Last updated: July 4, 2026
Avag ("we", "the extension") is a prospecting tool for creative freelancers. This policy explains, in plain language, what personal data we handle, why, on what legal basis, how long we keep it, and the rights you have under the General Data Protection Regulation (GDPR). We keep it short because we collect very little.
You control your leads. In the browser extension they stay on your own device; in your online dashboard they are stored securely in our EU database, where only you can access them. We never sell your data, never share it with advertisers, and only use your email to run your account. You can exercise your GDPR rights at any time.
The data controller for your Avag account is Ayrton Vaquer, an independent professional based in Portugal. For any privacy question or request, contact support@avag.io.
| Data | Why | Legal basis |
|---|---|---|
| Account email and password | To create and authenticate your account. Passwords are hashed by our authentication provider; we never see them in plain text. | Performance of a contract |
| Subscription status | To know whether your account is Free or Pro and to process billing. | Performance of a contract |
| Search queries | The keywords you type are sent to our search service to return results. They are not stored or linked to your profile. | Performance of a contract |
| Daily search count | A simple per day counter tied to your account so we can enforce the free tier limit and prevent abuse. | Legitimate interest |
| Captured leads | Business contact details you choose to save. Stored on your device in the extension, or in our EU database when you use your online dashboard (see section 3). | You are the controller (see section 6) |
| Your creator profile (niche, services, target sectors, budget range, bio) | To score how well each lead fits your business. Sent to our AI provider together with a lead's public details, only when you request an AI analysis (Pro feature). | Performance of a contract |
| Captured company website content | When you capture a lead from a URL, our backend fetches that page to pull the company name, email, phone and social links. An excerpt is sent to our AI provider only if you request the Pro match-score analysis for that lead. | Performance of a contract |
| Website assistant chat messages | Anonymous visitors can ask our website chatbot questions about Avag. Messages are sent to our AI provider to generate a reply and briefly logged server-side (not in a database) to monitor quality and abuse. Not linked to any account. | Legitimate interest |
| Advertising / traffic source data (public website only) | If you accept cookies, Google's tags (Google Ads and Google Analytics) set cookies in your browser so we can measure which ads and channels bring visitors to Avag. We use this only to understand our own traffic and advertising, never to build a profile of you for anyone else, and it never runs inside your logged-in dashboard. | Consent |
| Language preference | To show the product and any emails we send you in your preferred language. | Performance of a contract |
| Product / upgrade emails | Occasional emails to Free accounts about Avag's Pro features. You can opt out with one click from the link in any such email. | Legitimate interest |
| Waitlist email (early access members) | Historical: early visitors who joined Avag's waitlist before general signup opened. Avag no longer uses a waitlist; accounts are now created directly. | Consent |
In the browser extension, leads you capture are stored locally in
your browser (chrome.storage.local) on your own device. If you uninstall
the extension, that data is removed with it.
In your online dashboard (avag.io/app), your leads are stored securely in our database (Supabase, hosted in the EU). Access is locked to your account: a per-user security rule (Row Level Security) means only you can read or change your own leads, never another user.
Your account email, subscription status and daily search count are stored securely with our providers solely to operate your account.
AI features (Pro match-score analysis and the public website chatbot) send only the specific text needed to answer your request (a lead's public details and your creator profile, or a visitor's chat message) to our AI provider, Anthropic. That data is used to generate the response and is not used by us to build a profile of you beyond your account. See Anthropic's own privacy policy for how they handle API requests.
We rely on a small number of trusted providers strictly to run the service:
person_profiles: 'identified_only', meaning no profiles are created for anonymous visitors. Data is processed only for authenticated users who have consented to account creation.Some of these providers may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards such as the European Commission Standard Contractual Clauses to protect your data.
For the business contact data you capture and store with Avag, you are the data controller: you decide what to collect and how to use it. In the browser extension, Avag simply stores that data on your own device. In your online dashboard, Avag acts as a processor that stores your leads on your behalf, in our EU database, accessible only to you; we never sell, share, or use them for our own ends.
You are responsible for using that data lawfully. Most results surfaced by Avag are business contact details (company name, general business email, phone), which typically fall outside strict personal data rules. However, if a result includes the personal email of a sole trader or individual, that constitutes personal data under GDPR. In that case, legitimate interest (Article 6(1)(f)) is the typical legal basis for B2B prospecting, provided the contact is relevant to your business, you keep a record of that interest, and you honor any opt-out promptly.
You must comply with applicable law when contacting any lead, as set out in our Terms of Service.
You have the right to:
You can delete your locally stored leads at any time from within the extension, or by uninstalling it. You can stop product/upgrade emails at any time using the unsubscribe link included in every one. To exercise any other right, email support@avag.io and we will respond within one month. You also have the right to lodge a complaint with your local data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), cnpd.pt.
We use reputable providers and reasonable technical measures to protect your data. Leads in the extension live on your own device; leads in your online dashboard are protected by per-user access rules so only your account can read them. Either way, keeping your own computer, browser, and password secure is the most important safeguard.
Avag is a business tool and is not directed to anyone under 18.
We may update this policy from time to time. If a change is significant, we will give reasonable notice. The date at the top shows when it was last updated.
Questions about this policy? Email support@avag.io.
← Back to Avag