Privacy policy

This is Aven’s current operational privacy notice. It explains how Aven handles personal data under UK GDPR and the Data Protection Act 2018. Aven is UK only. This notice is not legal advice; Aven maintains a separate legal and supplier review gate for real-client processing.

Who we are

Aven is an early-stage project operated under the trading name Aven HQ by an individual based in the UK. It is not yet incorporated as a company, so there is currently no company number or registered office. The data controller is the individual operating Aven HQ. Contact: hello@avenhq.com. We will update this notice if and when Aven incorporates.

What we collect

• Account details you provide - name, work email, and company information.
• Eligibility & Readiness answers and the readiness scores derived from them.
• Engineering metadata and text from tools you connect (commit, pull-request and ticket text and metadata). We never store your source code - see Data handling.
• Payment and billing details, processed by our payment provider (Stripe). We do not store card numbers.
• With your consent, product and web analytics data through PostHog and Vercel, plus advertising measurement data through Google Ads and LinkedIn Insight. This can include page and referrer URLs, browser or device information, shortened IP-derived information, consented identifiers, and conversion events. Aven does not intentionally include source code, evidence-pack contents, or HMRC identifiers in those events.
• Guided-session messages are kept in your browser tab. Aven processes a message transiently to reduce it to a generic workflow intent; Anthropic receives that generic intent and categorical card availability, not the client facts held in your working file.
• Evidence-assistance requests to the Anthropic API may include project names and summaries, redacted evidence excerpts, recorded interview questions and responses, or an unsaved draft testimony response, depending on the feature you use.
• Internal narrative-drafting and critique requests may include project names, redacted evidence excerpts, recorded testimony and current draft narrative sections.
• Messages you send us (e.g. by email).

How we use it, and our legal bases

• To provide the service and assemble your evidence pack - performance of a contract.
• To secure, operate, debug and improve the service - legitimate interests.
• Product analytics, advertising measurement, Matched Audiences, and other non-essential tags - consent (see Cookies).
• To meet legal, accounting and tax obligations - legal obligation.

We do not sell your personal data. Aven does not train an Aven model on client working-file data. Anthropic’s published standard API policy describes deletion of inputs and outputs within 30 days, subject to stated exceptions. Aven verifies the provider contract and configuration that apply to this service through its legal and supplier review. We do not promise a shorter external-provider retention period or a model-training exclusion here.

Sharing & sub-processors

We share data only with service providers that help us run Aven, under contract: Supabase (database, authentication, storage; UK/EU region), Vercel (hosting and consented web analytics), Stripe (payments), Resend (transactional email), PostHog (consented EU-region product analytics), Google Ads and LinkedIn Insight (consented advertising measurement, with LinkedIn Matched Audiences), and Anthropic (AI processing through its API behind deterministic and human review gates). Guided-session assistant requests contain generic workflow intent and categorical card availability. Separately, tailored-question requests may contain project names, project summaries and redacted evidence excerpts; optional follow-up requests may contain the project name and recorded interview responses; and “Tidy my draft” sends the question and unsaved draft testimony selected by the user. Internal narrative drafting and critique may also send the project name, redacted evidence, recorded testimony and current narrative sections. When you connect a repository we act as your data processor under a Data Processing Agreement.

International transfers

Core application records are hosted in the UK/EEA. A service provider, including Anthropic, may process a request outside the UK/EEA. An appropriate contractual safeguard is required for that transfer. Aven verifies the exact transfer mechanism and provider data terms through its legal and supplier review.

Retention

We keep account and engagement records for as long as your account is active and as required for legal, tax and accounting purposes, then delete or anonymise them. Disconnecting a tool immediately erases our local OAuth credentials and re-ingestable connector cache. Audit records and evidence already incorporated into controlled or released work may be retained where the engagement or law requires it. Repository and page selections are company-level processing instructions reused for current and future packs, including Annual monitoring, until you clear them or disconnect. You can ask us to delete your data at any time.

Your rights

Under UK GDPR you have the right to access, correct, export (portability), restrict, object to, and erase your personal data, and to withdraw consent. To exercise any of these, email hello@avenhq.com. You can also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to resolve it first.

Security

Stored OAuth tokens are encrypted before database storage using AES-256-GCM, with the key held separately as a restricted deployment secret; tokens are never logged. Data is isolated per company with row-level security, and integrations are read-only. See Data handling for detail.

Changes & contact

We’ll update this notice as the service and our company details evolve, and note the date above. Questions: hello@avenhq.com.