Last updated: October 18, 2026 · Draft: controller and provider details must be completed before publication.
Privacy Policy
This policy explains what personal data is processed when you use Avert, why it is processed, and the rights you may exercise. It applies to the Avert website and application.
1. Data controller and contact
The data controller is [LEGAL COMPANY NAME], with registered office at [FULL ADDRESS], tax/VAT number [NUMBER]. For privacy requests, email [PRIVACY EMAIL TO BE CONFIGURED]. These details must be completed before this policy is published.
If your organization uploads personal data relating to employees, customers, or other people, your organization will generally determine the purposes and means of that processing. In that case, your organization acts as controller and Avert processes those data to provide the service under its instructions and applicable agreements.
2. Data we process
Depending on how you use Avert, we may process:
- account data: name, email address, date of birth to verify the minimum age of 18, authentication credentials managed by the authentication provider, and associated organization; the date of birth is accessible to the account holder and platform administrators;
- service data: uploaded CSV or .xlsx files, file name and technical attributes, analysis results, anomalies, and generated recommendations;
- security and audit data: user identifier, organization, type of operation, affected resource, and event date;
- test checkout data: selected plan, email, and user and organization identifiers sent to Stripe to start a test-mode checkout;
- technical data strictly needed to operate and protect the service, such as request information and technical logs that may be generated by the infrastructure.
3. Purposes and legal bases
We use data to create and manage accounts, verify the minimum age of 18 and prevent access by ineligible accounts, authenticate users, associate users with their organization, receive and analyze files, display results, provide support, and start a requested test checkout. For business users, the legal basis is performance of or steps requested before entering into the service relationship; for third-party data uploaded by an organization, processing follows that organization's instructions and legal basis as controller.
We process technical data and security records to protect accounts and infrastructure, prevent abuse, apply temporary usage limits, and diagnose errors. The legal basis is our legitimate interest in the security and proper operation of the service, balanced against individuals' rights.
Where the law requires consent, processing based on consent takes place only after consent is obtained. Avert does not use results to make autonomous decisions with legal or similarly significant effects on users.
4. How analysis works
Files are processed on the Avert server using deterministic statistical methods to identify unusual values and produce estimates and recommendations. After analysis, Avert attempts to delete the original file from operational storage; if deletion cannot be confirmed, the application displays a warning and lets the user retry from history. The report and required metadata remain available for the plan's history period. The analysis currently described in the application does not send file contents to a generative artificial-intelligence service.
Results are provided as support and do not replace human review or professional advice. Avoid uploading unnecessary personal data or special-category data.
5. Providers and recipients
Data may be processed by providers acting on the controller's behalf and only for service-delivery purposes. The application uses Supabase for authentication, database, and private file storage, Stripe to start test-mode checkout, and providers needed to host and distribute the application. Stripe receives the information needed for the checkout session; this test integration does not request or collect real payments.
Providers are required to protect data and process it under applicable agreements. Data may be disclosed to public authorities where required by law or necessary to protect rights and safety.
6. Transfers outside the European Economic Area
The actual data location depends on provider and project configuration. Before publication, the controller must verify and specify hosting regions and any applicable international transfers. Where personal data is transferred outside the European Economic Area, GDPR safeguards will be used where applicable, such as an adequacy decision or standard contractual clauses.
7. Retention and deletion
After each completed analysis, Avert attempts to delete the original file from operational storage; if deletion fails, the user receives a warning and can retry. Reports and metadata are available in history for 30 days on Base, 12 months on Team, and 24 months on Premium; access to history is restricted after that period according to the plan. The history cutoff does not currently delete database records automatically: a permanent deletion process and its timing must be defined before commercial launch. Account and organization data are retained for the duration of the relationship and as needed for security and legal obligations.
To request access, rectification, or deletion, or to close your account, contact [PRIVACY EMAIL TO BE CONFIGURED]. Residual backup copies may remain for a limited period under normal technical cycles, unless a different legal obligation applies. The controller must define and implement an actual retention period before commercial launch.
8. Security measures
Avert uses technical and organizational measures intended to protect data, including organization-scoped access controls, private storage, authentication, file validation, and request limits. No system can guarantee absolute security; users should keep credentials confidential and promptly report suspected unauthorized access.
9. Cookies and sessions
Avert uses cookies and session mechanisms strictly necessary for authentication and continuity of access. If you start a test checkout, your browser is redirected to a Stripe-hosted page, which is subject to the provider's privacy notices and technologies. Avert does not state that advertising or profiling cookies are used. Before enabling real payments, this policy will be updated to describe the processing and any required consent mechanisms.
10. Your rights
In the cases and subject to the limits set by the GDPR, you may request access to personal data, rectification, erasure, restriction, and portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Send a request to [PRIVACY EMAIL TO BE CONFIGURED]. We may ask for reasonable information to verify your identity. If you believe processing violates applicable law, you may lodge a complaint with the competent supervisory authority, in Italy the Italian Data Protection Authority (Garante per la protezione dei dati personali), or the authority where you live or work.
11. Children's data and updates
Avert is intended for organizations and is not designed for direct use by children. Do not upload children's data unless strictly necessary, lawful, and covered by an appropriate legal basis.
This policy may be updated to reflect changes to the service or law. The current version and revision date are published on this page. Material changes will be communicated where required by law.