Privacy Policy

About this notice

AVATON provides governed access to APIs through capabilities and MCP. This notice explains how we handle personal information when you visit, contact us, create an account, or use the service. Contact the AVATON operator at contact@avaton.dev for privacy questions. AVATON is an independent personal project. For service, legal, and privacy inquiries, contact contact@avaton.dev. Effective date: 1 September 2026.

Information we process

We process account and profile information, email verification and login records, linked provider identifiers, memberships, project settings, API definitions you submit, encrypted credentials, and execution and security metadata. Requests and responses pass through AVATON to perform the operations you authorize. They can contain personal information supplied by you or your API. Avoid submitting sensitive information that is not necessary for your integration.

A contact request contains your name, email, message, consent record, and verification status. Network and abuse-prevention services may process IP addresses, browser/device signals, request timing, and security events. We do not claim that service traffic is anonymous.

Purposes and legal bases

We use information to provide accounts and integrations, authenticate and authorize requests, respond to inquiries, prevent abuse, investigate incidents, and comply with legal obligations. Where applicable, the legal bases are providing or preparing to provide a requested service, our legitimate interests in operating a secure service, legal obligations, and consent when required. Sending a contact request does not subscribe you to unrelated marketing. You may withdraw consent for optional processing without affecting earlier lawful processing.

Customers and API data

For account administration and our own security operations, AVATON determines the purposes of processing. Where we process API payloads on behalf of a business customer and under its instructions, that customer may be the controller and AVATON its processor. Customers must have a lawful basis, give necessary notices, and ensure they are authorized to send data through their integrations. A suitable data-processing agreement and any required transfer terms should be agreed before using regulated production data.

Service providers and disclosures

Cloudflare provides hosting, storage, network security, and human verification. Resend delivers transactional and contact-verification emails. Our email provider processes correspondence sent to contact@avaton.dev. Google or OpenAI processes sign-in information only if you choose an enabled provider. Your chosen AI client and upstream API receive the information required for the integration and have their own terms and privacy practices.

We may disclose information to service providers acting for us, to comply with lawful requests, to protect rights and security, or as part of a business transfer subject to appropriate protections. We do not sell personal information or share it for cross-context behavioral advertising. We do not use customer API traffic for advertising.

Security and access

We use access controls, tenant separation, encrypted storage for retrievable credentials, and encrypted transport where supported. Stored API secrets are not offered for later viewing in the interface. Authorized processing requires AVATON to use credentials and transmit requests to the configured API; this is not end-to-end encryption that hides all processing from the service. No security measure guarantees protection against every incident.

We do not routinely inspect the business meaning of every request or response. We retain security and operational records and may investigate suspected abuse, resolve support cases, or comply with law. Detailed execution diagnostics are configurable; disabling them does not disable essential security or usage records.

Retention and deletion

We retain account and project records while needed to provide the service, resolve disputes, meet legal obligations, and maintain security. Contact verification links expire after 30 minutes. Unforwarded request payloads are removed by the hourly cleanup after expiry; successfully forwarded payloads are removed from the application database immediately. Minimal contact receipts used for abuse control expire after 30 days. Messages already delivered to an inbox remain subject to correspondence retention and provider backups.

Other security records, backups, and legally required records may remain for a justified period after an account or data is deleted. Request deletion or retention details at contact@avaton.dev. We review retention according to necessity; this notice does not promise an automatic deletion schedule for every account record.

International processing

AVATON and its providers may process information in countries different from yours. Where applicable, we use required contractual, organizational, and transfer safeguards. Hosting location hints do not guarantee that every network or support operation stays in one country. Contact us for details about providers and applicable safeguards.

Your rights in the EU/EEA and other regions

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent where it is relied on and complain to your competent data-protection authority. We may verify your identity before responding. Some records may need to be retained under lawful exceptions. These terms do not remove mandatory privacy or consumer rights.

US privacy rights

Where applicable US state privacy laws provide rights, you may request to know or access personal information, correct it, delete it, obtain a portable copy, and appeal a denied request. Authorized agents may submit requests where permitted, subject to verification. We do not discriminate for exercising privacy rights. Because we do not sell personal information or use cross-context behavioral advertising, there is no sale or advertising-sharing program to opt out of. Contact us to exercise any right applicable to you.

Children, changes, and contact

AVATON is intended for adults and professional users, not children under 18. Do not register or submit personal information if you are under 18. We may update this notice and will identify the applicable version; material changes will receive any notice or consent required by law. For questions, requests, or appeals, email contact@avaton.dev.