Privacy Policy

Data Controller and Processors

Avlana AG is the data controller for the personal data described in this Policy – that means we determine the purposes and means of processing. We use a number of processors (sub-processors) to help us run the service; they are listed under “Third Party Services” below and are bound by data processing agreements.

Avlana AG is based in Switzerland. We comply with the Swiss Federal Act on Data Protection (FADP) and apply the EU General Data Protection Regulation (GDPR) to all users, wherever they are located.

Where a business customer has a data processing agreement with us, that customer is the controller for the footage and project content it provides, and we process that content on its behalf and according to its instructions.

Personal Data

Personal data means any information related to an identified or identifiable natural person. You may find more details about the definition of personal data in Article 4 and Recital 30 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

We collect the following personal data when you use Ava:

Data Necessary for Our Service

After your registration with Ava, collecting and processing the personal data listed here is necessary for the performance of our Terms of Service:

We do not knowingly collect any other personal data except as stated above, so we encourage you not to provide sensitive personal information (e.g. relating to health, religion, or political opinions) beyond what is incidentally present in footage you choose to share with us.

AI Processing of Your Content

Ava uses a mix of AI models to power the editing pipeline. Speech recognition and the analysis of your video and audio (for example shot detection, speaker detection and on-screen text recognition) run on models we host ourselves on Google Cloud in the EU. Your source footage is processed only by these models.

For analysis, edit planning and review, data derived from your footage – transcripts, clip descriptions, your prompts and revision notes, a limited number of still frames, and short audio extracts – is sent to managed models through Microsoft's Azure AI foundry and Google Cloud Vertex AI. Both process this data in the EU. Full source video files are never sent to an external AI provider.

This is inference only: we do not use your prompts, footage, or generated content to train or fine-tune any AI models, and the terms of our AI providers prohibit them from doing so. To detect abuse of their services, Microsoft and Google may retain the data they receive for up to 30 days, within the EU.

Only the AI providers named in this Policy receive your content. If we change an AI model, we stay within these providers and locations; adding a provider is a change to our sub-processors.

Support, Debugging and Business Operations

We use AI tools from Anthropic and OpenAI to help us support you, investigate and fix problems, and run our business. For this purpose, these providers may process our application logs, your account and project data, and content derived from your footage, such as transcripts, briefs and outlines. They never receive your footage or other media files and may not use this data to train their models. Anthropic processes it in the United States; OpenAI stores it in Europe but may process it in the United States. Both are subject to Standard Contractual Clauses.

These tools work only through dedicated, read-only access. If your organization has agreed restricted data handling with us, its data is technically excluded from this access, and neither provider receives any of it.

Optional Features

Some features use additional providers. They receive data only when you use the feature:

• AI voice narration – ElevenLabs receives the narration script and generates the voice-over.
• AI footage extension – fal and Higgsfield receive your prompts and selected still frames or short clips to generate additional footage; ElevenLabs may receive voice samples where a voice is recreated.
• Reference videos – when you add a link to a public Instagram video as a reference, Apify downloads that video and receives the link.
• Stock footage – stock footage directories receives search terms derived from your brief, but no footage or personal data.

These providers may process data in the United States, subject to Standard Contractual Clauses. For organizations with restricted data handling, these features are disabled unless agreed otherwise in writing.

Providing Your Footage

You can bring footage into Ava either by uploading it directly, or by sharing a Google Drive folder with an Avlana service account. If you use Google Drive, this grants us read access to the files in that folder so our pipeline can import them; you control that access from your own Google Drive at all times and can revoke it by removing the share.

Third-Party Application Access (including MCP)

Ava can be used through the Model Context Protocol (MCP) and other integrations that let AI agent tools and third-party applications request limited, scoped access to your Ava account on your behalf, using an OAuth authorization flow. When a third-party application requests access, we show you exactly what it is asking for (the requested scopes) and ask you to sign in and approve or deny the request before any access is granted. We do not share your data with a third-party application unless you explicitly approve that request. To revoke access you have previously granted, contact us at tech@avlana.co.

Mailing

If you sign up for our newsletter or request a demo, we use Brevo (Sendinblue) to send you emails – including a welcome email and, where you've opted in, product updates and marketing. You can unsubscribe using the link in our emails or by contacting us.

Statistical Data

Before you register with Ava, we process only aggregate, non-identifying statistical data about site usage.

Personal Data Disclosure

We will not disclose or share your personal data with third parties except:

If you are a paying customer, your payment details are handled directly by Stripe, our payment processor – we do not receive or store your full card details.

We do not sell your personal data.

Personal Data Storage and Transfer

Our infrastructure – compute, database, storage and authentication – runs on Google Cloud (Germany and the Netherlands) and Supabase (Germany), and the AI providers of our editing pipeline process your content in the EU. Data leaves the EU/Switzerland only for the purposes described above: support and operations tooling (Anthropic, OpenAI), optional features you use, payments (Stripe), and our email and file storage (Google Workspace, which stores this data in Europe but may process it elsewhere). Where data is processed outside the EU/Switzerland, this is subject to appropriate safeguards such as Standard Contractual Clauses (SCCs). Our services use TLS encryption in transit and encrypt stored data at rest.

Third Party Links

This website may contain links to third party websites, which are governed by their own privacy policies. We are not responsible for their content or practices.

Third Party Services

Children

Our website is not intended for children under 18. If a child has provided personal data, a parent or guardian can contact us to request deletion.

Your Data Protection Rights

Whether you are located in Switzerland, the EU/EEA, or elsewhere, we extend the following rights to you under the GDPR and the Swiss Federal Act on Data Protection (FADP):

• Right to access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object

You may also withdraw your consent at any time. If you are in Switzerland, you can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC). If you are in the EU/EEA, you can lodge a complaint with your local data protection supervisory authority.

Updating and Definitions

We may update this Privacy Policy periodically. Please check this page for the latest version.

Data Retention

We keep your account, footage and projects for as long as you use Ava; you can delete projects yourself at any time. When you ask us to delete your data, or your contract ends, we delete your active data within 30 days. Our backups and logs expire on their own schedules, so that no copy we manage remains 60 days after your request. Residual copies at our infrastructure providers are deleted under their own deletion processes.

Data Deletion Request

If you wish to have all your data removed from our servers, you can do so by requesting it via email to tech@avlana.co.

Cookies

We use essential cookies to keep you signed in, and analytics cookies (via PostHog, see above) to understand how the service is used. We do not use advertising or remarketing cookies. You can control or delete cookies through your browser settings, though this may limit some functionality.

Do Not Track

We do not support Do Not Track but respect this Privacy Policy.

Contact

If you wish to access, correct, or delete your personal data, please contact: tech@avlana.co

Data Protection Authority