Privacy notice
Avora International AG (“Avora”, “we”) provides a governed common data environment in which tower companies document and manage their site portfolios. This notice explains what personal data is processed in connection with the Avora platform and this website, why, where it is stored, and the rights you have.
Privacy questions or requests: support@avoraai.ch
Concerns you would rather not raise with support can be sent to conduct@avoraai.ch. If you contact us, we process your name, email address and message content in order to respond to you.
Who is responsible
For personal data processed inside the Avora platform, our customer — the company whose deployment it is — is the data controller, and Avora processes that data on its behalf under a data processing agreement. For data you send us directly, and for this website, Avora is the controller.
Avora is domiciled in Zug, Switzerland. The Swiss Federal Act on Data Protection (FADP) applies to us, and the EU General Data Protection Regulation (GDPR) applies to processing for customers and users in the European Union. Switzerland holds an adequacy decision from the European Commission.
What data is processed
First and last name, business email address, business phone number (optional), login timestamps, and records of actions performed in the system (audit logs). Personal data may also appear incidentally inside uploaded documents and site photographs.
The Avora mobile app
The Avora app is used by survey and maintenance crews on site. It collects four kinds of data, all of it sent to the customer’s own Avora deployment and encrypted in transit:
- Your email address — to sign you in. Signing in sends a one-time code to that address; the app stores no password.
- Precise location — one satellite fix when a round begins, recorded against that round and copied onto the findings raised during it, so that work can be matched to the physical site. The app records location only while it is open and in use; it does not track you in the background.
- Photographs you take with the camera as evidence for a checklist item, a deviation or a maintenance finding.
- What you enter — checklist answers, measurements, equipment serial numbers and notes.
The app does not record audio, does not read your photo library, contacts or calendar, and contains no advertising identifier, analytics or crash-reporting software. None of the data above is used for advertising, profiling or automated decision-making, and none of it is sold or shared with third parties.
Accounts cannot be created in the app. Your account is created for you by your organisation’s Avora administrator, who can also suspend or remove it; the app has no sign-up. To ask what is held about you or to have it erased, see Your rights.
Whose data
Employees of our customers who use the platform, and staff of external partners (planners, structural engineers, construction and survey crews, general contractors) who are granted access.
Why
To authenticate users, control access to site documentation, and provide the traceability (audit trail) that our customers require of their site records. The data is not used for any other purpose — no advertising, no profiling, no automated decision-making.
Legal basis
Art. 6(1)(b) GDPR (performance of a contract) for user account data; Art. 6(1)(f) GDPR (legitimate interest in secure, traceable site documentation) for partner contact data and audit logging. Equivalent grounds apply under the Swiss FADP.
Where your data is stored
All platform data is stored exclusively in the European Union (OVHcloud, France). The primary region is Paris; backups are replicated to Gravelines, also in France, and expire automatically after 14 days.
Sub-processors
We use a small number of sub-processors. Every third party that stores, transmits or processes Avora or customer data is recorded in our sub-processor register with its jurisdiction and what it touches. Those that process personal data or customer document content are:
- OVHcloud (France, EU) — cloud infrastructure: compute, databases, object storage and backups. All customer documents and all personal data.
- Anthropic (USA; EU endpoint under contractual EU data-residency and zero-training terms) — document content: page images and extracted text sent for text recognition and data extraction.
- SendGrid (Twilio, USA) — transactional email: recipient email addresses and message bodies, including login one-time codes and the waitlist emails described below.
- Google (Google Workspace, USA) — our company email: messages you send us, including waitlist submissions, and the names and addresses in them.
- OpenStreetMap Foundation (United Kingdom) — site addresses and coordinates, sent to the public Nominatim and Overpass services for geocoding and the site-surroundings register. Site location is customer asset data rather than personal data; it is listed here for transparency.
The full register, including every vendor’s jurisdiction and what it processes, is available to customers under the data processing agreement and on request.
How long we keep data
- Customer documents, site data and extracted facts: for the duration of the contract. At contract end, or on the customer’s instruction, the data is exported and then destroyed.
- User account data: while the account exists; removed on account deletion by the customer administrator or at contract end.
- Audit logs: for the duration of the contract, then exported with the customer’s data and destroyed.
- Database backups: expire automatically after 14 days.
- Queue state backups (transient job state, no primary data): expire after 3 days.
Because each customer runs its own isolated deployment, destruction at contract end means deletion of that deployment’s databases and storage — there is no shared store to selectively scrub.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection under Arts. 15–21 GDPR, and corresponding rights under the Swiss FADP. If your data is processed in a customer’s deployment, contact that company’s data protection contact — as controller it decides on requests, and Avora supports it with export, correction and deletion functions.
Erasure requests are honoured in backups automatically: backup copies expire within the 14-day window, after which no copy of the erased data remains. Audit-log entries are append-only by design (an integrity control); erasure of a person from audit history is handled by anonymising the person reference, preserving the integrity of the audit record while removing the personal data.
You can also contact us directly at support@avoraai.ch, and you have the right to lodge a complaint with a supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).
This website
This website is served from infrastructure in the European Union. It requires no account, and we do not use analytics, advertising or profiling cookies. Its fonts are served from this site itself, not from a third-party font service. The film on the home page is streamed from our own OVHcloud object storage in France; playing it sends your browser's usual request details (such as your IP address) to that storage, and nothing is fetched until you press play.
The waitlist form
If you join the waitlist, we receive the name, work email, company, role and optional message you enter, the language of the page you used and, where you arrived through a campaign link, a short tag naming that campaign. We use them only to contact you about early access to Avora — no newsletter, no marketing lists, no profiling.
The form is not stored in a database. Each submission is sent once, by email, to our company mailbox, which is hosted by Google (Google Workspace, USA), using SendGrid (Twilio, USA) as the sending service. We keep the email for as long as we are in conversation with you about early access and delete it when you ask us to, or when it is no longer needed. Legal basis: steps taken at your request before a possible contract, Art. 6(1)(b) GDPR, and our legitimate interest in answering enquiries, Art. 6(1)(f) GDPR; equivalent grounds apply under the Swiss FADP. To have your details removed, write to contact@avoraai.ch.
Changes to this notice
We update this notice when the platform or our vendors change. The date at the top reflects the last revision.