Privacy Policy

Draft — last updated [DATE TO SET AT LAUNCH]

This Privacy Policy explains how BHIH International LLC ("Avoonta", "we", "us") collects, uses, shares and protects personal information when you visit avoonta.com, create an Avoonta account, or when a business that uses Avoonta calls, texts or books an appointment with you.

1. Who we are

Avoonta is a service operated by BHIH International LLC, a limited liability company organized in [STATE], United States, with its registered address at [REGISTERED ADDRESS].

Avoonta provides AI voice agents for businesses. With the lead's consent, an Avoonta agent can call a business's new leads seconds after they ask to be contacted, follow up by SMS or WhatsApp, book appointments into the business's calendar, answer the business's inbound calls as a receptionist, record and transcribe calls, and send the results to the business by webhook or API.

Our customers are businesses and agencies. Agencies may offer Avoonta to their own clients under the agency's brand ("white-label").

Questions about privacy: support@avoonta.com.

2. Our two roles: controller and processor

Where we decide how data is used (controller / "business")

We are responsible for the personal information of our own customers and their users (account holders, team members, agency staff) and of visitors to avoonta.com. This includes account, billing, support and website information.

Where we act for our customers (processor / "service provider")

When a customer uses Avoonta to contact its leads, answer its calls or book its appointments, the customer decides whose data is processed and why. For that data (lead details, call recordings, transcripts, message content, appointment details and consent records) we act as the customer's processor or service provider and process it only on the customer's instructions and under our agreement with the customer.

Customers are responsible for having a lawful basis to process their leads' information and for obtaining every consent the law requires before Avoonta calls or texts anyone on their behalf, including prior express written consent where required. If a business contacted you through Avoonta, please see section 15.

Our data processing terms for customers are available at [DPA LINK OR "on request"].

3. Information we collect

Account information

Name, email address, phone number, business name, agency name and brand settings (such as logo, colors and support email), login details, team members and the time zone of your workspace. If you use the "Test call my phone" feature we collect the phone number you enter, a one-time verification code result, and your attestation that the number is yours and that you agree to receive the AI test call.

Billing information

Payments are handled by Stripe. We receive and store a Stripe customer identifier, a payment method identifier, the card brand, last four digits and expiry date, billing address, and the history of top-ups, auto-refills and charges to your wallet. We never receive or store full card numbers or card security codes. For agencies that bill their clients through Stripe Connect, we also store the connected account identifier.

Usage and technical information

Which features you use, the agents you configure (name, voice, greeting, questions, knowledge-base text), API key prefixes (we store only a one-way hash of each full key), webhook delivery logs, IP address, browser and device type, and service logs used for security and troubleshooting.

Lead information (processed for our customers)

Information our customers send us about their leads through our API, forms or trigger URLs: phone number, first name, email address, company and any context the customer adds (for example, what the lead asked about).

Call recordings and transcripts (processed for our customers)

Audio recordings of calls handled by Avoonta agents, written transcripts, AI-generated summaries, answers to qualification questions, call outcome, duration, and whether the call reached a person or a voicemail system.

SMS and WhatsApp content (processed for our customers)

The content, time, sender and recipient number, delivery status and replies (including STOP, HELP and START replies) of text and WhatsApp messages sent or received through Avoonta.

Consent evidence

For every call or message order, a record of the lead's consent as supplied by the customer: that consent was confirmed, when it was given, and where (for example, the web form address). For leads sent through a trigger URL, we also keep the customer's own attestation (which user confirmed, when, and the exact wording they agreed to).

Suppression list

When someone asks not to be called or texted (for example, by replying STOP or saying "stop calling"), we add their number to a suppression list so that the business they opted out from does not contact them again through us. We store this as a one-way cryptographic hash of the phone number, not the number in readable form, together with the date and channel. Each customer account keeps its own suppression list: an opt-out given to one business stops that business from contacting the person through Avoonta.

Calendar data

If a customer connects a calendar (Google, Microsoft Outlook / 365, HighLevel, Cal.com or a custom availability URL), we access free/busy availability and the events our agent creates (and, for Microsoft and HighLevel, the list of calendars so the customer can choose one). See sections 6, 7 and 8. We store the access and refresh tokens needed to keep the connection working.

Website visitors

Basic technical information (IP address, browser, pages requested) recorded by our hosting and network providers for security and to deliver the site. See Cookies.

Support communications

Messages you send to support@avoonta.com and our replies.

4. How we use information

• To provide the service: place and answer calls, run the AI conversation, send follow-up messages, book appointments, produce recordings, transcripts and summaries, and deliver results to the customer by webhook or API.
• To enforce calling rules: check consent records, the suppression list, the recipient's local calling hours (8am to 8pm), blocked destinations and retry limits before every dial, retry and text. If the suppression list cannot be checked, we do not place the call or send the message.
• To bill: calculate usage (per-minute call charges, message segments, phone numbers), charge your wallet and run auto-refill.
• To secure the service: detect fraud, abuse, spam and unauthorized access; keep audit logs.
• To support you: answer questions and troubleshoot problems.
• To communicate with you: send service, billing, security and legal notices. We send product news only where permitted, and you can opt out at any time.
• To improve the service: using aggregated or de-identified usage statistics. We do not use our customers' call recordings, transcripts or message content to improve the service for other customers without that customer's permission. [CONFIRM]
• To meet legal obligations: respond to lawful requests, keep tax and accounting records, and prove compliance with telephone and messaging laws.

Where the GDPR or UK GDPR applies to our controller activities, our legal bases are: performance of our contract with you; our legitimate interests in running, securing and improving the service (balanced against your rights); compliance with legal obligations; and your consent where we ask for it.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

5. AI processing of calls and messages

Calls placed or answered through Avoonta are handled by an AI voice agent, not a person. Every call opens with a spoken disclosure that the agent is an AI assistant acting for the named business. This disclosure cannot be turned off by our customers.

To run a conversation, the agent's speech is converted to text, processed by a large language model together with the business's instructions and information about the lead, and turned back into speech. The AI may also generate a summary, a qualification score and extracted answers after the call. These outputs can contain mistakes; businesses are told to review them.

The AI does not make decisions that have legal or similarly significant effects on you on its own; it collects information and books appointments for the business, which makes its own decisions.

Our commitment: we do not use customer call recordings, transcripts or message content to train third-party AI models, and we do not permit our providers to do so. [CONFIRM WITH VENDOR TERMS]

6. Google user data

If a customer chooses to connect a Google Calendar to Avoonta, we request access through Google's OAuth consent screen. We access only:

• Calendar availability (free/busy): so the AI agent can offer open time slots to a caller during a live call.
• Event creation: so the agent can book the appointment the caller agrees to, in the calendar the customer chose, and update or cancel events that Avoonta created.

The Google permissions we request are exactly: https://www.googleapis.com/auth/calendar.freebusy (availability) and https://www.googleapis.com/auth/calendar.events (creating and managing the events Avoonta books).

We use this data only to provide the booking feature the customer turned on. We do not read the content of other events beyond what is needed to determine availability, we do not use Google user data for advertising, we do not sell it, and no person at Avoonta reads it unless the customer asks us to for support, it is needed for security or to comply with law, or it has been aggregated and anonymized. We do not use Google user data to develop, improve or train generalized AI or machine-learning models.

Avoonta's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The customer can disconnect Google Calendar at any time in Avoonta's settings or at myaccount.google.com/permissions. When disconnected, we delete the stored Google tokens within [NUMBER] days. Appointments already created stay in the customer's calendar.

7. Microsoft calendar data

If a customer connects a Microsoft Outlook or Microsoft 365 calendar, we access, through Microsoft's consent screen, free/busy availability, the list of calendars, and the ability to create, update and cancel the events that Avoonta books. The Microsoft Graph permissions we request are exactly: Calendars.ReadWrite, User.Read and offline_access. We use this data only to check availability and book appointments for that customer, we do not sell it or use it for advertising or to train AI models, and the customer can disconnect at any time in Avoonta or in their Microsoft account settings, after which we delete the stored tokens.

8. HighLevel calendar data

If a customer connects a HighLevel (GoHighLevel) calendar, we access, with the customer's authorization, calendar availability, the list of calendars, and the ability to create appointments for the contact the agent spoke with. The HighLevel permissions we request are exactly: calendars.readonly, calendars/events.readonly, calendars/events.write and contacts.write. We use this data only to book appointments for that customer, we do not sell it or use it for advertising or to train AI models, and the customer can disconnect at any time, after which we delete the stored tokens. Cal.com and custom availability URLs are handled the same way.

9. How we share information and our subprocessors

We share personal information only as follows:

• With the customer it belongs to. Call results, recordings, transcripts and messages are delivered to the business (and, for white-label accounts, its agency) that placed the order.
• With our service providers (subprocessors) that help us run Avoonta, under contracts that limit their use of the data to providing services to us:

• For legal reasons: to comply with law, a subpoena or court order, to respond to valid requests from public authorities, or to protect the rights, safety and property of Avoonta, our customers or others (including to investigate unlawful calling or messaging).
• In a business transfer: if we are involved in a merger, acquisition or sale of assets, subject to this policy.
• With your permission or at your direction.

We will give notice of new subprocessors at [SUBPROCESSOR NOTICE METHOD / URL].

10. How long we keep information

• Call recordings: 30 days by default, unless the customer chooses a different period in its settings. [CONFIRM]
• Transcripts, summaries and message content: for as long as the customer's account is active, or until the customer deletes them. [CONFIRM]
• Consent records: for as long as needed to prove consent was obtained and to defend legal claims, which may be several years after the last contact (for example, the limitation periods under the US Telephone Consumer Protection Act). [CONFIRM PERIOD]
• Suppression list entries: for as long as needed to honor the opt-out; we do not delete them on request because doing so would allow contact to resume.
• Billing and transaction records: as required by tax and accounting law (generally 7 years). [CONFIRM]
• Account information: while the account is open, then deleted or anonymized within [NUMBER] days after closing, except what we must keep by law.
• Security logs: up to [NUMBER] days.

11. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit (TLS), encryption at rest by our hosting providers, access controls limited to staff who need them, row-level access rules in our database, hashing of API keys and suppressed phone numbers, signed webhooks, and audit logs. Recordings are served only through authenticated links. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you and the authorities as the law requires. More detail is on our Security Affiliates page.

12. International transfers

Avoonta is based in the United States and our main processing takes place in the United States. If you are outside the US, your information will be transferred to and processed in the US and in other countries where our providers operate. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), the EU-US Data Privacy Framework where a provider is certified, or another lawful transfer mechanism. [CONFIRM TRANSFER MECHANISMS] At launch, Avoonta places calls only to US (+1) phone numbers.

13. Your rights under US state privacy laws

Residents of California and other US states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate information;
• delete information, subject to legal exceptions;
• opt out of the sale or sharing of personal information and of targeted advertising (we do not sell or share it for those purposes);
• limit the use of sensitive personal information (we do not use it for purposes that would require this);
• appeal our decision on a request; and
• not be discriminated against for exercising these rights.

California notice at collection. In the last 12 months we have collected these categories: identifiers (name, email, phone, IP address); customer records (billing details); commercial information (purchases, wallet history); internet activity (usage logs); audio and electronic information (call recordings, when we process them for customers); and inferences in the form of AI-generated call summaries and qualification scores (for customers). We collect them from you, from our customers, and automatically, for the purposes in section 4, and we disclose them to the service providers in section 9. We keep them for the periods in section 10.

To make a request, email support@avoonta.com with the subject "Privacy request". We will verify your identity (usually by confirming control of the email or phone number involved) before acting. You may use an authorized agent, who must show your written permission. We respond within the time the law requires (generally 45 days). If we deny your request, you can appeal by replying to our decision; if the appeal is denied you may contact your state attorney general.

If your information was given to us by one of our customers (for example, you are a lead a business called), we will pass your request to that business or ask you to contact it directly, as it controls that data.

14. Your rights under the GDPR and UK GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access, correct, delete, restrict or object to our processing of your personal information, the right to data portability, and the right to withdraw consent at any time (without affecting earlier processing). You also have the right to complain to your local data protection authority. To exercise these rights, contact support@avoonta.com.

EU representative: [EU REPRESENTATIVE (Art. 27) OR "not appointed" WITH REASON]. UK representative: [UK REPRESENTATIVE OR "not appointed"].

15. If a business using Avoonta contacted you

If you received a call or text from a business that uses Avoonta, that business is responsible for your information and for having your consent. The call or message will name the business. You can:

• Stop calls: say "stop calling" or "do not call me" during any call.
• Stop texts: reply STOP to any text. See our Texting Terms.
• Ask about your data: contact the business directly, or email support@avoonta.com and we will help route your request.
• Report unwanted contact: email support@avoonta.com with the number that contacted you and the date. We investigate every report.

16. Children

Avoonta is a business service. It is not directed to children under 16, and we do not knowingly collect personal information from children. Our customers may not use Avoonta to call or text anyone they know to be under 18. [CONFIRM AGE THRESHOLDS] If you believe a child's information has been given to us, contact us and we will delete it.

17. Cookies and similar technologies

Our website and app use only essential cookies and similar storage needed to sign you in, keep your session secure, and remember basic settings. We do not use advertising cookies, cross-site trackers or third-party analytics that profile you. [CONFIRM AT LAUNCH] Because these cookies are strictly necessary, the site does not show a cookie banner; you can block cookies in your browser, but signing in will not work.

We honor Global Privacy Control (GPC) signals as a request to opt out of sale or sharing, although we do not sell or share personal information.

18. Changes to this policy

We may update this policy. We will post the new version on this page with a new "last updated" date and, for material changes, notify customers by email or in the app before the change takes effect.

19. Contact us

BHIH International LLC (Avoonta)
[REGISTERED ADDRESS]
Email: support@avoonta.com