Privacy Policy

1. Who We Are

Avenor is a B2B SaaS platform for brand and e-commerce operations management, operated as joint controllers by Avenor SAS (France) and LBMGB LLC (North Carolina, US), together with their partners, subsidiaries, and associated entities (“Avenor”, “we”, “us”, or “our”). Our production platform is available at https://os.avenor-na.com. This Privacy Policy describes how we collect, use, store, and share information when you use Avenor, and covers both the main SaaS platform and our document-sharing surface at /d/[link] (the “Deck Viewer”), used to share confidential decks with prospects, clients, and partners. For data subjects in the EU/EEA, processing is governed by the GDPR (Regulation (EU) 2016/679); for data subjects in California, by the CCPA/CPRA. You have rights of access, correction, erasure, restriction, portability, and objection — contact privacy@avenor-na.com or use our self-serve erasure form.

2. Information We Collect

We collect the following categories of information:

• Account & Profile Data. Name, email address, organization name, role, and any other information you provide when registering or updating your profile.
• Integration-Sourced Business Data. Financial records, order data, product catalogs, customer information, payroll figures, and banking transactions pulled from connected third-party platforms (Shopify, QuickBooks, Mercury, Revolut) at your explicit direction via OAuth authorization.
• Usage & Analytics Data. Page views, feature interactions, session duration, click paths, and performance metrics collected via PostHog.
• Device & Browser Data. IP address, browser type and version, operating system, device identifiers, and referring URLs collected automatically when you access the platform.
• Error & Diagnostic Data. Stack traces, error messages, and session context collected via Sentry when the platform encounters an error.

3. How We Use Information

• Platform Operation. To authenticate your identity, enforce organization-level access controls, and render your dashboard and reports.
• Analytics & Improvement. To understand how features are used, identify performance bottlenecks, and prioritize product improvements.
• Communications. To send transactional emails (account confirmation, password reset, weekly digests) via Resend.
• Security & Integrity. To detect fraud, prevent abuse, respond to security incidents, and maintain audit logs.
• AI Features. Where you use AI-assisted features, your input and relevant context is processed by Anthropic’s API to generate responses. We do not use your data to train AI models.

4. Data Processors & Sub-processors

We engage the following sub-processors to operate the platform. Each is bound by appropriate data processing agreements.

The authoritative, always-current list is our subprocessor register.

5. Third-Party Integrations

Avenor connects to external platforms at your direction. All integrations require your explicit OAuth authorization. We only access data scopes you approve.

6. Data Retention

We retain your account and organizational data for as long as your account remains active. If you close your account or request deletion, we will delete or anonymize your personal data within 90 days of account closure, except where we are required to retain data for legal or compliance purposes. Integration data cached in session storage is cleared at session expiration and is not stored persistently.

7. Data Security

We implement industry-standard security measures to protect your data:

• Integration credentials and sensitive tokens are encrypted using AES-256-GCM before storage.
• All data transmitted between your browser and our servers is protected by TLS 1.2 or higher.
• All database tables enforce Row-Level Security (RLS) to ensure your organization’s data is strictly isolated from other tenants.
• Access to production systems is restricted to authorized Avenor personnel and protected by multi-factor authentication.

8. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

• Access. Request a copy of the personal data we hold about you.
• Correction. Request correction of inaccurate or incomplete data.
• Deletion. Request deletion of your personal data, subject to legal retention obligations.
• Portability. Request an export of your data in a machine-readable format.

To exercise any of these rights, contact us at privacy@avenor-na.com. We will respond within 30 days.

9. Cookies

Avenor uses the following types of cookies:

• Session Cookies. Required for authentication and session management. These are strictly necessary and cannot be disabled.
• Analytics Cookies. PostHog sets cookies to identify returning users and track feature usage. These can be disabled via your browser settings, though doing so may affect platform functionality.

We do not use advertising cookies or sell cookie data to any third party.

10. Children’s Privacy

Avenor is a business operations platform intended for use by professionals and organizations. It is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us at privacy@avenor-na.com and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email at least 14 days before the change takes effect. Your continued use of Avenor after the effective date constitutes acceptance of the updated policy. We encourage you to review this page periodically.

12. Contact Us

For privacy inquiries, data requests, or to report a concern: