1. Who we are
Avatorial is a service of Nextarp B.V. ("we", "us"), registered in Rotterdam, The Netherlands. For workspace content (your posts, drafts, writing corpus) your organisation is the data controller and we act as processor. For account and billing data we are the controller. Contact: info@nextarp.com.
2. What we collect and why
- Account data — name, work email, organisation identifier from your Microsoft Entra ID sign-in. Purpose: authentication and workspace membership. Legal basis: contract.
- Writing corpus — posts you upload via your LinkedIn data export or import from your own Reddit history. Purpose: building your personal voice profile. Legal basis: contract. Your corpus is used only for your own profile — never to train shared or third-party models.
- Drafts, approvals and feedback — content generated for you, your edits, approvals and reject reasons. Purpose: providing and improving your own results; maintaining the approval audit trail.
- Platform tokens — OAuth tokens you grant for LinkedIn and Reddit, stored in Google Secret Manager (never in our application database). Purpose: publishing with your consent. Revocable at any time from the platform or by disconnecting the account.
- Media — photos/videos you upload for posts, stored in EU cloud storage.
- Billing data — subscription status and invoicing handled by Stripe; we never see full card numbers.
- Service logs — technical request logs (IP, timestamps, endpoints) for security and reliability, retained max 90 days.
3. Where your data lives
All application infrastructure runs on Google Cloud in the European Union (region europe-west1, Belgium): application servers, database, media storage, and AI processing (Google Vertex AI, in-region).
4. Sub-processors
- Google Cloud EMEA (hosting, storage, AI processing) — EU
- Stripe Payments Europe (subscription billing) — EU/US with SCCs
- Microsoft Ireland (Entra ID sign-in) — EU
5. AI processing
Drafts are generated by large language models (Google Vertex AI) using your voice profile and, where relevant, content you provided (photos, hints, posts you chose to reply to). Model inputs and outputs are processed in the EU and are not used by us or by Google to train foundation models. Every AI-generated draft requires your explicit human approval before publication.
6. Retention
- Workspace content: for the life of your subscription; deleted within 60 days after account closure (or on request).
- Platform tokens: destroyed immediately when you disconnect an account or close your workspace.
- Audit log: retained with the workspace, as an integral record of approvals.
- Invoices: retained per Dutch tax law (7 years).
7. Your rights
Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing. Write to info@nextarp.com; we respond within 30 days. You may lodge a complaint with the Dutch DPA (Autoriteit Persoonsgegevens).
8. Cookies
The application uses a single strictly-necessary session cookie. The marketing site sets no analytics or advertising cookies.
9. Changes
We will announce material changes to this policy by email to workspace owners and by updating the date above.