Privacy policy

This is Aven’s current operational privacy notice. It explains how Aven handles personal data under UK GDPR and the Data Protection Act 2018. Aven is UK only. This notice is not legal advice; Aven maintains a separate legal and supplier review gate for real-client processing.

Who we are

Aven is an early-stage project operated under the trading name Aven HQ by an individual based in the UK. It is not yet incorporated as a company, so there is currently no company number or registered office. The data controller is the individual operating Aven HQ. Contact: hello@avenhq.com. We will update this notice if and when Aven incorporates.

What we collect

• Account details you provide - name, work email, and company information.
• Founder-review request details: your role, engineering-team size, previous R&D claim status, accounting-period timing, contact preference, optional phone number and anything you choose to add in the message field. This form does not ask for source-code access or detailed claim evidence.
• Eligibility & Readiness answers and the readiness scores derived from them.
• Engineering metadata and text from tools you connect (commit, pull-request and ticket text and metadata). We never store your source code - see Data handling.
• Payment and billing details, processed by our payment provider (Stripe). We do not store card numbers.
• With your consent, product and web analytics data through PostHog and Vercel, plus advertising measurement data through Google Ads and LinkedIn Insight. This can include page and referrer URLs, browser or device information, shortened IP-derived information, consented identifiers, and conversion events. Aven does not intentionally include source code, evidence-pack contents, or HMRC identifiers in those events.
• Guided-session messages are kept in your browser tab. Aven processes a message transiently to reduce it to a generic workflow intent; Anthropic receives that generic intent and categorical card availability, not the client facts held in your working file.
• “Ask Aven” site-assistant messages (the optional chat widget on public pages) are kept in your browser tab only. Each message you send is processed transiently by Aven and by Anthropic to generate the answer; Aven does not store these messages and does not include their text in analytics. The widget asks you not to include personal details, and messages containing contact or account identifiers are answered with fixed guidance instead of being sent to the AI provider.
• Evidence-assistance requests to the Anthropic API may include project names and summaries, redacted evidence excerpts, recorded interview questions and responses, or an unsaved draft testimony response, depending on the feature you use.
• Internal narrative-drafting and critique requests may include project names, redacted evidence excerpts, recorded testimony and current draft narrative sections.
• Messages you send us (e.g. by email).

How we use it, and our legal bases

• To review and reply to a founder-review request, take steps you ask for before a contract, and keep a limited sales follow-up record - legitimate interests and, where applicable, steps at your request before entering a contract.
• To provide the service and assemble your evidence pack - performance of a contract.
• To secure, operate, debug and improve the service - legitimate interests.
• Product analytics, advertising measurement, Matched Audiences, and other non-essential tags - consent (see Cookies).
• To meet legal, accounting and tax obligations - legal obligation.

We do not sell your personal data. Aven does not train an Aven model on client working-file data. Anthropic’s published standard API policy describes deletion of inputs and outputs within 30 days, subject to stated exceptions. Aven verifies the provider contract and configuration that apply to this service through its legal and supplier review. We do not promise a shorter external-provider retention period or a model-training exclusion here.

Sharing & sub-processors

We share data only with service providers that help us run Aven, under contract: Supabase (database, authentication, storage; UK/EU region), Vercel (hosting and consented web analytics), Stripe (payments), Resend (transactional email), PostHog (consented EU-region product analytics), Google Ads and LinkedIn Insight (consented advertising measurement, with LinkedIn Matched Audiences), and Anthropic (AI processing through its API behind deterministic and human review gates). Guided-session assistant requests contain generic workflow intent and categorical card availability. Site-assistant (“Ask Aven”) requests contain only that widget’s conversation. Separately, tailored-question requests may contain project names, project summaries and redacted evidence excerpts; optional follow-up requests may contain the project name and recorded interview responses; and “Tidy my draft” sends the question and unsaved draft testimony selected by the user. Internal narrative drafting and critique may also send the project name, redacted evidence, recorded testimony and current narrative sections. When you connect a repository we act as your data processor under a Data Processing Agreement.

Aven evidence review and optional adviser introductions

During the free evidence-readiness journey, authorised Aven operators review the company details, accounting period, source scope, engineering metadata, evidence preview and visible gaps to provide the requested service. This is an internal Aven review. No accountant or tax firm receives the preview, pack or personal data merely because the company starts the scan, requests review, accepts an offer or pays for a pack.

After a pack is released, the company may separately ask Aven for an adviser introduction. Aven records that request and confirms the proposed recipient and scope before any pack or working-file data is shared. The receiving adviser then acts under its own privacy notice and separate engagement. Every authorised share records what was sent, to whom, when and on whose instruction. Source code is never stored or shared.

International transfers

Core application records are hosted in the UK/EEA. A service provider, including Anthropic, may process a request outside the UK/EEA. An appropriate contractual safeguard is required for that transfer. Aven verifies the exact transfer mechanism and provider data terms through its legal and supplier review.

Retention

Founder-review requests and their follow-up history are kept only while the opportunity is active and for a limited period afterwards for continuity, suppression and business-record purposes, then deleted or anonymised when no longer needed. You can ask us to delete a request at any time. Where a request becomes a client engagement, the engagement retention rules below apply. We keep account and engagement records for as long as your account is active and as required for legal, tax and accounting purposes, then delete or anonymise them. Disconnecting a tool immediately erases our local OAuth credentials and re-ingestable connector cache. Audit records and evidence already incorporated into controlled or released work may be retained where the engagement or law requires it. Repository and page selections are company-level processing instructions reused for current and future packs, including Annual monitoring, until you clear them or disconnect. You can ask us to delete your data at any time.

Your rights

Under UK GDPR you have the right to access, correct, export (portability), restrict, object to, and erase your personal data, and to withdraw consent. To exercise any of these, email hello@avenhq.com. You can also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to resolve it first.

Security

Stored OAuth tokens are encrypted before database storage using AES-256-GCM, with the key held separately as a restricted deployment secret; tokens are never logged. Data is isolated per company with row-level security, and integrations are read-only. See Data handling for detail.

Changes & contact

We’ll update this notice as the service and our company details evolve, and note the date above. Questions: hello@avenhq.com.