Privacy policy

Who we are

The controller of your personal data is:

Informacijske storitve Žiga Flis s.p. (“AVADO”, “we”, “us”)
Zelena ulica 7, 3240 Šmarje pri Jelšah, Slovenia
Email: support@ava.do

This policy covers the website www.ava.do, orders placed in our shop at shop.ava.do, email support, the Priority Support subscription, and the data your AVADO device exchanges with our services. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

We don’t sell personal data, and we don’t make decisions about you based solely on automated processing.

Summary

What	Why	Legal basis	How long
Website server logs (Vercel)	Run and secure the website	Legitimate interests	Up to 30 days
Analytics and ads measurement (Google, X)	Understand which pages help and measure ads	Consent	Up to 14 months
Your cookie choice (browser storage)	Remember your choice	Legitimate interests	Until you clear it
Newsletter (Klaviyo)	Send product updates	Consent	Until you unsubscribe
Shop orders (Shopify)	Sell and deliver hardware	Contract, legal obligation	10 years
Email support	Answer your questions	Contract, legitimate interests	3 years
Priority Support (Stripe, priorityapi.ava.do)	Sell and provide the subscription	Contract, legal obligation, legitimate interests	Audit log 12 months; records 10 years after the subscription ends
AVADO device update checks	Offer software updates	Contract, legitimate interests	Up to 90 days

The sections below explain each of these.

Website

Hosting and server logs

The website is hosted by Vercel Inc. When you visit a page, Vercel’s servers process your IP address, the page requested, the time, your browser’s user agent and the referring page. We use this to deliver the website, keep it secure and fix errors.

Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
Retention: Vercel keeps these logs for a limited time, no longer than 30 days.

If you select Accept in the cookie banner, we load:

Google Tag Manager and Google Analytics 4 (Google Ireland Ltd.), which record the pages you view, how you arrived, your device and browser type, your approximate location and identifiers stored in cookies.
The X (Twitter) pixel (Twitter International Unlimited Company), which lets us measure whether our ads on X lead to visits.

Nothing is loaded if you select Reject or make no choice. You can change your choice at any time under Cookie settings in the footer of every page.

Legal basis: your consent (Art. 6(1)(a) GDPR and the Slovenian Electronic Communications Act, ZEKom-2). Withdrawing consent doesn’t affect processing that took place before.
Retention: Google Analytics data is kept for up to 14 months. X keeps data according to its own policies.

We store your choice (accept or reject) in your browser’s local storage under the name avado-consent, so the banner doesn’t appear on every page. It stays on your device until you clear your browser data, and we don’t receive it.

Legal basis: this storage is strictly necessary to respect your choice (legitimate interests, Art. 6(1)(f) GDPR).

If you subscribe to the newsletter, your email address, the time you subscribed, your IP address at sign-up and whether you open or click our emails are processed by Klaviyo, Inc., which sends the newsletter for us.

Legal basis: your consent (Art. 6(1)(a) GDPR).
Retention: until you unsubscribe, using the link in every email or by writing to us. After that we keep a record that you unsubscribed, so we don’t email you again.

Shop orders

Our shop at shop.ava.do runs on Shopify. When you order, we process your name, email address, billing and shipping address, phone number, order details and payment status. Payments are handled by the payment providers shown at checkout; we don’t receive your full card details. Shopify’s own privacy policy also applies to the checkout.

We share your delivery details with the carrier and, for shipments outside the EU, with customs.

Purpose: to process your order, deliver it, handle returns and warranty claims, and keep accounting records.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations under accounting and tax law (Art. 6(1)(c) GDPR).
Retention: order records and invoices are kept for 10 years, as required by accounting law.

Email support

When you email support@ava.do, we process your email address, name, the content of your messages and anything you send us, such as screenshots, logs, your device model or order number.

Purpose: to answer your question and resolve your problem.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) where you’re a customer, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Retention: 3 years after our last exchange, so we can refer back to earlier problems with your device.

Priority Support

Payment by Stripe

Priority Support is paid through Stripe (Stripe Payments Europe Ltd.). Stripe processes your name, email address, billing address and payment details. You enter your card details at Stripe and they stay with Stripe; we never see or store them. Stripe acts as our processor for payments, and as an independent controller for its own legal obligations, such as fraud prevention and anti-money-laundering checks.

We use the same Stripe account for other businesses operated by Informacijske storitve Žiga Flis s.p. Priority Support payments are kept separate by product, and data from one business isn’t used for another.

The Priority Support service

The service that manages subscriptions runs at priorityapi.ava.do on servers in Slovenia. It stores:

your AVADO’s node ID, the public identifier of your box, which links the subscription to that box;
your Stripe customer ID and subscription ID;
your plan (monthly or yearly), the subscription status and the start and end dates of the current period;
an audit log of actions, such as status checks and the creation of checkout and billing-portal sessions, including the IP address each request came from.

When you contact us as a Priority Support customer, the section on email support also applies.

Purpose: to sell the subscription, check whether a box is covered, provide support, keep accounting records, and detect misuse.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR), our legal obligations under accounting law (Art. 6(1)(c) GDPR), and, for the audit log, our legitimate interest in securing the service and preventing abuse (Art. 6(1)(f) GDPR).
Retention: the audit log is kept for 12 months. Subscription records are kept while the subscription exists and then for 10 years for accounting.

Your AVADO device

Software updates

Once an hour, your AVADO contacts our update service at rpc.ava.do. It sends the box’s node ID and the list of installed packages with their versions, and receives information about available updates, which the Admin UI then offers to you. Like any internet request, this also transmits your IP address.

Packages are downloaded over IPFS, a peer-to-peer network, so the IPFS nodes that serve the files can see your IP address. Your AVADO also downloads TLS certificates from AVADO so you can open the Admin UI over an encrypted connection.

Purpose: to offer software and security updates and keep your device working.
Legal basis: performance of the contract for the device you bought (Art. 6(1)(b) GDPR) and our legitimate interest in keeping devices secure and up to date (Art. 6(1)(f) GDPR).
Retention: request logs of these services are kept for up to 90 days for operation and security.

Remote Connect

If you use Remote Connect to reach your AVADO from outside your home network, the connection is set up through ZeroTier (ZeroTier, Inc.). ZeroTier processes your devices’ IP addresses and network identifiers to establish the connection. This only happens when you use Remote Connect.

Monitoring

AVADO Monitoring (the Grafana package with Prometheus and Node exporter) runs entirely on your AVADO. The metrics stay on your box and are not sent to us or anyone else.

Blockchain data

When you run a node or validator, your node talks to other nodes on that network, and your validator’s activity is recorded publicly on the blockchain. This is how blockchains work; we don’t control that data and can’t delete it.

Who receives your data

We only share personal data where needed for the purposes above:

Vercel Inc. (website hosting)
Google Ireland Ltd. / Google LLC (Tag Manager and Analytics, only with consent)
Twitter International Unlimited Company / X Corp. (X pixel, only with consent)
Klaviyo, Inc. (newsletter)
Shopify International Ltd. and the payment providers shown at checkout (shop)
Stripe Payments Europe Ltd. (Priority Support payments)
ZeroTier, Inc. (Remote Connect, only when you use it)
carriers and customs authorities (delivery)
our email provider (support email)
public authorities, where the law requires it

Transfers outside the EU

Stripe, Vercel, Shopify, Google, Klaviyo and X may process data outside the European Economic Area, including in the United States. Where they do, the transfer is covered by the European Commission’s Standard Contractual Clauses or, where the recipient is certified, the EU–US Data Privacy Framework. You can ask us for more information about these safeguards.

Security

We use technical and organisational measures to protect your data, including encrypted connections (TLS), access controls, least-privilege access and backups. No system is completely secure; if a breach affects your data, we’ll inform you and the supervisory authority as the law requires.

Your rights

Under the GDPR and ZVOP-2 you have the right to:

access the personal data we hold about you;
correct inaccurate data;
erase your data, where there’s no legal reason for us to keep it;
restrict how we process it;
object to processing based on our legitimate interests, and to direct marketing at any time;
data portability: receive data you gave us in a machine-readable format;
withdraw consent at any time, without affecting earlier processing.

To use any of these rights, email support@ava.do. We may ask you to confirm your identity. We answer within one month.

You also have the right to lodge a complaint with the supervisory authority. In Slovenia this is:

Informacijski pooblaščenec (Information Commissioner)
Dunajska cesta 22, 1000 Ljubljana, Slovenia
Phone: +386 1 230 97 30
Email: gp.ip@ip-rs.si
Website: www.ip-rs.si

Children

Our website and products are not aimed at children under 16, and we don’t knowingly collect their data.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows when it last changed. If a change significantly affects how we use your data, we’ll tell you on the website or by email.