Privacy Policy

What this policy covers

This policy explains how Avanta handles personal data across two things: this website, and the Avanta CRM application you sign in to. They collect very different amounts of data, so each section below says which one it is describing.

Your data and your customers' data

Some data is about you: the details on your account, and the enquiry you send us through this site. We decide how that is handled, and this policy governs it.

Most data inside Avanta is about somebody else — the contacts, companies and conversations your team records. You decide what goes in, how long it stays and who may see it. We process it on your instructions to run the service for you, and we do not use it for our own purposes.

On this website

This site collects one thing: the enquiry form on the contact page. It asks for your first and last name, your work email address, your company name, a team-size range, and optionally a short description of what you need. Nothing else on the site collects anything.

The form is sent directly from your browser to the Avanta application, which records it as a contact request. As with any request over the internet, the systems that receive it necessarily see the address it came from and the browser that sent it.

No cookies, no analytics, no tracking on this site

This website sets no cookies. It writes nothing to local or session storage. It runs no analytics, no tag manager and no advertising pixel, and it loads no third-party scripts, fonts or images — typefaces and artwork are served from this site itself, so simply reading these pages does not tell anyone else that you did.

That is why you were not asked to accept cookies: there are none to accept.

In the Avanta application

When you create an account we collect your name, email address and password, which is stored hashed and never in readable form. If you sign in with Google, we receive the basic profile details that sign-in provides.

Inside a workspace we hold the records your team creates: contacts and companies, opportunities and pipeline activity, tasks and calendar entries, notes, uploaded files, and the content of email or messaging conversations you choose to connect.

We also keep the operational data needed to run and secure the service: session records, sign-in activity, request logs including network addresses, and error reports. The application sets a session cookie when you sign in, which is strictly necessary to keep you signed in.

What we never collect

We do not build advertising or behavioural profiles, we do not use advertising identifiers, and we do not track you across other websites.

Running the service

We use personal data to provide Avanta, keep accounts and workspaces secure, prevent abuse, investigate faults, respond to support requests, and answer enquiries sent through this site.

We use aggregate, non-identifying information about how the product is used to decide what to build next.

We do not train models on your workspace

The records in your workspace are not used to train machine-learning models, ours or anyone else's, and they are not sold, rented or shared for anyone else's marketing.

Messages we send you

Service messages — security notices, changes to these documents, and correspondence about your account or plan — are part of the service and continue for as long as you hold an account.

Marketing messages are separate. You can opt out at any time using the link in the message or by contacting us, and doing so does not affect your access to the service.

Why we are allowed to process your data

We process personal data on the basis of contractual necessity, where the processing is needed to give you the service you asked for; legitimate interest, for keeping the platform secure, preventing fraud and abuse, and improving the product; consent, which we rely on for marketing messages and which you may withdraw at any time; and legal obligation, where the law requires us to keep or disclose information.

Where you upload personal data about your own contacts, you are responsible for having a lawful basis to do so and for giving those people any notice the law requires.

Who we share data with

We share personal data with the service providers listed below, which process it on our instructions to host, store, deliver and secure the platform. They may use it only for that purpose.

We also share data with members of your own workspace, according to the roles its administrators have set, and with a competent authority where the law requires it or where it is necessary to protect someone's safety or our legal rights.

What we never do

We do not sell personal data, and we do not share it with advertisers or data brokers.

How long we keep things

Account data is kept while your account is active. After an account is deleted it is retained for 30 days and then permanently removed, so that an accidental deletion can be reversed.

Workspace records are kept for the life of the workspace, because their retention is your decision rather than ours. Authentication and access logs are kept for 12 months. Marketing records and enquiries sent through the contact form on this site are kept for 24 months.

When we keep something longer

We may retain information beyond these periods where the law requires it, or where it is needed to establish, exercise or defend a legal claim. Backups are overwritten on their own cycle, so data can persist in a backup for a short period after it is deleted from the live system.

How data is protected

Every record in Avanta is scoped to its workspace, and access within a workspace is governed by role. Passwords are stored hashed. Traffic is served over HTTPS with strict transport security, framing and content-type protections applied. Requests are validated before they reach the database, and rate limits apply to the application, to authentication and to public forms.

The honest limit

No method of transmission over the internet, and no method of electronic storage, is completely secure. We work to protect your data but cannot guarantee absolute security, and you should keep your own copies of anything critical to your business.

What you can ask for

You may ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask for it in a portable form, object to or ask us to restrict a particular use, or withdraw consent you have given for marketing.

Where the data is inside a workspace run by your employer or another organisation, that organisation decides what happens to it. We will pass your request on to them and help them act on it.

How to make a request

Send requests through the Avanta contact page. We will respond within 30 days. Avanta does not yet offer self-serve deletion of an account or a workspace, so closure and erasure are handled as a request, and we confirm it with a workspace administrator before acting.

• Make a request

Minimum age

Avanta is a tool for businesses and is not directed to anyone under 16. We do not knowingly collect personal data from children under 16. If we learn that we hold such data, we will delete it. If you believe a child has given us personal data, please tell us.

Providers that process data for us

The Avanta application relies on the following providers, each processing data only to deliver its part of the service: a PostgreSQL database for the primary data store; Upstash Redis for caching and rate limiting; Cloudflare R2 for uploaded files; Better Auth, with optional Google sign-in, for authentication; Resend, Gmail and Outlook for sending and syncing email; Telegram for connected messaging; Firebase for browser notifications; Sentry for error reporting; and Leaflet with Nominatim for maps and address lookup.

This website uses none of them. It has no back end of its own beyond serving these pages.

Integrations you connect

Connecting an email, messaging, notification or mapping integration authorises Avanta to exchange data with that service on your behalf. Those services are governed by their own terms and privacy policies, and what they do with the data is outside our control.

Leaving this site

Selecting Sign in takes you to the Avanta application, which is hosted separately. Following any external link from this site takes you somewhere this policy does not reach.

Where data is processed

The providers above operate internationally, so personal data may be transferred to and processed in the United States, Singapore and other jurisdictions outside Cambodia.

Where data leaves Cambodia we rely on Standard Contractual Clauses or an equivalent legal mechanism to require a comparable level of protection from the provider receiving it.

If something goes wrong

If we confirm a breach affecting personal data, we will notify the account holders and workspace administrators concerned, and any competent authority the law requires us to inform, without undue delay. The notice will describe what happened, what data was involved, what we have done about it, and what we suggest you do.

How we update it

The current version of this policy is always published on this page, with its version number and the date it was last updated shown at the top.

For a change that materially affects how we handle your data, we will give notice through the platform or by email before it takes effect. Continuing to use Avanta after a revision takes effect means you accept it.

Applicable law

This policy is governed by the law of the Kingdom of Cambodia, and any dispute arising out of it is submitted to the competent courts of Phnom Penh. It forms part of the Avanta terms of service.

• Read the Avanta terms of service

How to reach us

Questions about this policy, requests about your personal data, and reports of anything that looks wrong all come to us through the Avanta contact page.

Tell us which workspace your message concerns, if it concerns one, so we can route it to the right place.

• Contact Avanta