Privacy Policy

Avrosh provides AI that answers a business's calls and messages, and takes bookings and orders. This policy covers three surfaces: the marketing site at avrosh.com, the operator dashboard at app.avrosh.com, and the customer chat at go.avrosh.com.

For customer conversations, the business you interact with is the data controller of its own content; Avrosh acts as its processor. For operator accounts, Avrosh is the controller of the business account and billing data described below.

Customers. The QR chat needs no account, no phone number and no login, so nothing personal is required to start. It does not stay that way if the conversation goes anywhere: before the agent will hold a booking it asks for a name and a contact number, a delivery order carries the address as given, and the conversation itself is kept in full. Treat a transcript as the sensitive record it is, because a person can say anything into it.

Operators and staff. Business accounts hold a name, email, business details and billing information, plus the content each business enters (its own knowledge base, prices, hours and services).

We process the business content an operator enters so Avrosh can answer from it, and customer messages so it can help and route requests to staff.

For voice calls: no call audio is recorded or stored. Audio exists only in flight, long enough to be transcribed and answered. What is kept is a written transcript and a call record holding the caller's number, the time, the duration, the language and a summary. A transcript can contain anything the caller said, so treat it as the sensitive artifact it is. Because no audio is retained, we cannot produce a recording for a dispute or a regulator.

We do not build advertising profiles, and we never sell personal data.

Avrosh is operated by PT Laras Teknologi International, a company incorporated in Indonesia. GDPR Article 13 asks for the controller's identity, and until now this page did not give one.

Two laws apply to us at once, and neither substitutes for the other. The GDPR applies extraterritorially under Article 3(2), because we offer services to people in the European Union: most of our customers are there and in the United States, so this page is written on the basis that it applies rather than that it might. Indonesia's Law 27 of 2022 on Personal Data Protection applies because we are an Indonesian company.

Two gaps we would rather state than have found. Indonesia has no EU adequacy decision, so transfers of EU personal data to us rely on standard contractual clauses and a transfer impact assessment, provided with a signed agreement. And a representative in the EU under Article 27 is being appointed and is not yet in place; when it is, it will be named here.

Under the GDPR we rely on: performance of a contract (running the service for operators), legitimate interests (operating, securing and improving the service), and consent (for any marketing messages, which you can withdraw at any time).

We use a small set of vendors to run the service: model inference, speech synthesis and speech-to-text for the AI, a payments provider for subscriptions, hosting for the application and database, and an email provider for transactional mail. The current list, with purpose and region, is on our Security & Trust page.

Data is processed and stored in the region your business is assigned to: Virginia or Singapore. A European region is not live today. Where data originates in another region, transfers rely on appropriate safeguards such as standard contractual clauses.

Every business is isolated with row-level security at the database layer, so one business can never read another's data. Traffic is encrypted in transit. More detail is on the Security & Trust page.

We would rather state this accurately than comfortably. What is actually pruned on a schedule today: platform bookkeeping rows after fourteen days, internal error logs after thirty, a deleted business and soft-deleted catalogue rows after seven, and past booking ranges nightly. Conversations, chat sessions, call records and their written transcripts have no automatic prune. They are kept for the life of the account and removed when the business is deleted. A committed retention period for conversation and call data will be published here once the job that enforces it exists.

We use no advertising pixels and no third-party ad trackers, on this site or in any customer chat. Only strictly necessary cookies (such as a session cookie) are used to run the product.

You can request access to, export of, or deletion of your data. We would rather be exact about what is self-serve than imply more than exists. Where a customer holds an account with a business, export and erase are a click in the product. But that account only exists on some kinds of business, and the erase blanks identifying fields on records linked to that account; it does not reach the conversation transcript, a phone call's record, or a request logged without an account. If you reached a business by phone, by a room code, or without signing in, there is no self-serve path yet and we handle the request by hand. Either way, write to hello@avrosh.com. We will not discriminate against you for exercising these rights.

The service is intended for businesses and is not directed at children.

If this policy changes materially we will update this page and its date. Questions go to hello@avrosh.com.