Privacy notice
Draft. This text is published for review and will be replaced by the version approved by counsel before paid plans open. Where it is unclear, the plain-language security & privacy page says what we actually do.
This notice covers three groups: people who visit avaclone.ai, customers who use the service, and visitors who talk to an AvaClone agent on a customer’s site. Bold Crow AI is the controller for the first two; for the third, the customer is the controller and we process data for them.
Visitors to this website
We keep server logs (IP address, pages, browser) for 30 days for security. We set no advertising cookies and run no third-party analytics scripts. The contact forms send what you type to us and nothing else.
Customers
- Account data: name, email, organisation, billing details (card data is held by Stripe, not by us). Kept while the account exists and for the period tax law requires afterwards.
- Content: photos, generated images, voice samples, documents, agent configuration. Kept until you delete them or close the account (then deleted within 30 days). Unsaved Studio versions are deleted after 7 days.
- Likeness releases: the signed release, the short spoken consent and the e-signature trail, kept for the life of the avatar and for the period the law requires after it is deleted.
- Usage: sessions, minutes, turns and unanswered questions, so you can see what your agents do and we can bill you.
Visitors who talk to an agent
- Speech: streamed to a speech recogniser; no recording is kept by default. The transcript is kept for the period the customer sets (default 30 days).
- Camera: off unless the visitor turns it on. When the visitor asks the agent to look, one still image is sent to the vision model for that answer and discarded after the call; we request zero data retention from the provider. A one-line text note of what was seen is kept with the transcript. The agent does not recognise faces, read emotions or infer personal traits, and never notes payment card or government ID numbers.
- Identity: we do not identify visitors. A customer may pass a reference of their own to the agent as context; we never use it to identify a person.
Who else sees data
Subprocessors, each under a contract that limits use to providing the service: Google Cloud (hosting, speech, image generation), OpenAI (language and image models), ElevenLabs (voices), Stripe (payments), Railway (web hosting). Content goes to a model provider only for the call that needs it, with zero data retention where the provider offers it. We do not sell personal data.
Where
Data is processed in the United States (Google Cloud, us-central1). Enterprise customers may choose another region.
Your rights
Customers can see, export and delete their data from the dashboard. Anyone, including a person whose likeness appears in an avatar, can ask us at privacy@avaclone.ai to access, correct or delete personal data, or report a likeness through the takedown form. We answer within 30 days, and takedowns within 48 hours of verification. Where the GDPR or a US state privacy law applies, you have the rights it gives you, and the right to complain to your supervisory authority.
Contact
Bold Crow AI, Ohio, United States. privacy@avaclone.ai.