1. Who we are
Avarole is operated by Qorden AI Ltd, a company incorporated in the Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates (DIFC commercial licence CL6291), with its registered office at Unit GA-00-SZ-L1-RT-208, Level 1, Gate Avenue South Zone, DIFC, Dubai, UAE (Qorden, we, us or our).
Qorden is registered with the DIFC Commissioner of Data Protection and has appointed a Data Protection Officer (DPO). You can contact our DPO at legal@avarole.com (subject line: Data Protection Officer) or by post at the address above.
This notice applies to:
- visitors to avarole.com and its subdomains (the Website);
- people who create an Avarole account, subscribe to a plan or use the Free plan;
- authorised users of our business customers, including Avarole Executive users;
- business contacts, prospects and people who contact us.
It does not cover how our business customers use personal data when they deploy Avarole for their own visitors, customers or staff. That use is described in each customer's own privacy notice (see section 2).
2. Our role: controller or processor
We act as controller for personal data we use for our own purposes, and as processor for personal data we handle on a business customer's instructions.
| Situation | Qorden's role | Who to contact first |
|---|---|---|
| Website visits, account sign-up, billing, support, security, marketing to business contacts | Controller | Qorden (legal@avarole.com) |
| Avarole Executive used by you or your organisation (connected email, CRM, files, avatar conversations) | Processor for your organisation; controller for account, billing and security data | Your organisation's administrator, or Qorden for account matters |
| Speaking with an Avarole Agent or Avarole Interactive avatar deployed by a business on its website, app or kiosk | Processor for that business | The business that deployed the avatar |
| Avatars and voices we create from a person's likeness for a customer | Processor for the customer | The customer, or Qorden where you cannot reach them |
When we act as processor, we process personal data only on the customer's documented instructions under a Data Processing Addendum (DPA). The customer decides why the data is collected and is responsible for giving you its own privacy notice and AI notice. If you contact us about a customer deployment, we will pass your request to that customer and support them in responding.
3. Personal data we collect
We collect the personal data you give us, data generated when you use Avarole, and limited data from third parties. We do not ask for more than we need for the purposes in section 4.
| Category | Examples | Where it comes from |
|---|---|---|
| Account and identity | Name, business email, job title, company, password (stored hashed), role and permissions | You or your organisation's administrator |
| Billing and subscription | Plan, billing address, VAT number, invoices, payment status, last four digits and expiry of your card | You and our payment service provider (we do not store full card numbers) |
| Conversation content | Voice audio, video of you where a camera feature is used, transcripts, detected language, translations, prompts and avatar responses | You, when you speak with an avatar |
| Customer content | Knowledge base files, website content, uploaded documents, avatar images, voice samples and custom avatar or voice assets | You or your organisation |
| Executive connected data | Emails, CRM records, calendar entries, files and contacts, limited to the permissions you grant when connecting an account | Your connected services, at your request |
| Interactive capture | Camera images, scanned documents and data extracted from them (for example name or document number) where the deploying organisation has enabled these features | You, at a kiosk or device |
| Lead capture | Name, email, phone number and enquiry details a visitor gives to a customer's avatar | Visitors to our customers' deployments |
| Analytics and usage | Minutes used, session counts, conversation insights and summaries, feature usage, error reports | Generated by your use of Avarole |
| Technical and security | IP address, device and browser type, operating system, app version, log files, authentication events | Your device and our systems |
| Cookies and similar technologies | Session identifiers, preferences, and analytics data where you consent | Your browser (see section 12) |
| Communications and marketing | Support tickets, emails, sales enquiries, event registrations, marketing preferences | You, and business contact sources where permitted |
You do not have to give us personal data, but without account, billing or conversation data we cannot provide the Services.
4. How we use personal data and our legal bases
We use personal data only for the purposes below, under the DIFC Data Protection Law (DIFC Law No. 5 of 2020) and, where they apply, the EU or UK General Data Protection Regulation and other applicable laws.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account, provide the plan you chose, run avatar conversations, translation and text-to-speech | Account, conversation content, customer content, Executive connected data, usage | Performance of our contract with you, or with your organisation |
| Bill you, collect payment, apply taxes and keep financial records | Billing and subscription, account | Performance of contract; compliance with legal obligations |
| Provide conversation analytics and summaries to the account owner | Conversation content, analytics | Performance of contract |
| Provide support and respond to enquiries | Account, communications, relevant conversation or technical data | Performance of contract; legitimate interests in helping you |
| Keep Avarole secure, detect fraud and abuse, enforce our Terms, prevent misuse of AI (including deepfakes and prohibited uses) | Technical and security, usage, conversation content where needed for an investigation | Legitimate interests in security and safe AI; compliance with legal obligations |
| Monitor, test and improve service quality and AI safety, including reviewing reported harmful or inaccurate outputs | Usage, analytics, and conversation content only where reported or needed to fix a fault | Legitimate interests; never to train generalised AI models (see section 5) |
| Create a custom avatar or cloned voice of a real person | Images, video and voice samples of that person | Explicit consent of that person, collected by the customer and evidenced to us |
| Enable camera, document scanning or any biometric feature at a kiosk or device | Interactive capture | The deploying organisation's legal basis, and explicit consent where the law requires it |
| Send product updates and B2B marketing | Business contact details, marketing preferences | Legitimate interests (business contacts) or consent where required; you can opt out at any time |
| Website analytics and non-essential cookies | Cookies, technical data | Consent |
| Comply with law, respond to lawful requests from authorities, establish or defend legal claims | Any relevant data | Compliance with legal obligations; legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details and you can object (see section 11). Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
5. AI processing notice
Avarole uses AI systems that process your personal data automatically, without a person starting or directing each step. This section is our notice under Regulation 10 of the DIFC Data Protection Regulations and our transparency statement under Article 50 of the EU AI Act. It is shown, or linked, when you first use Avarole.
Human-defined purposes only. Avarole processes personal data only for the purposes set by people at Qorden and by the customer who configures a deployment, as listed in section 4. Avarole cannot define new purposes for itself. Where an avatar adapts its replies during a conversation, it stays within the customer's instructions, knowledge base and scope limits, and our built-in safeguards.
What the AI systems do and what they produce.
| AI function | Provider | What it outputs | How the output is used |
|---|---|---|---|
| Avatar video generation and rendering | Qorden's own managed avatar model | AI-generated avatar video synchronised to speech | Shown to you during the conversation |
| Conversation responses | Qorden's AI services, using the customer's knowledge base | Spoken answers, information, drafts and suggested actions | Shown to you; actions in Executive run only with your confirmation or a separately enabled workflow |
| Translation and text-to-speech | OpenAI API | Translated text and synthetic speech in the avatar's voice | Spoken by the avatar in your language |
| Conversation analytics | Groq and Anthropic (Claude) APIs | Summaries, topics, insights and lead details | Shown to the account owner in their dashboard |
| Camera and document scanning (Avarole Interactive, where enabled) | Configured per deployment | Extracted text and fields | Used for the deploying organisation's stated purpose |
No decisions with legal effects. Avarole does not make decisions about you that have legal or similarly significant effects. Our customers must not use it for that purpose without human review. If an organisation uses Avarole output in such a decision, you can ask that organisation for human review, give your point of view and contest the outcome.
No model training on your data. We do not use your conversations, voice, images, documents, connected emails or outputs to train generalised AI models, including our own avatar model. Our AI providers receive data under commercial API terms under which, by default, it is not used to train their models.
Design principles and safeguards.
- You are told at the start of each session that you are speaking with an AI avatar. Avatars must never claim to be human.
- Avatar video and synthetic speech may carry labels or machine-readable markings identifying them as AI-generated.
- Content filtering, scope limits and prompt and output controls reduce harmful or off-topic responses.
- Human intervention is triggered where processing may be unfair, discriminatory or biased, where an authority makes a lawful request, or where a user reports a concern.
- Emotion recognition, biometric categorisation and biometric identification are not enabled by default.
- We maintain a register of our AI use cases, keep risk and impact assessments, and log processing for accountability.
Standards we rely on. Qorden AI Ltd holds ISO/IEC 27001:2022 (information security) and ISO/IEC 27018:2025 (protection of personal data in the cloud) certifications. We design Avarole with reference to the OECD AI Principles and the transparency requirements of the EU AI Act.
Limits on your rights. AI processing does not limit your rights under section 11. Because we do not train models on your data, erasure removes it from our systems and backups on the schedule in section 9. Copies held by AI providers for abuse monitoring expire within their limited retention period.
You can ask for a plain-language explanation of how Avarole processed your data, or report an AI concern, at legal@avarole.com (subject line: AI concern).
6. Camera, voice, biometrics and sensitive data
We use your voice and, where enabled, your camera image to run the conversation, not to identify you.
- Microphone and camera. Avarole asks for microphone or camera access through your browser, app or device before using it. You can refuse or withdraw access in your settings at any time; some features will then stop working. Device permission is not consent from other people, so do not capture people who have not been told.
- Biometric data. We do not use voice, face or other biometric data to identify you or to infer your emotions or characteristics. A deploying organisation may only enable biometric identification or matching after a separate assessment, with a valid legal basis, a clear notice and your explicit consent where the law requires it.
- Custom avatars and cloned voices. We create an avatar or voice from a real person's likeness only with that person's documented, informed and revocable consent. If consent is withdrawn, we delete the related avatar and voice assets and the customer must stop using them.
- Identity documents. Avarole Interactive can scan documents where the deploying organisation enables it. A scan does not on its own verify your identity. Only the data needed for the stated purpose is extracted.
- Special category data. Avarole is not designed to collect health, religious, political, biometric or other special category data. Please do not share it in a conversation unless the organisation you are speaking with has asked for it for a clear purpose. If it is shared, we process it only to provide the conversation and under the customer's instructions. Avarole is not used to process protected health information under the US Health Insurance Portability and Accountability Act (HIPAA) unless we have signed a business associate agreement with the organisation concerned.
7. Who we share personal data with
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only with the recipients below, each under a written contract that limits use to providing services to us.
| Recipient | Why | Data shared |
|---|---|---|
| OpenAI | Translation and text-to-speech | Text to be translated or spoken, and the target language |
| Groq | Conversation analytics | Transcripts and conversation metadata |
| Anthropic (Claude) | Conversation analytics | Transcripts and conversation metadata |
| Cloud hosting and infrastructure providers | Hosting, storage, backups and content delivery | All data we hold, encrypted |
| Payment service provider | Taking and refunding payments, fraud checks | Billing and payment data |
| Email, support and communication tools | Sending service emails and handling support | Contact details, support content |
| Website analytics providers (with your consent) | Measuring Website use | Cookie and technical data |
| Our business customers | Providing their deployment, analytics and leads | Conversation content and lead data from their own deployments |
| Qorden group companies, including our Ireland subsidiary | Support, sales and operations | Data needed for the task |
| Professional advisers, auditors and insurers | Legal, audit, certification and insurance | Data needed for the task |
| Regulators, courts and law enforcement | Where required by law or to protect rights and safety | Data required by the lawful request |
| A buyer or successor | If our business or assets are sold or restructured | Data relating to the transferred business |
The current list of our AI providers and sub processors, with their roles and processing locations, is published on the Website and available from legal@avarole.com. We notify business customers of material changes as set out in their DPA.
8. International transfers
Avarole is a global service, so your personal data may be processed outside the country where you live, including in the UAE, the European Economic Area and the United States, where our AI providers OpenAI, Groq and Anthropic process data.
When we transfer personal data out of the DIFC, the European Economic Area or the United Kingdom to a country without an adequacy decision, we use the safeguards the law requires. These include the DIFC Standard Contractual Clauses, the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, together with a transfer risk assessment and supplementary measures such as encryption. Where a business customer has agreed a specific data residency arrangement with us in writing, we follow it.
You can ask for a copy of the relevant safeguards at legal@avarole.com.
9. How long we keep personal data
We keep personal data only as long as we need it for the purposes in section 4, then delete or anonymise it. A business customer's DPA or Order Form may set different periods for its deployment.
| Data | Retention period |
|---|---|
| Account and billing data | Up to 7 years, as required by legal, tax and financial obligations |
| Conversation transcripts, translations and conversation analytics | Up to 1 year, or a shorter period set by the customer; deleted within 30 days after the subscription ends, if sooner |
| Conversation recordings (only where the customer has enabled recording) | Up to 90 days; deleted within 30 days after the subscription ends, if sooner. Live audio and video that is not recorded is processed in real time and not stored |
| Customer content (knowledge base files, documents and website content) | While the subscription is active; deleted after the 30-day retrieval window that follows termination |
| Executive connected data | Accessed on demand; cached copies deleted when you disconnect the account or close your subscription |
| Custom avatar and voice assets | Until the customer deletes them, the subscription ends, or the person withdraws consent, and biometric information no later than three years after the person's last interaction (see section 17) |
| Usage logs and service analytics | Up to 2 years; deleted within 90 days after the subscription ends, if sooner |
| Security and access logs | Up to 1 year, or longer while an incident or claim is investigated; otherwise deleted within 90 days after the subscription ends, if sooner |
| AI inference cache | Up to 30 days, deleted on a rolling basis |
| Copies held by AI providers | Up to 30 days for abuse monitoring, or not retained where zero data retention applies |
| Free plan accounts | Closed and deleted after 90 days without activity, after 14 days' notice by email, except data we are required by law to retain |
| Support tickets and correspondence | Up to 3 years after the ticket is closed |
| Marketing preferences | Until you opt out; we keep a minimal suppression record, so we do not contact you again |
| Backups | Overwritten on a rolling cycle; deleted data leaves backups at the end of that cycle |
We may keep data longer where the law requires it or to establish, exercise or defend legal claims, and only for that purpose.
10. How we protect personal data
We protect personal data with technical and organisational measures certified under ISO/IEC 27001:2022 and ISO/IEC 27018:2025.
- Encryption of data in transit and at rest.
- Role-based access, least privilege and multi-factor authentication for staff with access to production systems.
- Logical separation of each customer's data.
- Security monitoring, logging and regular vulnerability testing.
- Security and data protection assessment of AI providers and other sub processors before use and periodically after.
- Staff confidentiality obligations and privacy and security training.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the DIFC Commissioner of Data Protection and, where required, you and affected customers without undue delay. Report a suspected security issue to security@avarole.com.
11. Your rights
You can exercise the rights below free of charge by emailing legal@avarole.com. We respond within one month, which we may extend by up to two further months for complex requests, telling you why.
- Access: get a copy of your personal data and information about how we use it.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data where there is no good reason to keep it.
- Restriction: ask us to limit how we use your data while a concern is resolved.
- Portability: receive data you gave us in a structured, machine-readable format, or have it sent to another provider.
- Objection: object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent: where we rely on consent, including for cookies, cloned voices or custom avatars.
- Automated decisions: not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, and to obtain human review.
- Explanation of AI processing: a plain-language explanation of how Avarole processed your data.
We may need to verify your identity before acting on a request. If your request concerns a business customer's deployment, we will forward it to that customer and help them respond.
Residents of other countries. You may have additional rights under local law, for example in the European Union, the United Kingdom or US states such as California. We honour those rights where they apply. We do not sell or share personal information as those terms are defined in California law, and we will not discriminate against you for exercising your rights.
12. Cookies and similar technologies
We use strictly necessary cookies to run the Website and keep you signed in. We use analytics and marketing cookies only with your consent, which you can give, refuse or change at any time through the cookie banner or settings on the Website. Our cookie notice on the Website lists the cookies we use and how long they last.
13. Marketing
We send product news and offer to business contacts where the law allows, and with consent where it is required. Every marketing email has an unsubscribe link, and you can opt out at any time by emailing legal@avarole.com. Service messages about your account, billing or security are not marketing and will still be sent.
14. Children
Avarole is a business service for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact legal@avarole.com and we will delete it.
15. Changes to this notice
We update this notice when our processing changes. We show the date of the latest version at the top and notify account holders of material changes by email or in the product before they take effect. Earlier versions are available on request.
16. Contact and complaints
| Topic | Contact |
|---|---|
| Privacy questions, rights requests, AI concerns and our DPO | legal@avarole.com |
| Security incidents | security@avarole.com |
| Account and billing | support@avarole.com |
| Post | Data Protection Officer, Qorden AI Ltd, Unit GA-00-SZ-L1-RT-208, Level 1, Gate Avenue South Zone, DIFC, Dubai, UAE |
If you are not satisfied with our response, you can complain to the DIFC Commissioner of Data Protection (through difc.com) or to the data protection authority where you live or work, including in the European Union or the United Kingdom. We would appreciate the chance to resolve your concern first.
17. Additional information for US residents
This section applies to residents of US states with consumer privacy laws, including California, Colorado, Connecticut, Texas, Utah and Virginia, and supplements the rest of this notice.
Notice at collection. In the last 12 months we have collected the categories of personal information below, from the sources and for the purposes in sections 3 and 4, and kept them for the periods in section 9.
| Category (California law) | Examples | Disclosed for a business purpose to | Sold or shared |
|---|---|---|---|
| Identifiers | Name, email, IP address, account ID | Service providers, AI providers, business customers | No |
| Customer records | Billing address, phone number, card last four digits | Payment provider | No |
| Commercial information | Plan, purchase and usage history | Service providers | No |
| Internet or network activity | Website and app usage, logs | Service providers, analytics providers (with consent) | No |
| Audio, electronic and visual information | Voice, video, camera images, transcripts | AI providers, business customers | No |
| Professional information | Job title, company | Service providers | No |
| Inferences | Conversation insights and summaries | Business customers | No |
| Sensitive personal information | Account login credentials; identity document data and biometric information only where a customer enables those features | Service providers, business customers | No |
No sale, sharing or targeted advertising. We do not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising, and we have not done so in the last 12 months. We do not knowingly sell or share personal information of consumers under 16. We use sensitive personal information only to provide the Services, keep them secure and comply with law, and not to infer characteristics about you.
Your rights. Depending on your state, you can ask us to tell you what personal information we collect, use and disclose; give you a copy; correct it; delete it; and opt out of sale, sharing, targeted advertising and profiling for significant decisions. Because we do not sell, share or profile in those ways, no opt-out is needed, but we honour Global Privacy Control signals for non-essential cookies. We will not discriminate against you for exercising your rights.
How to make a request. Email legal@avarole.com. We verify your identity by matching information we already hold. An authorised agent can make a request for you with your signed permission. We respond within 45 days, extendable by a further 45 days where reasonably necessary.
Appeals. If we decline your request, you can appeal by replying to our decision with the subject line Privacy appeal. We respond within the time your state law requires. If you disagree with the outcome, you can contact your state attorney general.
Biometric information. This is our public policy for biometric identifiers and information, including face geometry and voiceprints, under the Illinois Biometric Information Privacy Act and similar laws in Texas, Washington and elsewhere.
- We collect biometric information only for custom avatars, cloned voices or a biometric feature a customer has enabled, and only after the individual has given informed written consent.
- We do not sell, lease, trade or otherwise profit from biometric information, and we disclose it only to process it on the customer's instructions, with consent, or where the law requires it.
- We permanently destroy biometric information when the purpose for collecting it has been satisfied, or within three years of the individual's last interaction with Avarole, whichever comes first.
- We store and protect biometric information with at least the same care as our other most sensitive data.
Conversation recording and transcription. Avarole conversations are processed, transcribed and analysed by AI in real time, including by our AI providers, as described in sections 5 and 7. You are told this before a conversation starts. If you do not agree, do not start the conversation. We process conversation content only to provide the Services to the organisation you are speaking with, and for security, abuse prevention and legal compliance. We do not use it to train AI models or for our own marketing.
Other notices. You are always told when you are interacting with an AI avatar, as required by AI disclosure laws such as those in California and Utah. Avarole is not directed at children under 13. We do not share personal information with third parties for their own direct marketing. Because there is no common standard for browser Do Not Track signals, we respond to Global Privacy Control signals instead.
Also read
Avarole Terms and ConditionsThe terms that govern avarole.com and the Avarole Services.