Privacy policy

This Policy describes how the Avatar platform (the "Platform", "we") processes personal data of website visitors, customers of the service (owners and members of workspaces) and shoppers who pay for orders through links shared during streams.

1. Controller

The controller is the legal entity you have a contract with: the Russian entity for customers paying through YooKassa and for shoppers of Russian stores; the international entity for customers paying through Stripe. Details appear in the terms of service, on invoices and in the Billing section. For personal data requests use the address listed on the Contact page.

2. Data we process

Users and customers: email address, password hash, name (if provided), workspace country, time zone and language, team role, consent records with version, timestamp and IP address, an activity log (sign-in, role changes, stream starts, billing changes), technical session data.

Customer payment data: customer and subscription identifiers at the payment provider, card brand and last four digits, billing email, invoice address. The Platform never receives or stores full card details — Stripe and YooKassa process them.

Shoppers: name and contact (email or phone), delivery address when an order needs one, order contents and status, identifier on the streaming platform (for example a YouTube chat name), question history and preferences (size, interests) the avatar uses for recommendations.

Platform data: when YouTube is connected — OAuth tokens for the channel, stored encrypted in a key management system.

3. Purposes and legal bases

• Performance of a contract: registration, providing the service, running streams, processing orders and payments, support.
• Legal obligations: receipts and accounting, responses to lawful requests from authorities.
• Legitimate interest: security, fraud prevention, audit log, improving the service based on anonymised statistics.
• Consent: analytics and marketing cookies, product newsletters (withdrawable at any time).

Users from Russia are additionally asked for separate consent to personal data processing and to automatic charges, as required by Russian law.

4. Where data is stored

Data of workspaces with the "ru" data region (customers from Russia and their shoppers) is stored on servers located in the Russian Federation. Data of all other workspaces is stored in the European Union. The region is set when the workspace is created, based on the country, and is not changed without the customer's request.

5. Recipients

• Payment providers: Stripe (international customers) and YooKassa (Russia) — to process payments and issue receipts.
• Streaming platforms: YouTube (Google) — when you connect a channel.
• Avatar, speech synthesis and language model providers — receive only the text of utterances and voice settings, never shopper identifiers.
• Infrastructure providers (hosting, email delivery) — under data processing agreements.

We do not sell personal data and do not share it with third parties for their own marketing.

6. Retention

Account data — for the duration of the contract and 30 days after workspace deletion (recovery period), then erased. Audit log — 1 year. Financial documents — for the period required by law. Shopper data — while the customer uses the service, or until a deletion request, unless receipt retention rules require otherwise.

7. Your rights

You may request access to your data, rectification, export in a machine-readable format, restriction of processing and erasure, and withdraw consent. A workspace owner can export and delete their shoppers' data in the interface or on request. We respond within 30 days. You may lodge a complaint with the supervisory authority in your country.

8. Security

Passwords are stored as Argon2id hashes. Session tokens rotate; reuse of an old token revokes the whole chain. Customer secrets (YooKassa keys, OAuth tokens) are kept in an encrypted key management system. Workspace data is isolated at the database level. Staff access to customer data is role-restricted and logged.

9. Children

The service is intended for businesses and is not directed at persons under 18.

10. Changes

When the Policy changes, the new version is published on this page with an updated date. We notify you of material changes by email.