Privacy Policy

Avizio is a SaaS platform that helps local businesses manage and improve their online reputation through centralized Google review management. We are based in France and operate globally.

Contact: contact@avizio.io

Account data: name, email address, hashed password, business name.

Business data: establishment name, address, GPS coordinates, Google Place ID, business type.

Google API data (only when you connect Google Business Profile):

• Google Business Profile reviews (author, rating, text, date)
• Your published review replies
• OAuth access tokens and refresh tokens (stored encrypted, server-side only)
• Google account and location identifiers

Contact data: phone number (optional, for SMS alerts — collected with explicit consent after SMS verification).

Payment data: processed exclusively by Stripe. Avizio never stores card details.

Technical data: IP address, browser type, connection logs.

Data obtained through Google APIs is used solely for the following purposes:

• Displaying your reviews in the Avizio dashboard for you to read and manage.
• Publishing your replies to Google reviews — only when you explicitly click "Publish" or enable auto-reply.
• Alerting you by email or SMS when a new negative review is detected.
• Generating AI-suggested responses — the review text is sent to Anthropic's API solely to generate a draft reply. This data is not used to train AI models.

We do NOT:

• Share your Google review data with third parties for advertising or marketing purposes.
• Use Google data to build profiles for sale or sharing.
• Allow humans to read your Google data except for security or legal compliance purposes.
• Transfer Google data to AI providers beyond what is strictly necessary to generate your reply draft.

Google OAuth tokens are stored encrypted in our database, accessible only server-side. They are never exposed to the client browser.

• Google API data (reviews, tokens): retained while your account is active. Deleted within 30 days of account closure.
• Account data: deleted within 90 days of account closure.
• Billing data: retained 10 years as required by French accounting law.
• Technical logs: retained 30 days.

We use the following sub-processors, all subject to GDPR-compliant data processing agreements:

• Supabase — Database hosting (EU region)
• Vercel — Application hosting
• Stripe — Payment processing
• Resend — Transactional email
• Brevo — Transactional SMS
• Anthropic — AI reply generation (no data used for training)
• Google — OAuth authentication, Business Profile API, Maps

Under GDPR, you have the right to access, rectify, erase, and port your data, and to object to processing. To exercise these rights: contact@avizio.io

You may also lodge a complaint with the CNIL: www.cnil.fr

Avizio implements industry-standard security: TLS encryption in transit, encrypted storage for OAuth tokens, role-based access controls, and authentication via Supabase Auth. Google OAuth tokens are stored server-side only and never transmitted to the browser.

We will notify active users by email at least 30 days before any material changes to this policy.

🔒 L'utilisation par Avizio des données reçues via les APIs Google respecte la Politique d'utilisation des données utilisateur des services API Google, y compris les exigences d'utilisation limitée.

Qui sommes-nous ?

Données collectées via les APIs Google

Utilisation des données Google API — Usage limité

Conservation des données

Vos droits