Privacy Policy

1. Our role

When you visit our website, contact us, apply for access, or act as a customer’s user, Avoro decides how to use information about you for account administration, billing, support, security, and our own business operations. In those cases, Avoro acts as a business or controller.

When a brokerage, team, or other business customer (“Customer”) connects or uploads information about its agents, clients, leads, transactions, and other contacts (“Client Data”), Avoro processes that data for the Customer to provide the Services. The Customer decides why and how Client Data is used and is responsible for its privacy notices, permissions, and instructions. If you are an individual whose information was added by a Customer, contact that Customer to exercise privacy rights. We will assist the Customer as required by our agreement and applicable law. Avoro processes connected Intuit data for the Avoro Customer that connected it, not on behalf of Intuit.

This policy does not govern third-party products or websites, which have their own terms and privacy notices.

2. Information we collect

• Account and business contact information: name, work email, phone number, role, company, brokerage, profile and login information.
• Customer content and Client Data: information a Customer or its users submit, upload, or connect, including files, notes, prompts, contact and transaction records, and business metrics.
• Connected QuickBooks data: when enabled by a Customer, read-only access to customers, vendors, invoices, bills, payments, accounts, and transactions. We store a copy to join records and provide the enabled insights and features.
• Billing and payment information: billing contact and address. Our payment processor handles payment card details and funds; Avoro does not receive or hold customer funds.
• Website and device information: IP address, browser and device details, pages visited, referral information, timestamps, feature use, and diagnostic/performance data. We may infer approximate location from IP address; we do not collect precise location.
• Communications: information you provide when contacting support, making a privacy request, or applying for access.
• Business sources: professional information from a Customer, business partners, or public professional sources.

Avoro does not license or ingest MLS data feeds and does not knowingly collect personal information from children under 18.

3. How we use information

We use information to provide and administer the Services; authenticate users; connect and synchronize sources; match and organize records; produce summaries, insights, contact scores, and other AI-assisted features; respond to support and privacy requests; bill customers; secure, debug, test, and improve the Services; communicate service and administrative notices; send permitted business marketing; comply with law; and enforce agreements.

We do not use personal information to train generative foundation models. We may use approved service providers, including AI providers, to process information to return requested features. Our personnel and development agents may access real customer data when reasonably needed to develop, test, support, secure, or improve the Services. Some development agents and providers may process or store information in the United States or other countries. The QuickBooks connection flow will disclose that connected data may be used for pre-release product testing.

We do not use personal information to make decisions with legal or similarly significant effects about a person solely by automated means without human review.

4. Deidentified and aggregate information

We may create aggregated or deidentified information from Service data, including Client Data, so it is not reasonably linkable to a person or organization. We use it for benchmarks, product improvement, and industry insights. We display cross-customer benchmarks only when based on at least five organizations. We maintain deidentified information in that form and do not attempt to reidentify it.

5. How we disclose information

We disclose information to service providers that host, secure, analyze, support, or otherwise help operate the Services, including cloud, database, analytics, AI, email, and payment providers; to a Customer’s administrators and users as configured for its workspace; to connected services at the Customer’s direction; to professional advisers; in a corporate transaction; and when needed to comply with law, protect rights and safety, or enforce agreements. Providers are authorized to process information for the services they provide to us.

We do not sell personal information or share it for cross-context behavioral advertising. We do not disclose personal information to ad networks for targeted advertising.

6. QuickBooks and connected data

A Customer chooses whether to connect QuickBooks and grants the permissions shown in the connection flow. At launch, access is read-only. We use connected data to provide the Services the Customer enables, including joining records and generating insights. When the Customer disconnects QuickBooks, we stop syncing and processing new data from that connection immediately. Previously synced data remains in the Customer’s Avoro workspace unless the Customer requests its deletion or another retention rule applies. We do not use QuickBooks data to train generative foundation models.

6A. Google Workspace connections

Connecting Google Workspace is optional. Avoro receives the connected account identity and the permissions displayed by Google. Enabled features may access Gmail message content, headers, recipients, thread identifiers and history; Calendar availability, settings and events; and Drive folder/file metadata and document content.

Avoro uses this information for the connected features the user enables: transaction email context and approved sending, commitment follow-up, calendar scheduling, selected-folder document synchronization and organization, and separately consented communication-profile analysis. The Drive folder picker reads folder metadata so the user can choose folders. Document-content processing follows enabled folders. User actions can rename or move synchronized files in Drive; this document workflow does not permanently delete source Drive files.

Connected information is processed on Avoro servers and by service providers supporting hosting, storage, workflow automation and enabled AI features. Relevant message or document content may be sent to Anthropic to produce a requested classification, summary, extracted signal or communication profile. Anthropic API inputs and outputs are retained for 30 days by default, subject to its documented safety, legal and service-specific exceptions. Avoro does not promise zero retention at every processor. Derived observations, profiles and document classifications are also treated as Google-derived information where applicable.

Avoro’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. These Google-specific restrictions take precedence over conflicting general provisions on product improvement, testing, development access, benchmarking and corporate transactions. Google data is not sold, used for advertising, used to determine creditworthiness, or used to train or improve general-purpose AI models. Communication profiles are user-specific feature outputs.

Human access to Google data is limited to the circumstances allowed by Google’s policy, including documented permission to view specific data, necessary security investigation, applicable legal obligations, or qualifying aggregated and anonymized internal operations. General permission for development or testing elsewhere in this policy does not authorize unrestricted access to Google data.

Users can manage feature grants and disconnect Google in Control Room, or remove Avoro’s access in their Google Account’s third-party connections settings. Disconnecting stops future connection use; it does not automatically erase previously synchronized documents or derived records. Avoro retains those records for the enabled service and the Customer’s applicable retention requirements, subject to Section 8. Deletion requests cover applicable saved copies and derived observations, profiles, classifications and cached outputs; ordinary document Delete may first hide a document while separate storage cleanup removes its bytes. To request deletion of Google-derived records, use the privacy request form or the contact in Section 9. Avoro verifies the request, stops the affected processing, and coordinates required Customer instructions, shared-file rights, legal holds and backup deletion periods. A Google-data erasure request is separate from account closure; the account export window does not prevent a user from requesting erasure sooner.

7. Cookies and analytics

Our website uses essential technologies and analytics. We use PostHog to understand website use, referrals, performance, and product interest. Our current configuration disables session recordings, surveys, and automatic click capture. Browser storage may remember experiment assignment. You can use browser settings to manage cookies and local storage; disabling them may affect site features. We do not use this information for targeted advertising.

8. Retention

We retain information for the periods reasonably necessary for the purposes described in this policy, subject to legal, accounting, security, and dispute-resolution requirements. Unless a signed customer agreement requires otherwise, after a Customer account ends, the Customer may request return or deletion of Client Data during a 30-day export window. We then delete Client Data within 30 days after that window, except data we must retain by law or that remains in backups, which expire under their applicable recovery schedules. Recovery backups are restricted from normal product use. If a backup is restored, completed deletion requests must be reapplied before the affected data returns to normal use.

For Google-connected data, Avoro’s primary database currently has a seven-day point-in-time recovery window. Database backups do not include stored file bytes; removing a file copy requires separate removal from object storage. Service providers have their own retention periods, including Anthropic’s 30-day API default and the exceptions described in Section 6A. Avoro confirms applicable retention and any required exceptions when handling a verified deletion request. Limited security, consent, deletion-receipt and billing metadata may remain where needed for the purposes and obligations described in this policy.

We generally retain account and profile information for up to 24 months after account closure, billing and transaction records for seven years, usage and security logs for as long as reasonably needed for service operation, security, debugging, and improvement, and marketing contact information until opt-out or 36 months of inactivity, whichever comes first. We may retain limited information to meet legal obligations, resolve disputes, enforce agreements, or prevent abuse.

9. Your choices and privacy rights

Depending on where you live and your relationship with Avoro, applicable law may give you rights to access, correct, delete, or obtain a copy of certain personal information, or to opt out of certain processing. Avoro does not sell personal information or use it for targeted advertising. We will not discriminate against you for exercising a right provided by law.

To submit a request, use our privacy request form or email privacy@avoroglobal.com. We may need to verify your identity and will respond as required by applicable law. If your information is Client Data in a Customer’s workspace, we may refer the request to that Customer and assist it. You may also appeal a denied request by replying to our decision and including “Privacy appeal” in the subject line.

10. Security and international processing

We use safeguards designed to protect information, including encryption in transit and at rest, encrypted connected-account credentials, role-based access controls, and separation of customer data by tenant. No method of transmission or storage is completely secure. Information may be processed or stored in the United States and other countries where Avoro or its providers operate.

11. Changes and contact

We may update this policy and will post the revised version with a new effective date. For material changes, we will provide notice by email or through the Services when appropriate.