Free Trial Privacy Notice

Who is responsible

Anvaylo is provided by TradingEdgeIQ LLC, doing business as Anvaylo. Its business address is in the Free Trial Terms.

Questions and requests about privacy: legal@anvaylo.com.

What is handled

• Identity: your email address, sign-in times and session tokens, held by the authentication provider.
• Invitations: the invited person’s email address, role and expiry. The invitation is recorded in the portal and is not sent by email.
• Workspace data: organisation and company names, members and roles, AI-system register entries, owners, findings, reviewer decisions and rationales, and evidence reports.
• Audit events: who did what and when, without document text.
• Support: tickets (subject, message, category, status and the team’s replies) and product feedback (a rating, an optional short comment and the page it came from).
• Requests: data export and deletion requests (kind, status, date and the person who made them).
• Documents you upload and text derived from them, only if document upload is switched on for your workspace.
• Operational logs with fixed codes, intended to contain no document text and no email addresses.

Why it is used

Data is used to run the service you asked for: to sign you in, to hold and show your workspace, to answer support requests, to keep the service secure and to keep a record of who did what. Anvaylo does not sell your content.

No payment data is handled during the free trial: no card is collected and no charge is made.

AI training is switched off. Anvaylo is not using customer content to train AI models or to make sanitized contributions.

Where it is kept and who receives it

Document storage and the malware-scanning worker are set up in the United States (AWS us-east-1). Anvaylo does not promise that all data is stored only in the United States.

Providers receive data to run the service: Supabase supplies the database and sign-in service, Vercel hosts the website and functions, and an email provider delivers sign-in links. The Production database project is in us-east-1 and the documented Production function region is iad1. These describe the identified resources, not every provider resource or copy. Storage and backup locations and the email provider’s processing location are not yet confirmed. See Service Providers for the disclosed roles and location limits.

The Free assistant does not send questions or company context to an AI model provider. AI-generated Paid answers and optional model-assisted extraction must not be enabled until their provider terms and data handling are verified and disclosed. AI training remains switched off.

How long it is kept

Deleting a document stops access at once. When the background cleanup finishes, the original is overwritten with an empty marker and derived text is removed. The opaque storage key remains; the stored object itself is not removed. Cleanup may require an operator while automated deletion is held. Database backups can retain derived text for a period that Anvaylo has not yet confirmed.

A free workspace is archived for 720 hours (30 days) after the trial unless it moves to Paid. Deletion is then scheduled subject to notice delivery, operator review and safeguards; automated deletion is currently held.

When a workspace is deleted, company and account names are scrubbed and the records registered for deletion are erased. Some non-content records are kept, including membership and access records, billing records, document audit events and notification records. No end date is set for them yet. Erasing an account at an owner’s request needs an operator step, and deletion of backups and provider copies is not verified.

The email address held by the sign-in provider is not removed when a workspace is deleted.

Your choices

You can delete a document and download an individual assessment report as HTML or Markdown. Free reports are limited and watermarked; the detailed final report is available on Paid. These report limits do not transfer ownership of your original content to Anvaylo.

People with the right role can record a data export or a company deletion request in the portal. A request is only recorded: nothing is exported or deleted because of it, and no process or handling time is live yet.

Security measures and what is not claimed

Sign-in uses one-time email links, not passwords, and each request re-checks company membership on the server.

Documents, if enabled, sit in private cloud storage with public access blocked, encrypted connections required and default encryption on.

Anvaylo claims no security certification, penetration test, availability figure or recovery objective, because none has been obtained.

If Anvaylo confirms a security incident affecting your data, it will notify the affected account owner by email promptly and without undue delay, provide the known details and updates, and meet applicable legal deadlines. No fixed 24-hour contractual notice period is promised.

Who may use it

The service is for users aged 18 or older who act for a business or organisation. It is not for children.

Cookies and analytics

Website cookies and analytics, including your available choices, are described on the Cookies and analytics page (/cookies).