Privacy Policy

This Privacy Policy explains how Avena AI processes personal data when you use the service. It applies to guests and signed-in users.

Controller and contact

Data controller: MB Sekmingas pirkimas Privacy contact: support@avena-ai.com

What we process

Depending on how you use Avena, we may process: account and authentication data (email, auth identifiers); profile and preferences (display name, tone, flirt level, topics); age/18+ acknowledgement; custom companion profiles and appearance settings; chat transcripts and rolling conversation summaries; generated avatar/image requests and outputs; subscription and payment metadata from Stripe; support messages; and limited technical/security logs (including rate-limit counters and opaque digests used for abuse prevention).

Guests vs signed-in accounts

Guests keep preferences, custom companions, free-message counters, conversation transcripts, and rolling context in this browser’s local storage. Signed-in accounts can sync preferences, custom companions, visible conversation history, and rolling summaries to cloud storage so you can continue across devices.

Conversation transcripts and context

When signed-in cloud transcript storage is enabled for your account environment, Avena stores the visible chat transcript for each companion so you can reopen a conversation where you left off. Guests keep transcripts in this browser. Avena also keeps a short rolling summary used with a bounded recent-message window to generate replies — the full stored transcript is not blindly resent to the AI on every message. Reset conversation clears that companion's transcript and rolling summary. Closing chat does not delete them. Deleting your account removes account-owned transcript data.

Purposes and legal bases

We process data to provide the service you request (contract / steps prior to contract), to secure the service and prevent abuse (legitimate interests), to meet legal obligations, and — where we rely on consent (for example certain optional features or voluntary sensitive disclosures) — on consent that you may withdraw. You are not required to include special-category data in chats; if you voluntarily disclose health, sexual-life, or similar information, we process it only as needed to operate the conversational service you requested.

AI processing

Chat messages and relevant companion/context snippets are sent to AI model providers (via our model gateway) to generate replies. Image generation requests are sent to our image provider to create companion portraits. Outputs can be inaccurate or fictional. Do not submit passwords, payment card numbers, or unnecessary sensitive identifiers in chats.

Processors and recipients

We use infrastructure and processors needed to run Avena, which may include: hosting (Vercel), database/auth (Supabase), payments (Stripe), AI model gateway/providers (including OpenRouter and underlying model providers), image generation (fal.ai), email/auth delivery providers, and CAPTCHA providers when enabled (such as Cloudflare Turnstile). These parties process data under their terms and our instructions where they act as processors. We do not sell your personal data.

International transfers

Some providers may process data outside Lithuania/the EEA. Where required, transfers rely on appropriate safeguards (such as Standard Contractual Clauses) or other lawful transfer mechanisms offered by the provider.

Retention

We retain account and conversation data while your account remains active and as needed to provide the service. Guest data remains in your browser until you clear it. After account deletion, account-owned transcript and companion data are removed as described in product deletion flows, subject to limited retention needed for security, fraud prevention, dispute handling, and legal obligations (including a minimal hashed anti-abuse free-allowance record that does not store plaintext email). Expired rate-limit rows may be purged on a schedule.

Your rights (GDPR)

If GDPR applies, you may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent where processing is consent-based. To exercise rights, contact support@avena-ai.com. You may also lodge a complaint with the State Data Protection Inspectorate (VDAI) in Lithuania or another competent supervisory authority.

Cookies, local storage, and analytics

Avena uses technically necessary storage (such as local storage/session mechanisms) to keep guest preferences, auth session state, and similar functions. We do not run a separate advertising tracker in the core product. If optional analytics are added later, we will update this policy and obtain any required consent.

Security and anti-abuse

Avena uses limited security signals to protect the service from bots and free-allowance abuse, including rate-limit counters, truncated network/IP hints in logs, and keyed one-way digests used only as opaque bucket keys. These signals are for security and fraud prevention, not advertising.

Your control

You can clear local guest data from this browser using the Privacy controls on the home page. Paid subscriptions are processed by Stripe. Signed-in paid users can open subscription settings to update payment methods, view invoices, or cancel. Stripe processes payment details as an independent payment provider; Avena receives subscription and payment metadata needed to entitle your account, not your full card number.

Changes

We may update this Privacy Policy as the product changes. Material changes will be reflected on this page with an updated effective understanding via the product; continue using Avena after changes means you should review the updated policy.

Legal details

MB Sekmingas pirkimas Company code: 306617207 Registered office: Salininkų g. 191B, LT-02205 Vilnius, Lithuania support@avena-ai.com

Contact

For privacy, account, or billing data questions, contact support@avena-ai.com.