Data handling
Last updated September 23, 2026
Store facts, your instructions, approved work, and verified results have separate records. Avaura uses those records to explain what happened without treating an estimate as a result.
What the service handles
Depending on the connection and enabled feature, Avaura handles account and business membership details; authorized product, inventory, and order facts; merchant-provided business context; public demand evidence; proposals and approvals; operation receipts; billing references; and support correspondence. Available information depends on the permissions actually granted, not every permission a platform offers.
Minimizing store data
Commerce adapters use endpoint and field allowlists. Avaura does not need a store owner’s Shopify or WordPress password. Analytics adapters are designed to omit customer names, email addresses, phone numbers, and addresses rather than collect them merely to calculate business metrics. Please keep sensitive personal information out of free-text questions and support messages.
Browser storage and dictation
The browser holds session credentials and interface preferences needed to use the app. The authoritative business records and store credentials are server-side. If you choose dictation, microphone permission is requested and audio is sent for transcription; the resulting text stays editable before you send it. Do not dictate secrets or sensitive customer information.
Service providers
Cloudflare provides application infrastructure and enabled transcription. Supabase provides authentication and database services. Fastmail handles email. Shopify and the merchant’s WooCommerce installation provide the connections the merchant authorizes. Commercial evidence comes from the authorized store and supported merchant context. Payment processing, when available, follows the provider shown at purchase; Avaura does not collect card numbers or security codes in its app. See Service providers and their roles.
Access, correction, export, and deletion
Contact privacy@avaura.io to make a request. Avaura verifies identity, business authority, and scope before disclosing or changing records. A request is not a completed export or deletion. We distinguish store disconnection, subscription cancellation, account closure, and data deletion; one does not automatically perform the others.
Retention and legal preservation
Some evidence may need to remain for a specific security, billing, dispute, or legal purpose after operational access ends. Final category-specific retention periods and deletion procedures are still under review. No blanket promise of immediate deletion, permanent retention, or a particular backup recovery time is made here.
This operational explanation supplements, and does not replace, the Privacy Policy.