Privacy Policy
Last updated: October 19, 2026
Avior is a brand of Avior Technology, Inc. ("Avior", "we", "us" or "our"), a financial technology company. This Privacy Policy describes how we process personal information that we collect through our website, mobile application, and related services that link to this Privacy Policy (collectively, the "Service"), as well as through our marketing and other activities described here. We may provide additional or supplemental privacy notices for specific products at the time we collect personal information.
For clarity, this Privacy Policy does not apply to any decentralized aspect of the public blockchains we interact with that we do not control.
European users: please see the "Notice to European Users" section below for additional GDPR / UK GDPR information.
Personal information we collect
Information you provide to us.
- Contact data, such as your first and last name, email address, mailing address, and phone number.
- Demographic data, such as your city, country of residence, postal code, and age.
- Profile data, such as username, password, avatar, date of birth, company details, and information you add to your account.
- Business data (for business accounts), such as company name, registration details, beneficial-ownership information, and authorised-signatory details.
- Communications data based on our exchanges with you.
- Marketing data, such as your preferences for receiving our communications.
- Transactional data, such as information relating to your transactions, including transaction numbers and history.
- Blockchain activity data, such as wallet address, transaction number, sender and recipient, amount, and on-chain history associated with your account or wallet.
- Financial data, such as your account or wallet balance and associated information.
- Government-issued identification data, such as national identification number, tax identification number, passport or ID number, and an image of the relevant document, collected for identity verification.
Identity verification and biometric data. To verify your identity (KYC/KYB), we use a third-party service provider, Sumsub, which collects and uses biometric information, including facial data, from your ID document to match against your live image. Avior does not directly store this biometric data. It is held by Sumsub pursuant to its privacy notice, and retained for the period required by applicable anti-money-laundering law (typically up to five years after the end of the business relationship), after which it is deleted.
Third-party sources. We may combine information you provide with information from public sources (government agencies, public records, public blockchains), private sources (data providers, sanctions and screening lists), our service providers, and business-transaction partners.
Automatic data collection. We and our providers automatically log device data (device type, OS, browser, IP address, identifiers, general location), online activity data (pages viewed, navigation, access times, email opens and clicks), and communication-interaction data. When you join our waitlist, we derive your approximate country from your IP address and store only the two-letter country code, never the IP address itself. To protect our waitlist and application forms from automated abuse, we use Cloudflare Turnstile. When you submit one of these forms, Cloudflare, Inc. processes information about your browser and device and your IP address to check that the request comes from a person. Cloudflare acts as our service provider for this purpose. See Cloudflare’s privacy policy at https://www.cloudflare.com/privacypolicy/.
How we use your personal information
- Service delivery and operations: to provide and operate the Service, enable security features, establish and maintain your account, communicate with you, and provide support.
- Personalization: to understand your needs and tailor your experience.
- Improvement and analytics: to analyse usage and improve the Service.
- Marketing: to send you communications, which you can opt out of at any time.
- Compliance and protection: to comply with applicable law (including anti-money-laundering, KYC/KYB, sanctions and tax-reporting obligations), respond to lawful requests, enforce our terms, and prevent and investigate fraud and illegal activity.
- Aggregated/de-identified data: to create and use anonymized data for lawful business purposes.
How we share your personal information
- Corporate affiliates.
- Service providers that operate the Service or our business, including regulated account and payment infrastructure providers, self-custodial wallet infrastructure (Privy), card program management and issuing (our card program manager and the card issuer, Third National), identity verification (Sumsub), card wallet provisioning (for Apple Pay / Google Pay, where offered), AI-assisted features (Google, for the AI CFO, only after you allow it; see "AI CFO" below), customer-support tooling (Chatwoot), bot and abuse protection (Cloudflare Turnstile), hosting, analytics, and communications.
- Third parties designated by you, including for KYC/KYB and AML checks.
- Partners with whom we jointly offer or co-promote products.
- Authorities and others, where necessary to comply with law or protect rights, safety and property.
- Business transferees, in connection with a merger, acquisition, financing, or insolvency.
- Other users and the public: due to the nature of blockchain, any data written to a public blockchain will be visible to others and may be used to identify you through your public wallet address. We are not responsible for such use.
Our service providers, including Google for the AI CFO, Sumsub for identity verification, Privy for wallet infrastructure and Chatwoot for customer support, may use personal information only to provide their services to us, and are bound by written agreements to protect it with the same or equal protection described in this Privacy Policy.
AI CFO (optional assistant)
The AI CFO is an optional assistant in Avior that answers questions about your own Avior accounts. It only works after you allow it: we ask you before your first message, and you can turn it off at any time in Settings, under Legal (AI CFO). If you do not allow it, nothing is sent to our AI provider, and the rest of Avior, including our human support, works as before.
Who receives the data. To answer you, Avior sends data to Google, which runs the Gemini models for us on Google Cloud (Vertex AI). Google acts as our service provider (data processor) under the Google Cloud Data Processing Addendum. Requests may be processed in any Google Cloud region.
What is sent.
- What you type to the AI CFO, and the suggested questions you tap.
- The earlier messages and answers in the same conversation.
- Basic profile facts: your name, your country of residence, whether your account is personal or business (individual or company), and its verification status.
- Facts you ask the AI CFO to remember.
- The account data the AI CFO looks up to answer you: your balances; your transactions (date, amount, direction, method, status, category, and the name of the person or business you paid or were paid by, or the payment note when there is no name); totals calculated from them (income, spending by category, cash flow, runway, and comparisons between periods); and cashback or yield earned and your plan.
We do not send your email address, phone number, home address, date of birth, identity documents or selfie, card numbers or PIN, bank account numbers, or passkeys.
Why. Only to answer your questions and to show the related figures, charts and links in the app.
How long we keep it. Avior keeps your AI CFO conversations (your questions, the answers and the account data looked up for them) and the facts you asked it to remember in a separate database, so you can return to past conversations. They are deleted with your account, except what the law requires us to keep. You can also ask us to delete them sooner at legal@useavior.com. The app also keeps a copy of recent conversations on your device for up to 7 days and removes it when you sign out.
What Google does with it.
- Under Google Cloud's terms, Google will not use this data to train or fine-tune AI models without our permission, and we have not given that permission.
- Google processes it only on our instructions, to provide, secure and monitor the service.
- If Google's automated safety systems flag a request as possible abuse, Google may keep that prompt for up to 90 days solely to check it against its policies; it is not used for training.
When you ask for a person. If you switch from an AI CFO conversation to our support team, the support team receives a summary of that conversation, written by the AI, or the conversation itself, in our customer-support tool (Chatwoot). Your support conversations are deleted with your account too, except what the law requires us to keep.
Your choices. You can turn the AI CFO off in Settings at any time; from then on nothing more is sent to Google. Turning it off does not affect processing that already happened. To have your stored conversations deleted, email legal@useavior.com.
Retention
We retain personal information for as long as necessary to fulfil the purposes for which we collected it, including legal, accounting, regulatory and fraud-prevention requirements. AML/KYC records are retained for the period required by law (typically up to five years after the end of the business relationship). When no longer required, we delete, anonymize, or isolate the data from further processing.
Your choices
- Access or update your account information by logging in.
- Delete your account in the app (Settings, Delete account) or at www.useavior.com/delete-account.
- Withdraw your AI CFO permission in the app (Settings, Legal, AI CFO).
- Ask us to access, correct or delete your personal information at legal@useavior.com. We keep the records that anti-money-laundering law requires, as described under Retention.
- Opt out of marketing via the unsubscribe link in our emails.
- Cookies: see our Cookie Policy and manage preferences in your browser.
- Declining to provide information: we need certain information to provide the Service and to meet legal obligations; without it we may not be able to provide some or all of the Service.
Note: due to the nature of blockchain, neither you nor Avior may be able to delete transactions already recorded on a public blockchain.
Security
We employ technical, organizational and physical safeguards designed to protect personal information. However, no system is completely secure and we cannot guarantee absolute security.
International data transfers
Avior Technology, Inc. is based in the United States (Delaware) and may use service providers in other countries. Your personal information will be processed in the United States and may be transferred to other countries whose laws may not be as protective as those in your country. European users should read the transfer information in the Notice to European Users below.
Children
The Service is not intended for anyone under 18. If we learn we have collected personal information from a child without required consent, we will delete it in accordance with applicable law.
Changes to this Privacy Policy
We may modify this Privacy Policy at any time. Material changes will be notified by updating the date and posting on the Service or by other appropriate means.
How to contact us
Email: legal@useavior.com
Avior Technology, Inc., c/o Entrepreneur First, 501 Folsom Street, Floor 1, San Francisco, CA 94105, United States
Notice to European Users
This section applies to individuals in the European Economic Area (EEA) or United Kingdom.
Personal information in this Policy includes "personal data" as defined in the EU GDPR and UK GDPR.
Controller. Avior Technology, Inc. is the controller in respect of the processing covered by this Policy.
Legal bases for processing:
- Contractual necessity, where we need to process your data to deliver the Service.
- Legitimate interests, where processing is necessary for our legitimate interests and not overridden by your rights (e.g., security, service improvement, marketing of our own services).
- Compliance with law, including AML/KYC, sanctions and tax-reporting obligations.
- Consent, where required (e.g., certain marketing and optional cookies).
Your rights. Subject to applicable law, you may request access, correction, deletion, transfer (portability), restriction, and may object to processing or withdraw consent. To exercise these rights, contact us at legal@useavior.com. We aim to respond within one month.
Right to complain. You may lodge a complaint with your local supervisory authority (EEA: edpb.europa.eu; UK: ico.org.uk).
Transfers outside Europe. Where we transfer data outside Europe, we rely on adequacy decisions or appropriate safeguards (such as Standard Contractual Clauses), or, in limited cases, a permitted derogation such as your explicit consent.
No sensitive information. Please do not provide sensitive personal data except where specifically requested as part of identity verification.
No solely automated decision-making with legal effect is carried out as part of the Service.