This policy explains what Second Spring Design Inc. (doing business as Aventide) collects, why, who we share it with, how long we keep it and the choices you have. It covers our website (aventide.ai), the Aventide app (app.aventide.ai) and the pages your clients use, such as client portals and signing, booking, payment and form pages.

Questions? Email support@aventide.ai.

The short version

• We use your information to run Aventide for you. We don’t sell it, and we don’t use it for ads.

• When you put information about your own clients into Aventide, we handle it for you, as your service provider (Section 1).

• Are you a client of a business that uses Aventide? Start with Section 2.

• Aventide’s AI runs on Anthropic’s Claude models, served by Anthropic or, through Vercel’s AI Gateway, by Amazon Bedrock or Google Vertex AI. None of them uses your data to train models, and Aventide doesn’t either.

• If you connect Google, we use that data only for the features you connect, under Google’s Limited Use rules (Section 6).

• We keep your information while your account is open. To have it erased, email us and we’ll do it within 30 days (Section 12).

1. Who we are and our two roles

Second Spring Design Inc. is a Delaware corporation doing business as Aventide (“Aventide”, “we”, “us”). Our address is 522 W Riverside Ave, Spokane, WA 99201-0580. You can reach us at support@aventide.ai.

Aventide is for businesses and professionals. It isn’t meant for personal or household use, or for anyone under 18.

We play two roles:

• For our users. For people who sign up for Aventide, their teammates and visitors to our website, we decide how information is used. This policy explains how.

• For our users’ clients. Our users put information into Aventide about their own clients and contacts. That includes people who sign their agreements, book with them, fill in their forms, pay their invoices, email them or join their meetings. For that information, we act on the user’s behalf as their service provider (also called a “processor”). We use it only to run Aventide for them, as our Data Processing Addendum sets out. The user is responsible for having the right to put it into Aventide, and for giving their clients any notice the law requires.

2. If you’re a client of a business that uses Aventide

A business may use Aventide to send you proposals, agreements, invoices, booking pages, forms, a client portal or email. That business decides what information about you goes into Aventide and how it’s used, and its own privacy policy applies. We store and process the information for them.

What we may hold about you. It depends on what the business uses:

• Contact details: your name, email, phone number and company.

• Client portal: your email address, the sign-in links we send you (they expire after 7 days), your signed-in session (up to 90 days), and which documents you open or download.

• Proposals and shared documents: when you open a document the business shared with you. When you accept a proposal online, we keep your typed name (if you give one), a scrambled (hashed) version of your IP address and your browser details.

• Agreements you sign: see “E-signatures” below.

• Bookings: your name, email, notes, time zone and the booking details.

• Forms and inquiries: your answers. For an inquiry form, also your phone number and message, the wording of any marketing consent you gave, a hashed version of your IP address, your browser details and the page you came from. The business can choose to send its form submissions on to its own systems.

• Invoices and payments: your name, email, amounts, payment status, and when you open a payment page. Card and bank details are entered with the business’s payment provider (Stripe, or Intuit for QuickBooks) and stay with it.

• Email: if you email a business that has connected its Gmail, we keep the sender, subject and a short excerpt of your messages, and the business’s replies. If the business asks its AI assistant about one of your messages, what the assistant reads is kept in that conversation.

• Meetings: if the business brings in notes from a meeting tool, the transcript, speaker names and an AI summary.

• Notes about working with you: notes the business, or its AI assistant, keeps. Examples are how you like to be contacted, or a price or commitment you agreed.

AI. The business may use Aventide’s AI features on this information, for example to draft a reply or summarize a meeting. Our AI provider processes it only to provide those features. Our AI provider does not use your data to train its models under our API agreement; Aventide does not train models on your data.

Email from the business. Most emails the business sends through Aventide come from Aventide’s sending address, with the business’s name and reply-to address. Our email provider, Resend, delivers them. Replies to your emails may come from the business’s own Gmail, and invoices may be emailed by its Stripe or QuickBooks account.

Bot checks. Booking, inquiry and form pages use Cloudflare Turnstile to check you’re human. Cloudflare sees your IP address and browser signals for that check.

Your requests. To see, correct or delete your information, contact the business. If you contact us at support@aventide.ai, we’ll pass your request to the business within 5 business days.

E-signatures

When a business sends you an agreement to sign through Aventide, we keep a record as evidence for both of you. It holds:

• your name and email address;

• your typed signature;

• when you opened the agreement, agreed to sign electronically, and signed or declined (with any note you add);

• your IP address and browser or device details;

• a fingerprint (SHA-256) of the exact document you reviewed.

How we confirm it’s you: email-link authentication. The signing link is sent to your email address, and you confirm that address before you sign. If you’re signed in to the business’s client portal, that sign-in confirms it.

After signing, you and the business both get a signed copy by email, and you can still open it from your link. The record can’t be changed. We keep it with the agreement for as long as the business keeps its Aventide account, and it’s deleted when that account is deleted.

3. Information we collect

3.1 Your account

• Your name, email address, the businesses you set up, your plan and your billing status.

• Outseta runs sign-in and subscriptions and holds your password. We never store it.

• If you sign in with Google, we receive your name, email address and Google account ID.

• When you invite a teammate, their name and email address.

• What you send us when you ask for help.

3.2 What you put into Aventide

When you and your team use Aventide, we store what you put in or create:

• business details, goals, to-dos, offers, brand kit and documents;

• clients and contacts, and notes about them;

• proposals, agreements, invoices, expenses and payments;

• bookings, forms and the answers people send;

• meeting notes;

• files, including receipts, compliance documents and signed agreements;

• vault details, such as your EIN or business licence numbers;

• team chat messages;

• anything you import. For example, a HoneyBook import brings over contacts, clients, projects, tasks, notes, past messages, and invoice and contract history.

3.3 Your conversations with Aventide’s assistant

We save your conversations with the assistant (in Think and Sidekick, in the app, and on Telegram, WhatsApp or Slack) so you can come back to them and so the assistant has context. We also keep a log of what the assistant did for you, such as “sent an invoice”. Section 5 explains how AI processes them.

3.4 Services you connect

When you connect another service (for example Google, Stripe, QuickBooks, Zoom, Canva, a meeting-note tool or a social account), we store what’s needed to keep the connection working, such as access tokens, encrypted. We bring in the data the feature you’re using needs.

HoneyBook imports go through Vercel Connect, a sign-in service from our hosting provider. We never see your HoneyBook password, and we use the connection only to run the import you start.

3.5 Bank connections

Aventide is not a bank and never holds your money. If you link a bank account (where available), you sign in to your bank through Stripe Financial Connections, and Aventide never sees your bank login. From Stripe we receive:

• account balances;

• transactions (date, amount, description and status);

• the bank’s name and the account type;

• account identifiers (not your full account number).

We use this to show your cash and transactions in Money, to help you sort and match transactions in Books, and to answer your questions about them through the assistant. When you ask, our AI provider processes the transactions involved. We don’t use bank data for ads, sell it, give it to data brokers or use it to train AI. It’s stored in the United States.

When you disconnect, Stripe stops sharing new data. The transactions already in Aventide stay with your books until you ask us to delete them. Email support@aventide.ai and we’ll delete them within 30 days.

3.6 Payments and money

Your Aventide subscription is billed through Outseta, which uses Stripe. You enter your card details on their secure forms, and they never reach our servers. We keep your plan and billing status, and Outseta keeps your invoices. Stripe is certified PCI DSS Level 1.

When your clients pay you, the payment runs through your own Stripe account (connected with the Aventide Stripe App), or through a Stripe account we set up for you on our Stripe platform, or through QuickBooks Payments if you send the invoice through QuickBooks. Aventide takes 0% and never holds the money.

• We keep copies of your invoices, payments and payouts, and your customers’ names and emails, so Money can show them.

• The assistant can read them when you ask.

• Disputes and refunds are handled in Stripe.

• If you connect QuickBooks, we sync accounts, invoices and expenses with it, and can send your invoices through it.

3.7 Social publishing

If you connect social accounts, Aventide can publish to Facebook, Instagram, Threads, LinkedIn, TikTok and YouTube, and publish blog posts to WordPress and Framer sites, where each is available.

• What we store: encrypted access tokens, your profile name and picture, the posts you create, and how those posts perform.

• When we publish: content goes out only when you publish or schedule it, or approve the assistant’s draft.

• TikTok: we use TikTok’s Content Posting API with the user.info.basic and video.publish permissions, to post the videos you approve directly to your account.

• Disconnecting: access tokens are deleted when you disconnect.

3.8 Meeting notes

If you connect a meeting-note tool (Granola, Fireflies, Google Meet where available, or another tool by webhook), we import the transcript, speaker names and meeting details, and write a summary with AI. Up to 150,000 characters of a transcript go to our AI provider. Section 12 says how long we keep transcripts. If you record meetings, or upload or send Aventide a recording, you’re responsible for telling the people in them and getting any consent the law requires.

3.9 Files and videos

We store the files you upload or create, such as:

• chat attachments and Business Hub files;

• client documents and workspace files;

• receipts and compliance documents;

• signed agreements;

• photos and videos, including videos you bring in from Riverside (where available).

Who can open them. Files are private to your business. They open only for your team, and for anyone you share them with. If you share a document by link, anyone with the link can open it until you turn the link off. Two exceptions: your logo, and some images you upload for social posts, are stored at public web addresses so your branded pages and social apps can load them.

When we read a file. We read a file’s contents only when a feature needs to. That means:

• making a preview;

• converting it, for example an iPhone photo or a phone video into a format social apps accept;

• sorting an upload;

• reading dates from a document you scan with Smart Compliance;

• answering a question you ask about it.

Uploads that never finish are discarded within 24 hours. Videos in your marketing Library stay until you delete them.

3.10 Voice dictation

ElevenLabs keeps a copy of the recording and the text in our account with them, under its data processing terms with us, and doesn’t use them to train its models.

3.11 Usage and device information

• When you use Aventide, we collect log and usage information: device and browser type, IP address, pages visited, features used and errors.

• Usage events are linked to your account so we can see how features are used and fix problems. We mostly look at them in aggregate, and look at one account’s usage and costs when we need to, for example to check costs or fix a problem.

• For rate limits on public pages, we store IP addresses only in a scrambled (hashed) form.

• When you open your vault, or reveal or copy a value in it, we log the time, IP address and browser.

3.12 Our website

Our website is hosted by Framer, and its sign-up, log-in and support tools come from Outseta. We use Google Analytics and Framer’s analytics to count visits, and two cookies that remember how you found us. Section 10 has the details.

4. How we use information

• To provide Aventide: sign you in, run the features you use, and send what you ask us to send.

• To run the AI features you use (Section 5).

• To keep your connections working, and to act in a connected service only as you ask.

• To publish only what you publish, schedule or approve.

• To message you: account and billing emails, setup emails during a trial, and messages in the apps you connect (Section 11).

• To support you when you ask for help.

• To keep Aventide secure: spot and stop fraud, spam and abuse, including bot checks and rate limits.

• To improve Aventide: look at how features are used, in aggregate. We may combine usage data from many customers into statistics that don’t identify anyone. We don’t try to re-identify anyone from them.

• To understand how people find us: website analytics and the how-you-found-us cookies (Section 10).

• To meet legal obligations, enforce our Terms and protect our rights.

5. How Aventide uses AI

Which AI. Aventide’s assistant and document tools run on Anthropic’s Claude models. That covers the assistant in Think and Sidekick, and on Telegram, WhatsApp or Slack. Requests go through Vercel’s AI Gateway (part of our hosting provider) or directly to Anthropic. The gateway may send a request to the same Claude models hosted by Amazon Web Services (Amazon Bedrock) or Google Cloud (Vertex AI), usually when that’s faster or Anthropic is busy.

What the AI sees. Only what the task needs. That can include:

• your messages;

• your Business Hub facts and goals;

• the client records, emails, meeting notes, agreements, invoices, bank transactions, Google data or files involved in what you asked.

For example, when you ask for a reply to an email, the email goes to Anthropic. When Smart Compliance scans a document for dates, the file does.

The vault. Items you lock in the vault are kept out of the assistant and document tools: Think, Sidekick, document runs and the daily brief. One exception, which you choose: when you ask Smart Compliance to scan a document, the file goes to Anthropic to read dates and ID numbers, even if it’s locked. Locking is an access setting, not extra encryption. If you unlock an item and lock it again, anything the AI already saw while it was unlocked stays where it is, for example in a past chat.

Web search. When the assistant searches the web for you, search terms based on your question go to Anthropic’s web search tool.

What it learns about how you work. Each night, Aventide reviews what you wrote to the assistant in the last 45 days (not its replies). It adds a summary of recent client, invoice, agreement, booking and time-tracking activity, and of the documents you’ve had Aventide make. It doesn’t read your email, calendar, bank data or meeting notes for this review. It notes things like how you like to communicate, and background about your clients:

• It saves preferences, and background notes about clients, on its own. You can see them in Memory and on each client’s card, and remove any of them: Forget on a preference, or Delete and then Confirm on a client note.

• It asks you first before it changes a fact about your business, a client’s prices or a commitment. It also asks whenever it isn’t sure who something is about.

• Meeting notes you import can also add notes about a client, under the same rules.

• It keeps a short running summary of your recent work, which the assistant uses for context.

  • That summary isn’t shown in the app yet. Email support@aventide.ai and we’ll send it to you or clear it.

• We tell it not to save passwords or keys, health information, or private details about your clients’ personal lives.

Training. Our AI providers don’t use your data to train their models: not Anthropic, and not Amazon Bedrock or Google Vertex AI when they serve the same Claude models. Aventide does not train models on your data. The same is true of information about your clients. Anthropic may keep requests for a limited time to run its service and check for misuse, as its commercial terms allow. Parts of a request can also sit in a short-term cache, for up to an hour, to speed up the next answer.

Your approval. The assistant asks you or a teammate before it:

• sends an email or message to anyone outside your team;

• posts to a social account;

• sends an agreement, an invoice or a payment request.

Some things happen without a separate approval:

• small changes you ask for in chat, like adding a to-do;

• things you’ve scheduled, like your daily brief;

• automatic messages you’ve turned on, like booking confirmations, or a deposit invoice that a contract is set to send when it’s signed;

• low-stakes steps you can change or undo, like saving a preference or sorting an upload.

No significant automated decisions. Aventide’s AI doesn’t make decisions about anyone that have legal or similarly significant effects.

6. Google user data

If you connect Google, Aventide asks only for the permissions each feature needs, and you choose which features to connect. Each connection also gives us your Google email address and basic profile, so we can show which account is connected.

Assistant conversations. When you ask the assistant about your email, calendar or site data, what it reads and what it answers become part of that conversation. We keep your conversations as Section 12 describes, and they’re private to you (Section 7). A daily brief we send to a messaging app also keeps a copy of the calendar events in it, and on Mondays its Search Console line.

How we use and share it. We use Google data only to provide the features above, which you can see and use in Aventide. To do that:

• Our AI provider, Anthropic, processes Gmail messages, calendar events and Search Console and Analytics figures when you ask for a draft, or ask the assistant something that needs them. Your headline search figures (28-day clicks, average position and the searches you watch) are also part of the background each new assistant conversation starts with, and your Weekly SEO insights use the fuller figures. Anthropic acts on our instructions and doesn’t use the data to train its models.

• If you use the assistant or get your daily brief on Telegram, WhatsApp or Slack, the assistant’s replies and your brief go through that app. That includes today’s calendar events in the brief, a line of Search Console figures in Monday’s brief, and any Google data you asked about.

• Our hosting and database providers store and process it for us.

Google data isn’t used for the nightly memory review (Section 5).

We don’t transfer Google data to anyone else, except:

• to comply with the law;

• to protect against fraud, abuse or security threats;

• as part of a merger, acquisition or sale of our company’s assets, and then only after getting your explicit permission first.

What we never do with Google data:

• use it for ads, including retargeting, personalized or interest-based ads;

• sell it;

• give it to advertising platforms, data brokers or information resellers;

• use it to decide whether you can get credit or a loan;

• use it to develop, improve or train AI or machine-learning models.

People. No one at Aventide reads your Google data unless:

• you ask us to, for specific data (for example, a message you point us to in a support request);

• it’s needed to investigate security or abuse;

• the law requires it;

• it has been aggregated and anonymized for internal operations.

How long we keep it.

• Gmail copies:

  • Bulk mail is deleted 90 days after it arrives.

  • Mail you’ve resolved or dismissed is deleted 180 days after you last touched it.

  • Mail you haven’t dealt with, or have replied to and are still waiting on, stays until you mark it done or dismiss it.

  • Attachments on replies you send are deleted once the reply goes out.

  • When you disconnect Gmail, Aventide stops reading and sending at once.

    • Stored copies aren’t all removed automatically when you disconnect. Email support@aventide.ai and we’ll delete them within 30 days.

• Search Console and Analytics: summaries are kept while you’re connected, and cleared when you disconnect. Weekly SEO insights documents and briefs we’ve already sent keep their figures until you delete them or ask us to.

• Calendar: nothing beyond the IDs of events Aventide created, plus what’s in your assistant conversations and the daily briefs we’ve sent you.

• Meet transcripts: as for other meeting notes (Section 12).

• Assistant conversations: as Section 12 describes.

• Access tokens: encrypted, and deleted when you disconnect.

Your control. Disconnect any Google service in Business Hub → Integrations (YouTube in Marketing → Channels), or remove Aventide at myaccount.google.com/permissions.

Limited Use. Aventide’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Teams: what’s shared and what’s private

Shared with everyone on your team, in that business:

• Business Hub facts, goals, documents and files;

• to-dos (assigning one to a teammate labels it; it doesn’t hide it);

• clients, Money, bookings, Marketing, Offers and Smart Compliance. The account owner can keep the vault’s business details (such as your EIN) to themselves, and stop teammates running Smart Compliance scans. Vault files and Smart Compliance deadlines stay visible to the team;

• business connections: Stripe, QuickBooks, Zoom, Search Console and Analytics, social accounts, and a shared team mailbox if you connect one;

• the shared credit balance and each person’s usage;

• the history of who did what on agreements, invoices and documents. A teammate’s name and email are recorded when they act, so the history still shows their name after they leave.

Private to you:

• your Think and Sidekick conversations, and the log of what the assistant did for you;

• your own Google Calendar, Gmail and Canva connections, your meeting-note tools and the transcripts they bring in. The AI summary of each meeting is saved as a business document, so your teammates can see it. Teammates see your calendar only as busy or free, and can’t read your email;

• what Aventide has learned about how you like to work.

Something you tell the assistant can become a shared business fact, but only after someone on your team approves it. Background notes about a client that the assistant picks up from your chats (such as how they like to be contacted) are saved to that client’s card without a separate approval, and your team can see them there.

8. What we don’t do

• We don’t sell personal information, and we don’t share it for cross-context behavioral (targeted) advertising.

• We don’t use your data, or your clients’ data, for advertising, and we don’t let advertisers access it.

• We don’t train AI models on your data or your clients’ data (Section 5).

• We don’t show one customer’s information to another customer, unless you share it (for example with a client).

• We use bank data only to run your Money and Books features, including when you ask the assistant about it.

• We use Google data only as Section 6 describes.

9. Who we share information with

We share information only in these ways:

• Service providers who run Aventide for us, under contracts that limit them to that work. The full, current list, with what each one does and where, is on our sub-processor page. We update it before we add one. The main ones:

  • Vercel: hosting, scheduled jobs, logs and routing AI requests (Vercel AI Gateway).

  • Supabase: our database and file storage, in the United States.

  • Anthropic: AI models (Claude).

  • Amazon Web Services (Amazon Bedrock) and Google Cloud (Vertex AI): backup hosts for the same Claude models, through Vercel’s AI Gateway.

  • Cloudflare: file storage and conversion, and bot checks.

  • Resend: email delivery, including emails to your clients.

  • ElevenLabs: turning voice dictation into text.

  • Outseta and Stripe: accounts, sign-in and billing for your Aventide plan.

  • On our website: Framer (hosting and visit counts) and Google (Analytics, fonts and the YouTube player for the video on our home page).

• Messaging apps you connect. If you use the assistant on Telegram, WhatsApp (from Meta) or Slack, your messages, daily brief and approval requests go through that app, and its own privacy policy applies.

• Services you connect, when you ask Aventide to do something there. These include:

  • Google, Stripe, QuickBooks and Zoom;

  • Meta (Facebook, Instagram, Threads), LinkedIn and TikTok;

  • WordPress, Framer, Canva and HoneyBook;

  • meeting-note tools such as Granola and Fireflies, and Riverside for videos;

  • any webhook address you add to your forms.

  Their own terms and privacy policies apply to what they receive.

• People you choose: your teammates, and your clients when you send or share something with them.

• For legal reasons: when the law requires it, or to protect the safety, rights or property of people, our users or Aventide.

• In a merger or sale: if our company is merged, acquired or sold, information can pass to the new owner, who must honor this policy. For Google data, we’d ask your permission first.

10. Cookies and similar technology

We use a small number of cookies and similar browser storage. Our Cookie Policy has more detail.

• Sign-in and security (always on).

  • Outseta keeps your sign-in token in your browser’s storage.

  • Cloudflare Turnstile checks you’re human on sign-in, sign-up, booking, inquiry and form pages.

  • Our sign-in and sign-up pages load Google’s sign-in button, so Google sees your IP address when the page opens.

  • Pages that can take a payment (public booking pages, plan checkout and parts of Money) load Stripe’s payment script, which sets Stripe’s own fraud-prevention cookies.

  • Short-lived cookies protect some setup steps, such as connecting Stripe.

• Preferences (always on). A cookie remembers light or dark mode for a year. Other app settings, unsent drafts and the email address you signed up with are saved in your browser’s storage.

• Client portals. Each portal has its own sign-in cookie, which lasts up to 90 days.

• Analytics on our website.

  • Google Analytics (_ga and _ga_* cookies, which last up to 2 years). In the EEA, UK and Switzerland, it runs only after you accept. Elsewhere, it’s on until you choose “Necessary Only”. Google’s advertising features are turned off.

  • Framer’s cookie-free visit counts.

  • Our sign-up page records a couple of steps (such as starting sign-up) against a random ID kept in your browser. If you go on to sign up, that ID is linked to your new account.

• How you found us. Two first-party cookies, av_attr and av_attr_last, last 90 days.

  • They record a general category for where you came from (for example “linkedin” or “newsletter”), the campaign name if the link you followed had one, and whether you landed on our home page, pricing page or another page.

  • They never hold full web addresses.

  • When you sign up, we save that information with your account. It isn’t shared with anyone.

  • They’re set when you visit, before you make a choice in the banner.

• Fonts. Our website, and Stripe’s checkout and Money screens inside the app, load fonts from Google Fonts, so Google sees your IP address.

• Videos. Our home page has a product video hosted on YouTube. Until you press play, only a still image loads, from Google’s servers. When you press play, YouTube’s player loads in privacy-enhanced mode and may store cookies or similar data in your browser.

We don’t use advertising cookies, and we don’t track you across other companies’ sites.

Your choices. Use the cookie banner on our website to accept, or choose “Necessary Only”. To see the banner again, clear your cookies. You can also block or clear cookies in your browser.

• Our website doesn’t act on Global Privacy Control (GPC) signals yet. We don’t sell or share personal information, so there’s nothing for GPC to opt you out of. Choose “Necessary Only” to turn analytics off.

11. Messages from Aventide and how to stop them

• Account emails. Sign-in links, billing, security notices and replies to your support requests are part of having an account.

• Notifications. Emails about activity in your business, such as a new booking, a form submission, a signed agreement, a storage warning or a booking calendar that needs reconnecting, are also part of having an account.

• Trial setup emails. During your free trial, we may send a few emails to help you get set up.

  • To stop them, reply “unsubscribe” or email support@aventide.ai.

• News and marketing. If we send you product news or marketing email, it will include a way to unsubscribe, and we’ll stop when you use it.

• Telegram, WhatsApp and Slack. Aventide messages you there only after you connect that app from the Sidekick panel. Your daily brief and approval requests can name your clients and amounts, so connect only an account you control. You can turn off daily brief delivery in Routines.

  • To stop all messages, choose Disconnect in the Sidekick panel, or block the Aventide bot in that app.

• No text messages. We don’t send text messages (SMS).

12. How long we keep information, and deleting it

We keep your information while your account is open. A few things are cleaned up automatically:

• Gmail copies, as Section 6 describes;

• site scans, after 90 days (your newest 20 are kept);

• uploads that never finish, within 24 hours;

• attachments on email replies, once the reply is sent;

• client portal sign-in links (they expire after 7 days, and we delete the record 30 days later) and portal sessions (they expire after 90 days, and we delete the record about 13 months later).

Everything else stays until you delete it or ask us to. That includes conversations, files, client records, meeting transcripts and history. If your plan or trial ends, we keep your data so you can come back, until you ask us to delete it.

Deleting. You can delete most items in the app:

• Some deletions are permanent right away, such as deleting a meeting note.

• Others hide the item but keep it in our database, such as deleting a conversation, a client or a business.

To have your account, a business or specific information permanently erased, email support@aventide.ai from your account’s email address. We’ll confirm the request, erase it within 30 days, and tell you when it’s done. For now, our team does this by hand.

When we erase an account, its signed agreements and their signing records go too. Before we do, we email the account owner a reminder to download any they want to keep. Both sides got a signed copy by email. Deleted data can stay in our database provider’s backups for up to 7 days, until they’re overwritten. We keep our own billing records, and anything else the law requires, for as long as required.

13. Security

• Where your data lives. Our database is with Supabase, on AWS in the United States. Files are stored with Supabase and Cloudflare R2. Our infrastructure providers encrypt your data in transit and at rest.

• Connection tokens. Access tokens for services you connect are kept encrypted: most in a separate secrets store, and a few, such as Slack tokens, encrypted by us with a key kept outside the database.

• Separation. Each business’s data is kept separate by our database rules and by checks on every request. The assistant goes through the same checks.

• Links. Files are served through signed links, and most links expire.

• Abuse protection. Sign-in and public forms are protected against bots and abuse.

• Staff access. Only a small number of authorized people can access production data, and only for support, security or legal reasons.

• Software changes. Every change to our app’s code must pass automated tests and checks before it ships. Database changes are applied first, then checked in the same way.

• Certification. We aren’t SOC 2 certified. Our main infrastructure providers have independent SOC 2 audits.

• The vault keeps locked items out of AI features. It isn’t extra encryption (Section 5).

Our Security page has more detail.

If something goes wrong. If a security incident affects your information, we’ll tell you by email without undue delay, and as the law requires. If it affects information about your clients, we’ll tell you as soon as we can: we aim for 24 hours, and always within 72 hours of becoming aware of it, and give you what you need to notify them (see our DPA).

Report a security concern to support@aventide.ai.

14. Your rights and choices

Wherever you live, you can ask us to:

• tell you what personal information we have about you, and give you a copy;

• correct it;

• delete it;

• send it to you in a machine-readable file (JSON);

• tell you which specific companies we’ve shared it with.

Do it yourself. You can do much of this in the app:

• edit or delete items;

• forget what Aventide learned, in Memory;

• disconnect services in Business Hub → Integrations;

• download your documents, signed agreements and form responses (as CSV).

How to ask us. Email support@aventide.ai from your account’s email address. We’ll reply within 30 days.

• Checking it’s you. To protect you, we’ll confirm the request comes from you, usually by replying to your account email. If you don’t have an account, we’ll ask for details that let us match you to the information.

• Someone acting for you. Someone can make a request for you (an “authorized agent”). We’ll ask for your signed permission, and we may check with you directly.

• What we may keep. We may keep some information when the law allows. Examples are the record of a signed agreement or a payment, or what we need for security or a legal claim. We’ll tell you what we kept and why.

• If we say no. We’ll explain why. You can appeal by replying with “appeal”, and we’ll answer within 45 days. If we turn down your appeal, you can contact your state attorney general.

• It’s free. We won’t treat you differently for using your rights.

Sale and sharing. We don’t sell personal information or share it for cross-context behavioral advertising, and we haven’t in the past 12 months. We don’t knowingly sell or share the information of anyone under 16. We don’t use personal information for targeted advertising, or for profiling that leads to legal or similarly significant decisions.

Sensitive information. We hold some sensitive personal information:

• the contents of email you connect;

• bank account data;

• government ID numbers, such as a Social Security number, in documents you upload;

• the access tokens that keep your connections working.

We use it only to provide the features you ask for, and as the law allows. So there’s no separate “limit” option to offer.

If you’re a client of a business that uses Aventide, send requests to that business (Section 2).

California details. This table covers information we handled for ourselves in the last 12 months, about our users, their teammates and visitors to our website. Information we handle for a business about its clients is covered in Section 2.

15. Health and other sensitive information

Aventide isn’t built for health records. It isn’t designed for HIPAA-covered entities or their business associates. We don’t sign Business Associate Agreements, and you must not put protected health information (PHI) into Aventide.

Health and wellness coaches who aren’t covered by HIPAA may use Aventide to run their business. Please don’t put detailed health information about your clients into notes, files or chats.

Also don’t type Social Security numbers, full card numbers or bank logins into Aventide. Payments and bank links go through Stripe. If a document you upload shows a Social Security or other government ID number (a tax filing, for example), keep it locked in the vault. Aventide’s AI then can’t see it, unless you choose to scan it with Smart Compliance.

16. Children

Aventide is for businesses and isn’t meant for anyone under 18. We don’t knowingly collect personal information directly from anyone under 18. If you think we have, email support@aventide.ai and we’ll delete it.

If you work with clients who are minors, you’re responsible for getting any parental permission the law requires before you put their information into Aventide.

17. Where we operate

Aventide is offered to businesses in the United States, and we store and process information mainly in the United States. Some providers, and some apps you connect, may process it in other countries. Examples are Cloudflare’s global network, Telegram, WhatsApp and Slack.

We don’t yet offer Aventide to businesses in the European Economic Area, the UK or Switzerland. The EU and UK terms in our DPA are not yet in effect. Before we offer Aventide there, we’ll update this policy.

18. Changes to this policy

If we make a material change to this policy, we’ll email account owners or show a notice in the app at least 30 days before it takes effect. The exceptions are a change that only corrects or clarifies how Aventide already works, and a change the law requires sooner.

We won’t use information we already have in a materially different way without asking you first. The date at the top shows the latest version.

19. Contact us

Second Spring Design Inc. (doing business as Aventide)
522 W Riverside Ave, Spokane, WA 99201-0580
support@aventide.ai

Privacy requests, security reports and questions all go to this address.