Privacy Policy

Avrosh provides AI that answers a business's calls and messages, and takes bookings and orders. This policy covers three surfaces: the marketing site at avrosh.com, the operator dashboard at app.avrosh.com, and the customer chat at go.avrosh.com.

For customer conversations, the business you interact with is the data controller of its own content; Avrosh acts as its processor. For operator accounts, Avrosh is the controller of the business account and billing data described below.

Customers. The QR chat needs no account, no phone number and no login. Nothing personal is required to start a chat. We process only the conversation content and any booking or order details a customer chooses to share.

Operators and staff. Business accounts hold a name, email, business details and billing information, plus the content each business enters (its own knowledge base, prices, hours and services).

We process the business content an operator enters so Avrosh can answer from it, and customer messages so it can help and route requests to staff.

For voice calls: no call audio is recorded or stored. Audio exists only in flight, long enough to be transcribed and answered. What is kept is a written transcript and a call record holding the caller's number, the time, the duration, the language and a summary. A transcript can contain anything the caller said, so treat it as the sensitive artifact it is. Because no audio is retained, we cannot produce a recording for a dispute or a regulator.

We do not build advertising profiles, and we never sell personal data.

Avrosh is operated by PT Laras Teknologi International, a company incorporated in Indonesia. GDPR Article 13 asks for the controller's identity, and until now this page did not give one.

Two laws apply to us at once, and neither substitutes for the other. The GDPR applies extraterritorially under Article 3(2), because we offer services to people in the European Union: most of our customers are there and in the United States, so this page is written on the basis that it applies rather than that it might. Indonesia's Law 27 of 2022 on Personal Data Protection applies because we are an Indonesian company.

Two gaps we would rather state than have found. Indonesia has no EU adequacy decision, so transfers of EU personal data to us rely on standard contractual clauses and a transfer impact assessment, provided with a signed agreement. And a representative in the EU under Article 27 is being appointed and is not yet in place; when it is, it will be named here.

Under the GDPR we rely on: performance of a contract (running the service for operators), legitimate interests (operating, securing and improving the service), and consent (for any marketing messages, which you can withdraw at any time).

We use a small set of vendors to run the service: model inference, speech synthesis and speech-to-text for the AI, a payments provider for subscriptions, hosting for the application and database, and an email provider for transactional mail. The current list, with purpose and region, is on our Security & Trust page.

Data is processed and stored in the region your business is assigned to: Virginia, Singapore or Frankfurt. Where data originates in another region, transfers rely on appropriate safeguards such as standard contractual clauses.

Every business is isolated with row-level security at the database layer, so one business can never read another's data. Traffic is encrypted in transit. More detail is on the Security & Trust page.

We would rather state this accurately than comfortably. What is actually pruned on a schedule today: platform bookkeeping rows after fourteen days, internal error logs after thirty, a deleted business and soft-deleted catalogue rows after seven, and past booking ranges nightly. Conversations, chat sessions, call records and their written transcripts have no automatic prune. They are kept for the life of the account and removed when the business is deleted. A committed retention period for conversation and call data will be published here once the job that enforces it exists.

We use no advertising pixels and no third-party ad trackers, on this site or in any customer chat. Only strictly necessary cookies (such as a session cookie) are used to run the product.

You can request access to, export of, or deletion of your data. Customers on the QR chat have nothing personal collected to begin with. Where a customer holds an account with a business, export and erase tools are built into the product and are a click rather than a support ticket. An operator-side export of your own business content is not self-serve yet, so a copy is provided on request. You can also write to hello@avrosh.com. We will not discriminate against you for exercising these rights.

The service is intended for businesses and is not directed at children.

If this policy changes materially we will update this page and its date. Questions go to hello@avrosh.com.