YOUR DATA
Privacy policy.
The privacy information for the app, and the information specific to this presentation site.
Last updated: 17 September 2026.
Courtesy translation. The French version is the binding one in the event of any discrepancy.
This policy describes the data processed by the AVYOR mobile app and by this presentation site. It is written from how the product actually works. The publisher’s identification details, the exact retention periods and the transfer safeguards are still to be completed before going live: they are flagged as such rather than estimated.
1. Who we are
AVYOR is a mobile app that connects Creators and brands so they can discover profiles, publish campaigns and run content collaborations. The product is operated by Shavod.
To be completed before publication: The publisher’s registered name, legal form, share capital, company registration number, VAT number and registered address.
2. Scope
This policy covers two distinct perimeters: the AVYOR mobile app, which is built around a user account, and the presentation site you are reading, which has none. The processing that applies to each is described separately below.
3. This presentation site
This site is hosted by Vercel and has neither an account form nor any advertising tool. It measures its traffic with Vercel Web Analytics and Vercel Speed Insights, two cookieless tools: no cookie is placed on your device and no lasting identifier is assigned to you. What is recorded is the page viewed, the page that led you there, the country, the device type, the operating system and the browser, along with measurements of how fast the page displays. That data is only used to understand the site’s audience and to fix what is slow; it cannot follow you from one site to another and it is neither sold nor cross-referenced with your account. A preference stored in your browser’s session memory means the intro animation only plays once; it disappears when the tab is closed and never leaves your device. Messages you send to the contact address are processed in order to answer your request.
To be completed before publication: Legal basis for audience measurement to be decided: consent exemption for audience measurement, or legitimate interest, depending on the analysis retained against the CNIL criteria. Vercel’s registered name and address to be taken from its own legal notice.
4. Data you provide to us
In the app, this data comes directly from you:
- Account: email address and password, through Supabase authentication.
- Profile: name, photo, biography, links to your social networks.
- Content: videos, portfolio items, campaign applications.
- Campaigns: brief, expected content and terms, for a brand account.
- Messages: conversations and collaboration requests.
5. Data generated by use
Using the app produces data you do not type in: views, likes and interactions with content and campaigns, how far collaborations and deliverables have progressed, and the information brought together by matching between a profile and a campaign.
6. Technical data
Running the service produces technical data: connection and security logs tied to authentication, and error reports sent to Sentry when an incident occurs. Usage measurement for the app goes through PostHog.
To be completed before publication: Precise list of the events sent to PostHog and the retention period configured with each processor.
7. Why we use your data
This data is used to provide the connection between Creators and brands, to secure your account, to run campaigns, messaging and collaboration tracking, to process payments, to send the notifications tied to your activity, and to fix technical faults.
8. Legal bases
Processing rests on performance of the contract between you and AVYOR for providing the service, on AVYOR’s legitimate interest in security and product improvement, on a legal obligation for anything relating to invoicing and fraud prevention, and on your consent where it is collected, in particular for non-essential notifications.
9. Profiles and visibility
Your profile, your videos and your portfolio are meant to be seen by other AVYOR users: that is the very function of the product. What you publish there should be chosen accordingly. Your messages, by contrast, are only visible to the people they are addressed to.
10. Campaigns and collaborations
When a collaboration begins, the information needed to carry it out is shared between the Creator and the brand concerned: the profile’s identity, the campaign content, the exchanges and the deliverables. Matching brings together profile information and campaign information to suggest relevant profiles; the final decision always belongs to the brand.
11. Messaging
Conversations are kept so that a project’s context stays available during and after the collaboration. They may be read by our teams when handling a report or a dispute, and for that reason alone.
12. Payments
Payments between brands and Creators go through Stripe. AVYOR stores no card data. Billing and payment account information is processed by Stripe as a controller for what falls under its own regulatory obligations.
13. Notifications
Notifications tell you about the activity that concerns you: a new message, a change to an application, a stage in a collaboration. They are configured from the app’s settings.
15. Processors and service providers
AVYOR relies on a limited number of technical providers:
- Vercel — hosting of this site, audience measurement and speed measurement.
- Supabase — data hosting and authentication.
- Stripe — payment and transfer processing.
- PostHog — product usage measurement.
- Sentry — technical error monitoring.
To be completed before publication: Server locations retained with each provider and references of the signed data processing agreements.
16. Data sharing
AVYOR does not sell your personal data and passes it to no data broker. Sharing is limited to the providers listed above, to the users you choose to interact with, and to the competent authorities where a legal obligation requires it.
17. Transfers outside the European Union
Some of the providers named may process data outside the European Union. That is notably the case for Vercel, a company established in the United States, which hosts this site and measures its audience.
To be completed before publication: Hosting regions actually retained and the applicable transfer mechanism for each provider, to be documented before going live.
18. Retention periods
Your data is kept for as long as your account is active. After the account is deleted, the records needed to meet legal obligations, in particular accounting ones, are kept for the required time and then deleted.
To be completed before publication: Exact periods per category of data, to be set with the publisher before publication: they are not estimated here.
19. Security
Exchanges with the service are encrypted with HTTPS/TLS. Authentication and sensitive account changes go through Supabase’s authentication system. No system is infallible: never share your password, and tell us about any unusual activity on your account.
20. Your rights
If the General Data Protection Regulation applies to you, you have the following rights over your personal data:
- Access: obtain confirmation that your data is processed and receive a copy of it.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: ask for your data to be deleted, within the limits set by law.
- Restriction: ask for processing to be frozen while something is checked.
- Objection: object to processing based on legitimate interest.
- Portability: receive your data in a structured, machine-readable format.
- Withdrawal of consent: withdraw it at any time, without affecting what came before.
21. Exercising your rights
Write to the contact address given at the end of this document, stating the email address linked to your account and the nature of your request. Do not attach passwords or full bank details.
To be completed before publication: Appointment of a data protection officer and publication of their contact details, if such an appointment is required.
22. Deleting my account
Deletion happens from the app: open Settings, then Security, and choose to delete your account. Your profile, your content and your conversations then stop being accessible to other users. If a collaboration is under way, finish it or contact support before deleting your account: records tied to a payment may have to be kept for legal reasons. If you run into difficulty, write to the contact address from the email linked to the account.
23. Minors
AVYOR is not intended for children. If we learn that an account has been created below the required age, it is deleted.
To be completed before publication: Minimum age retained for opening an account, to be aligned with the terms of use and the applicable law.
24. Changes to this policy
This policy may change along with the product. The date it was last updated appears at the top of the page, and any substantial change will be flagged to you in the app.
25. Contacting us
For any question about this policy or about your data, write to us at the contact address below.
26. Supervisory authority
If you believe your rights are not being respected, you may lodge a complaint with the competent data protection authority. In France, that is the Commission nationale de l’informatique et des libertés (CNIL), www.cnil.fr.
To be completed before publication: Lead authority to be confirmed once the publisher’s main establishment is settled.
Write to us
For any question about this document: shavod.web@gmail.com.