Avio

Last updated October 7, 2026

Privacy Policy

Draft for the owner to review before the Google OAuth app is published.

VINICIUS BOROTO DOS ANJOS DESENVOLVIMENTO DE PROGRAMAS DE COMPUTADOR SOB ENCOMENDA LTDA (CNPJ 67.847.587/0001-40, Brazil) runs Avio and controls your personal data under Brazil's data protection law (LGPD, Lei 13.709/2018).

What we collect

  • Your Google account: email, name and picture, from the Google sign-in. We ask Google for nothing else, and we drop Google's tokens before saving the sign-in, so we can't read your Gmail, Drive or anything else there. A bot can reach your Gmail only if you log in to it yourself in the bot's browser.
  • Your site: the address you type, the text our reader extracts from its public page (title, description, visible text), and the summary and interview questions it writes from that. It is saved before you sign in, with a keyed hash of your network address that limits how many sites one visitor can read an hour.
  • Your interview answers: the pain you tap and the follow-up you pick or type.
  • Your bots: their chats, notes, schedules and the logins you make in their browser live on your own machine's disk, not in our database. Your messages pass through our API to reach it. We keep what the panel needs: the bot list, which finished turns rang the bell, the model cost counted for the free run, and each bot's plan (its steps and rules).
  • Model calls: what your bots read and write goes to a model provider to be answered. Before a bot's browser sends something (a post, a form, a message), a second, faster model reads that request, with the bot's brief and plan, and decides whether to ask you. Each request and the verdict are logged on your machine's disk and listed on the bot's page.
  • Payment: Stripe holds your card. We store the Stripe customer and subscription ids and your plan.
  • Logs: our servers log requests and errors, with the time and the route. Cloudflare keeps them.

Why

To run the service you signed up for (LGPD art. 7, V), to bill you, to keep the service secure and fix errors (legitimate interest, art. 7, IX), and to meet legal duties such as tax records (art. 7, II). We don't sell your data, show ads, or train models on it.

Where it lives and who processes it

  • Cloudflare: hosts the panel, the API, our database and the logs.
  • box.ascii.dev: runs your machine. Its disk holds your bots' chats, notes, browser and logins.
  • OpenRouter: answers your bots' model calls and the site reader's, and gives each founder a model key with a monthly spending cap. Avio picks the models; you bring no key of your own.
  • Google: sign-in.
  • Stripe: payments.

A bot's browser visits the sites it needs, and it is logged in only where you logged in. Those sites see the bot as you.

These providers keep data outside Brazil, mostly in the United States and Europe. We transfer it under their standard contractual terms (LGPD art. 33).

Nothing goes out in your name unasked

A bot asks you before it sends, posts, pays or deletes, and shows the exact draft. A second model checks each action against the bot's brief and what you already approved, and you are asked about anything outside it. If you tap "Always allow" for a kind of action on a bot, that bot does it without asking until you turn it back, and each one is listed on its page.

Cookies

Signing in sets a short-lived cookie on api.avio.run to finish the Google handshake. After it the panel keeps your session token and a few settings in your browser's storage. We use no advertising cookies, no tracking cookies and no analytics.

How long

As long as your account exists. We mark records deleted instead of erasing them. When you delete your account in Settings, we delete your machine and its disk, revoke your model key, end your sessions and cancel your subscription. The account, your business and its site reading stay in our database, marked deleted. We keep billing records for as long as tax law requires. Email us and we'll erase the rest within 30 days.

Your rights

You can ask to see, correct, export or delete your data, or withdraw a consent you gave. Write to viniciusdosanjos63@gmail.com and we'll answer within 15 days. You can also complain to Brazil's data protection authority, the ANPD.

Changes

If we change this policy in a way that matters, we'll email you before it applies.