AvartanBack to site

Privacy Policy

Avartan · avartan.ai · avartan.com.au — Effective date: 11 August 2026 · Last updated: 14 August 2026

This Privacy Policy explains how Innovation Engine Global Pty Ltd (ABN 94 668 670 675) ("Avartan," "we") collects, uses, and shares personal data when you use avartan.ai, avartan.com.au, our applications, and APIs (the "Service").

Summary: We collect account info, content you upload, data from social accounts you connect, and usage data. We use it to run the Service (including sending your content to AI providers and publishing to social platforms at your direction). We don't sell personal data. You can export or delete your data.

1. Data We Collect

You provide:

  • Account data — name, email, password (hashed), profile photo; workspace and team details.
  • Brand data — your website URL and the brand profile generated from it; brand angles, tone rules, audience descriptions.
  • Content and media — images, videos, demo recordings, scripts, captions, and AI generation prompts; media you upload to your media bank.
  • Likeness data — if you create AI influencers/avatars from photos of a real person, those images (and any voice samples) are processed to generate content. Upload a real person's likeness only with their consent.
  • Payment data — processed by our payment processor (e.g. Stripe); we receive plan, transaction status, and last-4/card brand only.
  • Communications — support requests, feedback, survey responses.

From connected accounts (with your authorization):

  • Social account identifiers, handles, profile metadata, and OAuth tokens for TikTok, Instagram, YouTube, and Google sign-in.
  • Post metadata and performance metrics (views, likes, comments) for content published via the Service.

Collected automatically:

  • Usage and device data — pages viewed, features used, IP address, browser/OS, approximate location (from IP), cookies and similar technologies (see the Cookie Policy).
  • Logs and diagnostics — error reports, API request metadata.

Website analytics (optional feature): if you install our tracking script on your website, we collect visit data about your site's visitors on your behalf. For that data you are the controller and we are your processor; you are responsible for disclosing this in your own privacy notice and obtaining any required consents.

2. How We Use Data

  • Provide and operate the Service: generate brand profiles and content, schedule and publish posts, show analytics.
  • Process content through third-party AI providers (e.g. model hosts for image/video/text generation). We send only what is needed to fulfill your generation request. We contractually require providers not to use your inputs or outputs to train generally-available models. (Confirm this matches your actual provider agreements before publishing.)
  • Billing, account management, and enforcing plan limits.
  • Service communications (transactional emails, digests you enable) and, with your consent where required, marketing emails (opt out anytime).
  • Security, fraud and abuse prevention, and debugging.
  • Legal compliance.

We do not sell personal data and do not share it for cross-context behavioral advertising.

AI training: we do not use Your Content to train our own foundation models. We may use aggregated, de-identified usage statistics (e.g. which content formats perform best) to improve the Service.

3. Legal Bases (EEA/UK)

The Service is not currently directed to or offered in the EEA or United Kingdom. If the GDPR/UK GDPR nonetheless applies to a particular processing activity, we process personal data on these bases: contract (providing the Service), legitimate interests (security, product improvement, B2B marketing), consent (optional cookies, certain marketing, likeness processing where required), and legal obligation (tax, accounting).

4. Sharing

We share personal data with:

  • Service providers / subprocessors — hosting and database, AI model providers, payment processing, email delivery, error monitoring, customer support tooling, search. A current subprocessor list is available on request at [email protected].
  • Social platforms — content, captions, and scheduling instructions are sent to platforms you connect, at your direction.
  • Your workspace — teammates in your workspace can see workspace content and activity.
  • Legal — when required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale (with notice).

5. International Transfers

We are based in Australia and may process data in Australia, the United States, and other countries where our service providers operate. We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles, and where required we rely on appropriate safeguards such as Standard Contractual Clauses.

6. Retention

  • Account data: for the life of the account and up to 90 days after deletion.
  • Content and media: until you delete it or your account is deleted; backups purge on a rolling 30-day cycle.
  • OAuth tokens: until you disconnect the account or delete your account.
  • Billing records: as required by tax and accounting law (typically 7 years).
  • Logs: typically 90 days.

7. Google / YouTube API Disclosure

Avartan's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If you connect YouTube, we use the YouTube API Services; you can revoke access at https://myaccount.google.com/permissions. Google's Privacy Policy: https://policies.google.com/privacy.

8. Your Rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data, and to withdraw consent.

  • Self-serve: export or delete your data in Settings, or disconnect social accounts at any time.
  • Requests: email [email protected]. We respond within the legally required timeframe and may verify your identity.
  • Australia: you may access and correct your personal information under the Privacy Act 1988 (Cth). If you have a complaint, contact us first; if unresolved, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
  • California: we do not "sell" or "share" personal data as defined by the CCPA/CPRA. You may exercise rights to know, delete, correct, and non-discrimination via [email protected]. Authorized agents may submit requests with proof of authorization.

9. Security

We use industry-standard measures: encryption in transit, encryption at rest for stored media and tokens, access controls, and audit logging. No system is perfectly secure; notify us at [email protected] of any suspected vulnerability or breach.

10. Children

The Service is not directed to anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us data, contact [email protected] and we will delete it.

11. Changes

We will post updates here and, for material changes, notify you by email or in-app notice before they take effect.

Controller / Contact: Innovation Engine Global Pty Ltd (ABN 94 668 670 675), 81-83 Campbell Street, Surry Hills NSW 2010, Australia · [email protected]