram, Facebook and Google are stored in an encrypted vault, separate from the regular application tables. All communication between the app and our servers is encrypted in transit.

11. Retention

As a rule, we keep your data for as long as your account exists. If you delete your account, your data is removed following the procedure described in section 12.

We keep copies of the invoices we issue to you for seven years, counted from the end of the calendar year to which they relate. This is a legal obligation of our own (§ 132 BAO, § 11(2) UStG); it continues to apply after your account is deleted. We keep the invoices digitally, complete and in a form that allows them to be reproduced unaltered throughout the entire period. If the invoices are relevant to pending tax proceedings in which we are a party, we keep them for as long as the law requires. They are deleted once the applicable statutory period has ended.

Of the notifications from Stripe (section 6), we keep the identifiers we need to evidence invoices, payments, refunds or adjustments together with the invoices and for the same period. The remaining details of those notifications only serve to stop us processing the same notification twice; they are deleted 30 days after we receive them.

For enquiries via the contact form, for the newsletter and for the customer story, the separate periods in section 7 apply.

Technical logs kept by our infrastructure providers are deleted according to their standard periods. Certain minimal records may be kept for longer where required by law.

12. Deleting your account

You can delete your account directly in the app, under ‘Settings’. Subject to the exceptions described below, your data is deleted from our application database immediately. There is no grace period and no way to restore it. The deletion process only ends once the database has been checked to confirm that the data concerned has actually been removed.

When you delete your account:

  • Your profile, your roles and your memberships are deleted.
  • If you are the sole owner of a business, the business and all its data are deleted, including content, media files, brand voice, campaigns, metrics, calendar data and the data about your subscription. The only exceptions are copies of your invoices, which we must keep for seven years (Art. 17(3)(b) GDPR, section 11), the identifiers from Stripe's notifications that we need to evidence invoices, payments, refunds or adjustments, which we keep for as long as the related invoices (section 11), and the record that you unsubscribed from the newsletter, together with the record of the emails we sent you before (date, subject and delivery status), and your written agreement to a customer story, for which the periods in section 7 apply.
  • If you took out a subscription on avoops.com, it is ended at Stripe immediately when you delete your account. No further payments are collected, and the period already paid for is not refunded.
  • If you belong to businesses you do not own, you are removed from them. The business and its data remain with its owner. Records needed for the integrity of the business's history are anonymised, so that your identity is removed and cannot be linked to you again.
  • Connections to Instagram, Facebook and Google are revoked with those platforms first; the credentials we store are then deleted.
  • Posts already published on Instagram, Facebook or Google are not removed automatically. They remain on those platforms and can be deleted there. The app points this out explicitly before you give your final confirmation.
  • If you register again later, you will have a new account. The exceptions to deletion described in sections 7, 11 and 12 still apply.

Encrypted backups or server logs may remain in our service providers' infrastructure for a limited period until they are deleted on their standard cycles. The same applies to data that the law requires us to keep. Data that Stripe processes as an independent controller is kept by Stripe in accordance with its own privacy policy (section 8).

13. Your rights

Under the GDPR you have, in particular, the right of access, rectification, erasure, restriction of processing, objection and data portability. You can withdraw any consent you have given, for example for the newsletter via the contact form or for the customer story, at any time with effect for the future. Where we have to keep data because of legal obligations, such as copies of your invoices, we can only delete it once the relevant period has ended.

Objecting to processing based on legitimate interests. Where we process your data under Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for establishing, exercising or defending legal claims.

Objecting to marketing. You can object to the use of your email address for news about Avo at any time, free of charge and without giving reasons: with the unsubscribe link in every email or by emailing privacy@avoops.com. After that we no longer use your address for this purpose (Art. 21(2) and (3) GDPR).

To exercise your rights, you can contact us at privacy@avoops.com.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): dsb.gv.at.

14. Children

Avo is a business tool and is not intended for minors.

15. Changes to this privacy policy

We update this privacy policy when the service or the way we process data changes. The current version is always available at avoops.com. We also communicate material changes within the app.