Privacy Policy

We collect only what we need to respond to you and run our business.

• Information you give us: your name, work email, company, team size, and anything you write in the contact form or in email.
• Engagement records: statements of work, meeting notes, invoices, and correspondence created while working together.
• Website usage: pages visited, referring site, device and browser type, and approximate location derived from your IP address, collected through privacy-respecting analytics without cross-site tracking.
• Cookies: a small number of strictly necessary cookies for security and to remember preferences such as a dismissed banner. We do not use advertising cookies.

• To reply to enquiries and schedule and run calls you ask for.
• To scope, deliver, and invoice engagements.
• To understand which parts of the site are useful and fix what is not.
• To meet legal, accounting, and security obligations.

We do not sell personal information, and we do not use it to train machine-learning models.

We share personal information only with service providers that help us operate, and only as far as they need it to do so. These currently include email and calendar hosting, analytics, accounting, and cloud infrastructure providers. Each is bound by a contract that limits its use of the data to providing the service to us.

We may also disclose information when required by law or to protect the rights, safety, or property of Averava, our clients, or others.

During an engagement we may access documents, tickets, records, and other data belonging to your organisation. That access is governed by your engagement agreement, and by default:

• Data stays in your environment. We work inside your accounts and repositories rather than copying data to ours.
• Access follows least privilege and is removed when the engagement ends.
• We never use your data to train models, and we configure third-party model providers so they do not either.
• A written security review happens before anything we build touches production.

Where a client asks us to process personal data on its behalf, we act as a processor under the client's instructions and sign a data processing agreement on request.

Enquiries we do not pursue are deleted within 12 months. Engagement records are kept for the life of the relationship and for as long afterwards as tax and contract law require, typically seven years. Analytics data is aggregated and does not identify you after 14 months.

Depending on where you live you may have the right to access, correct, delete, or export the personal information we hold about you, to object to or restrict certain processing, and to withdraw consent where processing is based on it. To exercise any of these, email us at the address below. We answer within 30 days and never charge for a reasonable request.

If you are in the European Economic Area or the United Kingdom you also have the right to lodge a complaint with your local data protection authority.

We protect personal information with access controls, encryption in transit and at rest, hardware security keys for our own accounts, and regular review of who has access to what. No method is perfect, so if you believe your information has been compromised, tell us and we will investigate promptly.

We will post any changes to this policy on this page and update the date at the top. If a change materially affects how we use information we already hold, we will tell you directly where we can.

Questions, requests, and complaints go to averavaai@gmail.com.