Privacy Policy
Privacy Policy of Avlana AG, the EditWithAva website and the Ava editing assistant
Last updated: August 14, 2026
Data Controller and Processors
Avlana AG is the data controller for the personal data described in this Policy – that means we determine the purposes and means of processing. We use a number of processors (sub-processors) to help us run the service; they are listed under “Third Party Services” below and are bound by data processing agreements.
Personal Data
Personal data means any information related to an identified or identifiable natural person. You may find more details about the definition of personal data in Article 4 and Recital 30 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
We collect the following personal data when you use Ava:
Data Necessary for Our Service
After your registration with Ava, collecting and processing the personal data listed here is necessary for the performance of our Terms of Service:
Account Information
You can sign in with Google, via a passwordless magic link sent to your email, or, for enterprise customers, via your organization's Single Sign-On (SSO) provider. Depending on the method, we receive your name, email address, and (for Google) profile picture from the identity provider, and we store that information together with your Ava account.
How do we use it: to create and secure your account, and to identify you within the service.
Footage and Project Content
To edit your videos, you provide footage to Ava – either by uploading files directly, or by sharing a Google Drive folder with us. We (and our video processing pipeline) access and store that footage, along with transcripts, prompts you write describing the video you want, and the outlines, cuts, and other content our pipeline generates from it.
How do we use it: to analyze your footage, generate and refine video edits, and let you review and revise them. This content may contain personal data about you or third parties who appear or are discussed in your footage – only share footage you have the right to share with us.
Contact Information
Your email address, and any phone number or address you choose to give us.
How do we use it: to respond to your requests, and to contact you about significant updates to our service.
Usage Data
We collect log data (date and time, IP address, browser type and settings, device information) and product analytics events (pages viewed, features used, session recordings of your interactions with the app) via our analytics provider.
How do we use it: to keep the service working correctly across devices, to diagnose problems, and to understand which features are useful so we can improve the product.
We do not knowingly collect any other personal data except as stated above, so we encourage you not to provide sensitive personal information (e.g. relating to health, religion, or political opinions) beyond what is incidentally present in footage you choose to share with us.
AI Processing of Your Content
Ava uses a mix of AI models to power the editing pipeline: models from OpenAI, Microsoft (Azure OpenAI / Azure AI Foundry), Anthropic, and Google, as well as models we host ourselves on our own infrastructure. Depending on the task, your prompts and footage-derived data (e.g. transcripts, scene and moment analysis) may be sent to one or more of these providers to power tasks like prompt analysis, translation, content review, and automated analysis of your footage that generates the cut and edit suggestions Ava produces. Models we host ourselves process data entirely on our own infrastructure rather than sending it to an external AI vendor.
This is inference only: we do not use your prompts, footage, or generated content to train or fine-tune any AI models, and we have not authorized our AI vendors to do so. Data sent to these providers is used solely to generate a response to your request.
Providing Your Footage
You can bring footage into Ava either by uploading it directly, or by sharing a Google Drive folder with an Avlana service account. If you use Google Drive, this grants us read access to the files in that folder so our pipeline can import them; you control that access from your own Google Drive at all times and can revoke it by removing the share.
Third-Party Application Access (including MCP)
Ava can be used through the Model Context Protocol (MCP) and other integrations that let AI agent tools and third-party applications request limited, scoped access to your Ava account on your behalf, using an OAuth authorization flow. When a third-party application requests access, we show you exactly what it is asking for (the requested scopes) and ask you to sign in and approve or deny the request before any access is granted. We do not share your data with a third-party application unless you explicitly approve that request. To revoke access you have previously granted, contact us at tech@avlana.co.
Mailing
If you sign up for our newsletter or request a demo, we use Brevo (Sendinblue) to send you emails – including a welcome email and, where you've opted in, product updates and marketing. You can unsubscribe using the link in our emails or by contacting us.
Statistical Data
Before you register with Ava, we process only aggregate, non-identifying statistical data about site usage.
Personal Data Disclosure
We will not disclose or share your personal data with third parties except:
It is necessary to provide our service:
- with our employees or contractors who help us operate and support the service;
- with our sub-processors listed under “Third Party Services” below, who process data on our behalf;
- with your organization's identity provider, if you sign in via enterprise SSO;
- with a third-party application you have explicitly authorized via the OAuth/MCP flow described above;
- with a successor in case of a merger, acquisition, or transfer of our business.
Based on your consent:
- if you sign up for our newsletter or request a demo, we share your email with Brevo to send you the relevant emails.
If disclosure is required by law or court order.
If you are a paying customer, your payment details are handled directly by Stripe, our payment processor – we do not receive or store your full card details.
We do not sell your personal data.
Personal Data Storage and Transfer
Our infrastructure, including compute, database and storage and authentication, runs on the Google Cloud Platform and Supabase, with all services within EU regions. Some of our sub-processors – including our AI providers – may process data in the United States or other countries outside the EU/Switzerland; where they do, this is subject to appropriate safeguards such as Standard Contractual Clauses (SCCs). If you contact us via email, your message will be stored on Google servers which may be located in various countries, subject to SCCs. Our services use TLS encryption in transit.
Third Party Links
This website may contain links to third party websites, which are governed by their own privacy policies. We are not responsible for their content or practices.
Third Party Services
We use Google as a sign-in provider (including Google One Tap) and to let you link footage from Google Drive. Google processes your identity and, where you grant access, the contents of the Drive folders you share with us. See Google's Privacy Policy for more details.
Supabase
We use Supabase, hosted in the EU, to manage, among others, sign-in and authentication. Supabase processes your account information and footage on our behalf. See Supabase's Privacy Policy for more details.
AI Model Providers (OpenAI, Microsoft, Anthropic, Google)
We use models from OpenAI, Microsoft (Azure OpenAI / Azure AI Foundry), Anthropic, and Google to process prompts and analyze footage as described above under “AI Processing of Your Content.” This is inference only – your data is not used to train their models.
Self-Hosted Models
For some tasks, we run AI models ourselves on our own infrastructure rather than sending data to an external AI vendor. Data processed this way stays within our own infrastructure.
Stripe
If you are a paying customer, Stripe processes your payment details on our behalf. We do not receive or store your full card details. See Stripe's Privacy Policy for more details.
PostHog
We use PostHog, hosted in the EU, for product analytics. This includes tracking which pages and features you use and, to help us diagnose issues and improve the product, session recordings of your interactions with the app (password fields are always masked). PostHog sets a cookie to recognize you across visits.
Brevo
Brevo (Sendinblue) sends transactional and, where you've opted in, marketing emails on our behalf. See Brevo's Privacy Policy for more details.
Children
Our website is not intended for children under 18. If a child has provided personal data, a parent or guardian can contact us to request deletion.
Your Data Protection Rights
Whether you are located in Switzerland, the EU/EEA, or elsewhere, we extend the following rights to you under the GDPR and the Swiss Federal Act on Data Protection (FADP):
- Right to access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to data portability
- Right to object
You may also withdraw your consent at any time. If you are in Switzerland, you can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC). If you are in the EU/EEA, you can lodge a complaint with your local data protection supervisory authority.
Updating and Definitions
We may update this Privacy Policy periodically. Please check this page for the latest version.
Data Deletion Request
If you wish to have all your data removed from our servers, you can do so by requesting it via email to tech@avlana.co.
Cookies
We use essential cookies to keep you signed in, and analytics cookies (via PostHog, see above) to understand how the service is used. We do not use advertising or remarketing cookies. You can control or delete cookies through your browser settings, though this may limit some functionality.
Do Not Track
We do not support Do Not Track but respect this Privacy Policy.
Contact
If you wish to access, correct, or delete your personal data, please contact: tech@avlana.co
Avlana AG
Pfaffenmattweg 37a
4132 Muttenz BL
Switzerland
Data Protection Authority
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
CH - 3003 Berne
T +41 (0)58 462 43 95, F +41 (0)58 465 99 96