Privacy Policy

1. Who we are

Avvi AI is a software as a service platform that provides AI powered Microsoft 365 management for Managed Service Providers. Depending on context, Avvi acts as both a data controller, for platform and account data, and a data processor, for client tenant data handled on behalf of MSPs.

2. Information we collect

2.1 Account and identity information

• Full name, email address, and Azure AD user object ID
• Tenant domain and organization name
• User role within the MSP or client tenant
• Authentication tokens, stored securely and never logged

2.2 Microsoft 365 and Exchange data

• User account properties, mailbox settings, and forwarding rules
• Distribution list and Entra group membership
• Quarantine metadata such as sender, recipient, subject, and reason only, never the message body
• Multi factor authentication and sign in session status

Email message bodies and attachments are not read or stored.

2.3 Conversation and AI interaction data

• User chat messages and AI responses
• Tools invoked during sessions
• Conversation history scoped to each user and tenant
• Personally identifiable information redacted from audit records

2.4 Usage and technical data

• IP address with the port stripped, and browser user agent
• Session identifiers and activity timestamps
• Feature usage and performance metrics
• Error logs with personal data scrubbed

3. Legal basis for processing

Processing occurs under one or more of the following bases:

• Contract performance, for service delivery
• Legitimate interests, including security, fraud prevention, and service improvement
• Legal obligation, for regulatory compliance
• Consent, including explicit Microsoft administrator consent

4. How we use information

• Authenticate and authorize users and organizations
• Execute authorized Microsoft 365 management actions
• Maintain audit logs for compliance and accountability
• Detect and prevent unauthorized access or abuse
• Generate anonymized analytics for platform improvement
• Derive anonymized workflow patterns to enhance platform wide AI assistance
• Provide customer support and respond to inquiries
• Send administrative communications

Personal data is not sold, rented, or traded for marketing purposes.

5. Data sharing and third party services

5.1 AI processing provider

Avvi uses Anthropic (Claude) to process AI interactions. Anthropic processes this information under its applicable data-processing commitments.

5.2 Microsoft cloud services and infrastructure

Avvi uses Microsoft Azure for hosting, Azure Database for data storage, and Azure Log Analytics for monitoring. Its Microsoft 365 integration includes Microsoft Entra ID, Microsoft Graph, Exchange Online, and Teams. Information handled by Microsoft services is also subject to Microsoft’s privacy statement.

5.3 Transactional email

Avvi uses SMTP2GO to send transactional communications, such as service and account emails. SMTP2GO processes the information needed to deliver those messages.

5.4 Other disclosures

Information may be disclosed when required by law, court order, or a regulatory authority, to protect rights or safety, or in connection with a merger, acquisition, or asset sale, with notice.

6. Multi tenant data isolation

• Each MSP organization’s data is logically separated from every other organization
• Client tenant data is scoped exclusively within its MSP account
• No cross tenant raw data access is permitted
• Granular Delegated Admin Privileges enforce permission boundaries
• All data access is validated at runtime against the authenticated user’s tenant context

6.1 Aggregated platform learning

Generalized workflow patterns derived from anonymized interactions undergo sanitization that:

• Strips personally identifiable information, names, email addresses, and tenant identifiers
• Removes tenant specific terminology and internal naming conventions
• Retains only generic Microsoft 365 operational patterns
• Is validated by automated compliance review before inclusion

This aggregated knowledge contains no data traceable to any individual user, MSP, or client tenant. To opt out, contact info@avvi.cloud.

7. Data retention

• Conversation history, for the duration of the subscription plus 90 days after termination
• Audit logs, retained for 400 days in the normal course and for seven years when maintained as compliance records
• Quarantine session cache, purged automatically after 24 hours
• Account data, deleted within 30 days of account termination upon written request
• Anonymized analytics, may be retained indefinitely in aggregated, non identifiable form

8. Security

Security controls include:

• Encryption in transit using TLS 1.2 or higher, and at rest using AES 256
• Non interactive, certificate based authentication with Microsoft services
• Role based access control with least privilege enforcement
• Redaction of personal data in audit records before storage
• Comprehensive audit logging for all administrative actions
• Security event monitoring and anomaly detection
• Regular security reviews aligned to the SOC 2 Trust Services Criteria

If Avvi confirms an incident affecting personal data, it will assess notification obligations and notify affected parties and regulators as required by applicable law and the applicable agreement. Avvi does not publish a universal incident-notification timeframe on this page.

9. International data transfers

Services are hosted in the United States on Microsoft Azure infrastructure, and data may be transferred to and processed in the United States. Standard contractual clauses and other lawful transfer mechanisms are relied upon where required under the GDPR or other applicable data protection law.

10. Your rights

Depending on your jurisdiction, your rights may include:

• Access, request a copy of the personal data held about you
• Correction, request correction of inaccurate or incomplete data
• Deletion, request deletion of personal data, the right to be forgotten
• Restriction, request restriction of data processing
• Portability, receive your data in a structured, machine readable format
• Objection, object to processing based on legitimate interests
• Withdraw consent, where processing is based on consent

To exercise any right, contact info@avvi.cloud. A response is provided within 30 days.

California residents (CCPA and CPRA)

California residents have the right to know what personal information is collected, sold, or disclosed, to opt out of sales, which Avvi does not practice, to request deletion, and to non discrimination for exercising these rights.

11. Cookies and tracking

Session cookies are used strictly for authentication and security. Avvi does not use advertising cookies, behavioral tracking, or third party analytics cookies that track users across sites. Avvi honors the Global Privacy Control signal: if your browser sends one, we treat it as a refusal of everything that is not strictly necessary, nothing outside that category loads, and we do not show the consent banner. There has never been a common industry standard for the older Do Not Track signal, so we do not act on it separately. If Avvi introduces analytics, advertising, or cross-site tracking, it will update this policy and any applicable consent controls before that change takes effect.

12. Children’s privacy

The services are designed for business use only and are not directed at children under 16. Personal data from children is not knowingly collected. Please notify us immediately if inadvertent collection occurs.

13. Changes to this policy

This policy may be updated. Material changes are communicated by email or a prominent platform notice at least 14 days before taking effect. Continued use of the services after the effective date constitutes acceptance.

14. Contact us

Avvi AI LLC, Privacy Team
Email: info@avvi.cloud
Website: avvi.cloud

For inquiries from the EU and EEA, or to reach the Data Protection Officer, contact info@avvi.cloud.