On this page
Key takeaways
- Tell visitors they are talking to an AI. In the EU this is a legal duty under Article 50(1) of the AI Act.
- Collect less. Record page paths, not what visitors type, and keep passwords and card numbers out of the agent entirely.
- Gate every irreversible action behind a confirmation and give your team a clear off-switch.
An AI avatar talks to your customers in your name, so it needs the same scrutiny as any system that handles their data. These are the questions we would ask if we were the buyer, and where Avarole answers them in the open.
| Question | What good looks like | What Avarole documents |
|---|---|---|
| Do visitors know it is an AI? | A clear disclosure at the start of the conversation | You choose the avatar's appearance, voice and tone, so you can introduce it as an AI |
| What data is collected? | Only what the feature needs | Insights records page paths only, never what visitors type |
| Can it touch sensitive fields? | No access to passwords, card numbers or codes | Site Navigation never reads or fills them and masks personal data |
| Can it take irreversible actions? | Only after confirmation | It asks before anything that buys, pays, deletes, cancels or submits |
| Can I restrict where it goes? | Allow and block lists, per element controls | Block or allow paths and mark elements to skip, confirm or rename |
| How long is data kept? | A stated retention period | Insights events are kept for 180 days |
| Can I switch it off? | Per agent, per page, at any time | Per agent, and per page with data-guided-nav="false" |
| Who has access? | Role-based permissions | Role-based access on the AI Team plan |
| Is anything sent without approval? | A person reviews outbound messages | Executive drafts replies and sends nothing until approved |
| What certifications back it? | Independent audits | The site lists ISO 27001 and ISO 27018 certification and Amazon Web Services |
1. Disclose that it is an AI
People should know when they are talking to a machine. Under Article 50(1) of the EU AI Act, providers must make sure people are informed they are interacting with an AI system, unless that is obvious. Law-firm commentary from August 2026 treats this duty as in force. The rules and dates are for you and your counsel to confirm for your situation, but disclosing is good practice everywhere.
2. Collect only what you need
Measure behaviour without reading people's input. Avarole Insights keeps page paths, never query strings, fragments or what visitors type. It stays off when the browser sends Do Not Track or the page opts out.
3. Keep secrets away from the agent
Site Navigation never reads or fills passwords, card numbers or one-time codes. It masks personal data and asks before any action that buys, pays, deletes, cancels or submits.
4. Control the blast radius
- Allow only the paths the agent needs.
- Mark sensitive elements to skip, and risky ones to confirm.
- Define custom actions narrowly, and set
confirm: trueon anything destructive. See agentic AI avatars.
5. Put a person in the loop for outbound messages
In Avarole Executive, the desktop assistant for leaders, replies are drafted for review and nothing is sent until the user approves. Executive Pro can send automated replies, still with approval. Connections to email, calendar and documents are encrypted.
6. Ask about the paperwork
- A data processing agreement and a list of sub-processors.
- Where data is hosted, and in which region.
- How long transcripts are kept, and how to delete them.
- Penetration test summaries and a security contact.
If you need these for a procurement review, contact the team.
Frequently asked questions
Does Avarole read what visitors type?
Insights does not. It records page paths and the actions the agent took, never what visitors type.
Is Avarole certified?
The Avarole site lists ISO 27001 and ISO 27018 certification. Contact the team for the documents your review needs.
Can I stop the agent from acting on certain pages?
Yes. Block paths, mark elements to skip or confirm, and switch Site Navigation off per agent or per page.
Need a security review?
Talk to the team about hosting, data handling and the documents your procurement process needs.
