Privacy Policy

1.1 Customers are the businesses that install Amvio in their product, and the people at those businesses who use the Amvio dashboard. For customer account information, Amvio is the controller.

1.2 End usersare the people who use the Amvio assistant inside a customer's product. For end user information, the customer is the controller and Amvio processes it on the customer's behalf and under the customer's instructions. End users can find a plain-language summary in our notice for end users.

1.3 Visitors are people who browse our website or request a demo.

2.1 Account information: name, email address, password (stored by our authentication provider), the organisation and workspace you create, and the people you invite.

2.2 Configuration:the description of your product and its users, and the settings that shape the assistant's behaviour, such as its tone, subjects it should avoid, and how it responds when it does not know an answer.

2.3 Knowledge content: documentation pages you ask Amvio to index, files you upload, and text you provide.

2.4 Usage and technical data: IP address, browser and device information, and logs of requests to the service.

3.1 Conversations: transcripts of what the end user says or types and what the assistant replies, the pages the end user visits during the session, and a summary of each session.

3.2 Voice: before the assistant asks for the microphone, it shows the end user a notice explaining that the microphone is used, whether the conversation is recorded, and how long recordings are kept, with a link to a privacy notice chosen by the customer. The end user can continue with voice or type instead. If they continue and allow the microphone, their voice is processed in real time, and the time they accepted the notice, with the wording and language they were shown, is stored with the session.

3.3 Screen:if the customer allows screen sharing and the end user chooses to share through their browser's screen-sharing prompt, images of the shared screen are processed in real time so the assistant can see what the user is looking at. Customers can turn screen sharing off, or allow it only on specific pages of their product; sharing stops automatically when the user moves to another page. Without sharing, the assistant receives only the address of the current page.

3.4 Recordings:unless the customer turns recording off, the session's audio (the end user and the assistant) is recorded while the microphone is in use, together with a video of the screen if it is shared. While a session is recorded, or the screen is shared, the assistant shows an indicator at the top of the page, and the end user can stop sharing their screen from it at any time. Recordings are made available to the customer for playback. Sessions conducted by typing only are not recorded.

3.5 Identity: account and user identifiers, and optionally a name and email address, when the customer provides them through a signed call from its own servers. Without that call, sessions are not linked to a named person.

3.6 Device identifier:unless the customer turns it off, a random identifier stored in the browser's local storage so the assistant can recognise a returning visitor within that customer's product, and a first name if the end user shares one. When it is turned off, the identifier is kept only until the browser tab closes.

3.7 Derived information: which parts of the product people find difficult, questions the documentation does not answer, how sessions went, and indicators of account health.

4.1 If you request a demo, we collect the name, email address and company details you enter. We also collect aggregate page-view statistics as described in section 11.

5.1 To provide the service:running the assistant, answering end users, indexing documentation, and producing the analysis and recordings shown in the dashboard. For customer information this is necessary to perform our contract. For end user information we act on the customer's instructions.

5.2 To secure and maintain the service: preventing abuse, diagnosing errors and investigating incidents, based on our legitimate interest in operating a secure service.

5.3 To communicate with you: service messages, invitations, support and responses to demo requests.

5.4 To comply with law: keeping records and responding to lawful requests.

5.5 We do not sell personal information, share it for cross-context behavioural advertising, use one customer's data to serve another customer, or use customer or end user data to train AI models.

5.6 Customers are responsible for establishing a lawful basis for the processing of their end users' information, including informing end users that sessions are recorded and obtaining any consent required before a session begins.

6.1 We share information with service providers that help us run Amvio. They are listed, with the information each receives, on our sub-processor page.

6.2 Googleprovides the AI models that power Amvio. It processes end users' voice, typed messages and shared-screen images during a session, conversation transcripts after a session, and customers' documentation for indexing.

6.3 Supabase hosts our database and file storage, including conversations, recordings, uploaded files and indexed documentation.

6.4 We may also disclose information where required by law, to protect our rights or the safety of others, or to a successor in a merger, acquisition or sale of assets, subject to this policy.

7.1 Amvio is currently operated from India and is in the process of incorporating. Our service providers process information in the United States and other countries.

7.2 Transfers of personal information from the EEA or the UK are covered by the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, incorporated into our Data Processing Agreement and required of our service providers.

8.1 Recordings are deleted automatically after the period the customer chooses (7, 30 or 60 days after the session; 60 by default). Transcripts, session summaries, derived information and knowledge content are kept for as long as the customer's workspace exists, unless the customer asks us to delete them sooner.

8.2 Customers may ask us at hello@amvio.ai to delete a conversation, a recording, all recordings for a workspace, or an entire workspace before then. Recordings can be deleted without deleting the related transcripts. We complete deletion requests within 30 days.

8.3 When an agreement ends, we delete customer data within 30 days of a written request and in any event within 90 days, except where the law requires us to keep it. Backups expire on our providers' standard cycle and are not used to restore deleted data.

8.4 Demo request details are kept for as long as needed to respond and follow up, and deleted on request.

9.1 Information is encrypted in transit and at rest. Access to customer data in the dashboard is restricted to members of the relevant organisation, and recordings and files are held in private storage and made available only through short-lived links. Our security page describes these measures in more detail.

9.2 If a personal data breach affects your information, we will notify you without undue delay and within 72 hours of becoming aware of it.

10.1 Depending on where you live, you may have the right to access, correct, delete or port your personal information, to restrict or object to its processing, and to withdraw consent. We will not treat you differently for exercising these rights.

10.2 California residents may request the categories and specific pieces of personal information we have collected, its sources, the purposes for collecting it and the categories of recipients; may request correction or deletion; and may use an authorised agent. We do not sell or share personal information as those terms are defined under California law, and we do not use sensitive personal information for purposes that give rise to a right to limit.

10.3 EEA and UK residentsmay complain to their data protection supervisory authority, or in the UK to the Information Commissioner's Office.

10.4 End users should contact the company whose product they were using, which controls their information. If you contact us, we will refer your request to that company.

10.5 Customers and visitors can contact us at hello@amvio.ai. We will verify your identity and respond within 30 days.

11.1 The dashboard uses cookies that are strictly necessary to keep you signed in. We do not use advertising or cross-site tracking cookies.

11.2 Our website and dashboard use Vercel Web Analytics to count page views. It does not use cookies and records the page, the referring site and approximate device and country information.

11.3 The Amvio assistant stores the device identifier described in 3.6 in the browser's local storage, and remembers that the end user accepted the notice described in 3.2. In the EU and UK, storing information on a user's device is subject to the same rules as cookies, so customers should include the assistant in their own cookie notice or consent mechanism where required, or turn the identifier off.

12.1 Amvio is a business service and is not directed at children. We do not knowingly collect personal information from anyone under 16. Customers should not deploy Amvio in products intended for children unless they have confirmed that doing so is lawful.

13.1 Amvio produces indicators such as account health for our customers' teams. These are informational and do not by themselves produce legal or similarly significant effects on any individual.

14.1 We will post any changes here with a new effective date. For material changes we will notify customers by email or in the dashboard at least 30 days in advance.