Privacy Policy

This Privacy Policy explains how Aevon LLC (“Aevon,” “we,” “us”) collects, uses, and protects information when a business (a “Client”) uses the Aevon client portal at portal.aevon.io (the “Portal”) and our AI receptionist service, which answers a Client’s phone and, where the Client connects them, its business WhatsApp, Instagram and Facebook Messenger messages (the “Service”). It works alongside the agreement between Aevon and each Client.

Who this covers

• Client account users — the business owner/administrator we work with, who logs into the Portal.
• A Client’s own customers/callers — people who call a Client’s AI receptionist. Each call is handled by Retell (our voice-AI provider, an outside service that processes data for us) on the Client’s behalf, and what was said on it is kept in the Portal like a message conversation; see “Calls” below.
• People who message a Client — people who write to a Client’s business WhatsApp or Instagram account, or message its Facebook Page on Messenger, after the Client has connected it to the Service; see “Message conversations” below.

For a Client’s customers, callers and the people who message them, the Client decides how that data is used (in legal terms, the Client is the “data controller”) and Aevon simply follows the Client’s instructions and our service agreement (acting as their “processor”).

What we collect

Category	Examples	Source
Account & business info	Business name, category, location, contact name, login email	You, from our first conversation about the Service
Credentials	Password (stored only in a scrambled form that can’t be read back — never as plain text)	You
Configuration	Business hours, report/summary-email preferences, the Client’s access key for Retell, our voice-AI provider (encrypted while stored)	You / setup
The Client’s own phone numbers	Where a Client’s calls come in on numbers in its own Twilio account: an access key to that account, the sign-in Retell uses to put calls through over it, which numbers we connected, and how each was set up before so we can put it back (all encrypted while stored)	The Client, at setup
Billing	Stripe customer ID, plan, and billing status (Stripe is our payment processor)	Via Stripe
Text messages	Mobile phone number and the content of messages you send to an Aevon business number	You, when you text us
Connected messaging accounts	Which business WhatsApp and Instagram accounts and Facebook Pages a Client connected (the business number, @name or Page name, and Meta’s identifiers for them), and the access Meta grants us to answer on them (encrypted while stored)	The Client, when they connect an account in Meta’s own window
Message conversations	What people write to a Client’s connected business accounts and the replies sent from them, who wrote (their identifier on that channel, their number where WhatsApp gives it, and the name the channel shows), why a conversation was passed to a person, and notes the Client’s team writes on a conversation (all encrypted while stored, and deleted after 90 days)	People who message the Client, the Client, and the Client’s receptionist
Calls	What was said on each call to a Client’s receptionist, as text (never the recording), a one-line summary of the call written by the receptionist, the number the call came from, and when (all encrypted while stored, and deleted after 90 days)	People who call the Client, and the Client’s receptionist
Usage & support	Login/session activity, admin audit logs, support messages	Automatic / you

What we do not store

We deliberately keep little about the people who contact a Client. The Portal never keeps call recordings, and beyond the conversations described here it keeps no details about the people who call or message a Client.

The exception is a Client’s conversations on its public lines: message conversations on its business WhatsApp and Instagram accounts and its Facebook Page’s Messenger, and what was said on calls to its receptionist, kept as text. We keep them for 90 days so the Client can read and continue them, and so their receptionist does not ask a returning customer everything twice (see “Calls” and “Message conversations” below). We never keep photos, videos or voice notes sent in those conversations; we keep only the reference Meta gives us to show them while Meta still has them. We keep no profile of the people who call or message a Client beyond the conversations themselves and the notes the Client’s team writes on them.

SMS/Text Messaging

When you text our business number — (754) 331-8500 — we collect your mobile phone number and the contents of your messages in order to respond to you.

We do not share or sell mobile phone numbers or SMS consent to third parties for marketing or promotional purposes. Mobile information is not shared with third parties or affiliates for marketing purposes. Information may be shared with subprocessors that support the messaging service itself — for example, our telephony provider — solely to deliver messages on our behalf.

Message frequency varies and depends on the conversation. Message and data rates may apply.

Reply STOP at any time to opt out of further messages. Reply HELP for assistance.

Account notifications to Clients. Where a Client has its receptionist answer its WhatsApp, Instagram or Messenger messages, we text the Client’s account holder, at the number they give us, when one of their customers needs a person — saying which customer and what they need in a few words — and once more as a reminder if nobody has replied. These are notifications about the Client’s own Service, not marketing. The account holder can reply STOP to stop them.

Apart from those account notifications, we only send messages in reply to conversations you start. We do not maintain a marketing list and do not send unsolicited or bulk messages.

Messages may be handled by an automated assistant. You can ask to speak with a person at any time.

How we use information

• Provide, operate, and support the Service and Portal.
• Authenticate users and secure accounts.
• Process billing through Stripe.
• Send routine service emails (welcome messages, password resets, reports and summaries) through Google Workspace / Gmail, our email provider.
• Deliver the messages callers leave for a Client, and complete the bookings and emails a Client’s receptionist makes on their behalf.
• Answer the messages people send to a Client’s connected WhatsApp and Instagram accounts and Facebook Page, pass a conversation to the Client when it needs a person, and step back when the Client replies themselves.
• Help our team run the Service and our business — working a Client’s requests, setting up and looking after their receptionist, planning our outreach to local businesses, and reviewing our own accounts — using an AI assistant (Anthropic). We remove people’s names, phone numbers and email addresses before anything reaches it. Names are removed wherever we recognise them, so a name someone types into free text, such as a request or a note, may occasionally get through.
• Keep our own team informed — a morning summary and alerts to Aevon staff in a team group chat (Telegram), naming the businesses on that day’s plan, figures from Clients’ accounts, and the follow-ups our team has set itself. Phone numbers and email addresses are removed before anything is sent; a name our team writes into a follow-up note may get through.
• Keep activity logs for security and accountability.

We do not sell or share personal information (including for cross-context behavioral advertising). Neither Aevon nor our subprocessors use Client or caller data to train AI models for the benefit of other customers; we use data only as needed to provide and operate the Service.

Subprocessors

We use the following outside services to run the Service. Each one handles a limited type of data under its own data-protection terms:

Subprocessor (outside service that handles data for us)	Purpose	Data
Retell (our voice-AI provider)	AI voice agent (the core product), and the AI that writes a Client’s replies to messages	Calls while they happen, then each call’s recording and transcript with personal details removed, deleted after 90 days; for messages, the conversation while a reply is being written (including the earlier messages with that person and their WhatsApp number), deleted when that exchange ends
Meta (WhatsApp, Instagram and Messenger)	Receiving and sending the messages on a Client’s connected business accounts	What people write to the Client and the replies, and the identifiers Meta uses for them
Neon (our database host)	Portal database	Client account & settings, and kept conversations: messages and what was said on calls (encrypted)
Stripe (our payment processor)	Billing & payments	Billing/payment data
Vercel (our hosting provider)	Hosting	Data while it moves between systems
Twilio (our telephony provider)	Text messaging with our business numbers, including the account notifications we send Clients	Mobile phone number & message content (for a notification, the customer’s name as the channel shows it and what they need)
Google Workspace (our email)	Routine service email, delivering callers’ messages to the Client, and a hand-over notification by email when a Client has given us no number to text	Recipient email + message content
Activepieces (our automation provider)	Completing the bookings and messages a Client’s receptionist takes	The details a caller gives to book or leave a message (such as name, number, and reason), passed through and not kept by the Portal
SendGrid (our customer-email provider)	Emails a Client’s receptionist sends to that Client’s customers, such as booking confirmations	Recipient email + message content
Anthropic (our AI assistant provider)	Helping our team work a Client’s requests, look after their receptionist, plan outreach to local businesses and review our own accounts	Business details, settings, the text of requests, our notes on businesses we approach and our own transactions, with people’s names, phone numbers and email addresses removed first (names wherever we recognise them)
Telegram (our team chat)	A morning summary and alerts to Aevon staff	Business names, figures from Clients’ accounts and our team’s follow-up notes, with phone numbers and email addresses removed first

Data sharing & disclosures

We share personal information only as needed to run the Service:

• With the subprocessors listed above, each acting on our instructions under its own data-protection terms.
• At a Client’s direction — for example, configuration or data the Client asks us to handle on their behalf.
• When required by law — to comply with a valid legal request, enforce our agreements, or protect the rights, safety, and security of Aevon, our Clients, or others.
• In a business transfer — if Aevon is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this policy.

We do not sell or share personal information for cross-context behavioral advertising.

Mobile numbers and SMS consent are carved out of the above. No mobile phone number, and no SMS consent, is shared with or sold to any third party or affiliate for marketing or promotional purposes — under any of the circumstances listed in this section. Those details are disclosed only to the subprocessors that deliver messages on our behalf, and only where required by law.

Calls

• Every call to a Client’s receptionist begins by telling the caller that the call may be recorded.
• Calls are handled inside Retell, our voice-AI provider. Retell keeps each call’s recording and transcript with personal details removed (such as names, phone numbers, addresses and card numbers) for 90 days, so our team can check how a call went, and then deletes them.
• When a call ends, the Portal keeps what was said on it, as text, and a one-line summary of the call written by the receptionist, in that caller’s conversation with the Client, encrypted, and deletes them 90 days later. The Portal never keeps the recording. Nothing is kept from a call where the caller said nothing, or from our own test calls.
• Kept calls are treated exactly like message conversations: the Client and our team can read them, each opening by our team is logged, nothing from them reaches our AI assistant provider or our team chat or is used to train AI models, and they are deleted at once when the Client’s account is deleted (see “Message conversations” below).
• The Service is designed for general businesses and is not designed to handle protected health information under HIPAA; Aevon does not act as a HIPAA business associate.
• Callers should direct any requests about their own data to the Client they called; Aevon will help the Client respond as required under our agreement and applicable law.

Message conversations

• When a Client connects its business WhatsApp or Instagram account or its Facebook Page, it does so in Meta’s own window; its password never reaches us. Meta then sends us the messages people write to that account, and lets the Client’s receptionist reply.
• Each reply is written by Retell, our voice-AI provider, which holds that conversation only while the exchange runs; we delete it at Retell when the exchange ends, at the latest after a day without new messages.
• Conversations are kept encrypted in the Portal and deleted 90 days after each message was written. All of a channel’s kept conversations are deleted at once when the Client turns that channel off, when the Client removes our access in their WhatsApp, Instagram or Facebook settings, when Meta tells us the account has ended, or when the Client’s account is deleted. Routine backups of our database age out within 30 days.
• The Client’s team can write notes on a conversation. They are read like the conversation itself (by the Client, and by our team as described below), never shown to the person it is about. Notes are encrypted, deleted 90 days after they are written, and deleted with the conversation.
• The Client can read its own conversations. Our team can also read them, to check and improve the receptionist’s answers and to help the Client, and each time someone on our team opens a conversation it is logged.
• None of it — no name, number, message or note from these conversations — is sent to our AI assistant provider or our team chat, or used to train AI models.
• People who call or message a Client should direct requests about their conversations to the Client, who decides how they are used, or write to support@aevon.io. Aevon will help the Client respond, including by deleting a conversation.

Data retention & deletion

• Client account and settings data is kept while the account is active.
• Message conversations on a Client’s connected accounts are kept for 90 days, and deleted at once when that account is disconnected (see “Message conversations” above). What was said on calls is kept for 90 days too (see “Calls” above).
• If we talk with a business about the Service and it does not go ahead, what we noted (the business, and the name and email of the person we spoke with) is deleted within 90 days of our first conversation.
• When a Client leaves, we delete the Client’s Portal account (which also removes the stored Retell key and access, the stored Twilio key and sign-in, the access to their WhatsApp and Instagram accounts and Facebook Page, and every kept conversation), then clear any incidental copies after a 30-day grace period. Where the Client’s numbers are in its own Twilio account, the numbers and what we set up there to carry their calls stay in that account and remain the Client’s; on request we put each number back as it was.
• Call recordings and transcripts held in Retell, with personal details removed, are deleted after 90 days.

For the full details — what we keep, for how long, and the exact steps when a Client leaves — see our Data Retention & Deletion Policy.

Security

• Passwords are stored only in a scrambled form that can’t be reversed back into the original; Retell and Twilio keys, email secrets, the access to Clients’ WhatsApp and Instagram accounts and Facebook Pages, and kept conversations are encrypted while stored using strong, industry-standard encryption.
• We use secure login sessions; you can “sign out everywhere” and sign out individual devices.
• Each staff member has their own account secured with a passkey or a second login step (two-factor authentication), and staff get only the access they need to do their job.

Security incident notification

If a security incident affects personal information we hold, we will notify affected Clients without undue delay and no later than the timelines required by applicable law or committed to in our agreement with the Client. Clients are responsible for notifying their own customers/callers where required.

Clients, offices and callers outside the United States

Aevon is based in the United States, and we process and keep personal information in the United States. A Client may be based outside the United States, and a Client’s receptionist may answer the phone for its offices in other countries. When someone calls or messages a Client from anywhere in the world, what they say and the details described in this policy are processed and kept in the United States, as described here. Some subprocessors may process limited data outside the United States; where they do, they provide appropriate safeguards (such as Standard Contractual Clauses).

Where the law of a caller’s country applies to how their information is used — for example the UK or EU General Data Protection Regulation — the Client, who decides how that information is used, is responsible for the notices and the lawful basis that law requires for using the Service, and Aevon processes the information on the Client’s behalf under our agreement and helps the Client meet those obligations, including requests from the people the information is about. Every call to a Client’s receptionist begins by telling the caller that the call may be recorded and that they are speaking with an AI receptionist.

Automated decision-making

Aevon does not use the personal information of account users to make automated decisions that produce legal or similarly significant effects, and does not engage in profiling for such purposes.

Your choices & rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Know / access the personal information we hold about you.
• Correct inaccurate personal information.
• Delete your personal information.
• Opt out of the sale or sharing of personal information — note that we do not sell or share personal information for cross-context behavioral advertising.
• Limit the use of sensitive personal information.
• Non-discrimination for exercising these rights.

Account users: submit a request by emailing support@aevon.io. We will respond within the timeframe required by applicable law (for example, within 45 days for verifiable consumer requests under the CCPA, with an extension where permitted). We may need to verify your identity before acting.

A Client’s customers/callers: because the Client decides how that data is used, please direct requests to the Client. Aevon will support the Client in responding as required under our agreement and applicable law.

California & U.S. state privacy disclosures

For residents of California and other U.S. states with comprehensive privacy laws, the personal information we collect maps to the following statutory categories:

• Identifiers — business and contact name, login email, and account identifiers; for people who message a Client, their identifier on that channel, their WhatsApp number where given, and the name the channel shows.
• Commercial information — plan, billing status, and transaction records (via Stripe).
• Internet or other electronic network activity — login/session activity and admin audit logs.
• Audio, electronic, visual, or similar information — the text of message conversations on a Client’s connected accounts.

We collect this information from the sources, and use it for the business purposes, described above, and disclose it only to the subprocessors and in the circumstances listed in Subprocessors and Data sharing & disclosures. We do not sell or share personal information and do not use sensitive personal information for purposes that would require a right to limit.

Cookies

The Portal uses only a small login cookie that is strictly necessary to keep you signed in. We use no outside analytics or advertising cookies and do not track you across other websites.

Children

The Service is for businesses and is not directed to children. Where a Client’s callers may include minors, the Client remains responsible for any notices or consents required under COPPA or applicable state law.

Changes

We may update this policy; material changes will be posted here with a new effective date, and we will email account administrators.

Versioning & annual review. Aevon maintains this document under version control and reviews it at least once a year, updating it as needed; any material change takes effect and is communicated in accordance with the change, amendment, and notice provisions set out in this document.

Contact

Aevon LLC  ·  support@aevon.io