Privacy policy

Who we are

The controller of your personal data is:

Informacijske storitve Žiga Flis s.p. (“AVADO”, “we”, “us”)
Zelena ulica 7, 3240 Šmarje pri Jelšah, Slovenia
Email: support@ava.do

This policy covers the website www.ava.do, orders placed in our shop at www.ava.do/shop/, email support, the Priority Care subscription (formerly Priority Support), and the data your AVADO device exchanges with our services. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

We don’t sell personal data, and we don’t make decisions about you based solely on automated processing.

Summary

What	Why	Legal basis	How long
Website server logs (Vercel)	Run and secure the website	Legitimate interests	Up to 30 days
Analytics and ads measurement (Google, X)	Understand which pages help and measure ads	Consent	Up to 14 months
Your cookie choice (browser storage)	Remember your choice	Legitimate interests	Until you clear it
Newsletter (Klaviyo)	Send product updates	Consent	Until you unsubscribe
Shop orders (Stripe)	Sell and deliver hardware	Contract, legal obligation	10 years
Email support	Answer your questions	Contract, legitimate interests	3 years
Priority Care (Stripe, priorityapi.ava.do)	Sell and provide the subscription	Contract, legal obligation, legitimate interests	Audit log 12 months; records 10 years after the subscription ends
Priority Care monitoring (AVADO Care app, Resend)	Send alerts and health reports	Contract	Check-ins 90 days; alert log 1 year; email address until 90 days after the subscription ends and the box goes silent
AVADO device update checks	Offer software updates	Contract, legitimate interests	Up to 90 days

The sections below explain each of these.

Website

Hosting and server logs

The website is hosted by Vercel Inc. When you visit a page, Vercel’s servers process your IP address, the page requested, the time, your browser’s user agent and the referring page. We use this to deliver the website, keep it secure and fix errors.

Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
Retention: Vercel keeps these logs for a limited time, no longer than 30 days.

If you select Accept in the cookie banner, we load:

Google Tag Manager and Google Analytics 4 (Google Ireland Ltd.), which record the pages you view, how you arrived, your device and browser type, your approximate location and identifiers stored in cookies.
The X (Twitter) pixel (Twitter International Unlimited Company), which lets us measure whether our ads on X lead to visits.

Nothing is loaded if you select Reject or make no choice. You can change your choice at any time under Cookie settings in the footer of every page.

Legal basis: your consent (Art. 6(1)(a) GDPR and the Slovenian Electronic Communications Act, ZEKom-2). Withdrawing consent doesn’t affect processing that took place before.
Retention: Google Analytics data is kept for up to 14 months. X keeps data according to its own policies.

We store your choice (accept or reject) in your browser’s local storage under the name avado-consent, so the banner doesn’t appear on every page. It stays on your device until you clear your browser data, and we don’t receive it.

Legal basis: this storage is strictly necessary to respect your choice (legitimate interests, Art. 6(1)(f) GDPR).

If you subscribe to the newsletter, your email address, the time you subscribed, your IP address at sign-up and whether you open or click our emails are processed by Klaviyo, Inc., which sends the newsletter for us.

Legal basis: your consent (Art. 6(1)(a) GDPR).
Retention: until you unsubscribe, using the link in every email or by writing to us. After that we keep a record that you unsubscribed, so we don’t email you again.

Shop orders

Our shop is part of this website. Your cart is kept in your browser’s local storage until you check out; it contains only the products and options you chose. You pay on Stripe Checkout (Stripe Payments Europe Ltd.). When you order, we process your name, email address, billing and shipping address, phone number, any tax ID you enter, order details and payment status. You enter your payment details at Stripe and they stay with Stripe; we never see or store your full card details. Stripe acts as our processor for payments, and as an independent controller for its own legal obligations, such as fraud prevention and anti-money-laundering checks. When an order is paid, we receive an order notification email sent through Resend, Inc.

We use the same Stripe account for other businesses operated by Informacijske storitve Žiga Flis s.p. Shop payments are kept separate by product, and data from one business isn’t used for another.

Orders placed in our former shop at shop.ava.do were processed by Shopify International Ltd., whose privacy policy applies to those orders.

We share your delivery details with the carrier and, for shipments outside the EU, with customs.

Purpose: to process your order, deliver it, handle returns and warranty claims, and keep accounting records.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations under accounting and tax law (Art. 6(1)(c) GDPR).
Retention: order records and invoices are kept for 10 years, as required by accounting law.

Email support

When you email support@ava.do, we process your email address, name, the content of your messages and anything you send us, such as screenshots, logs, your device model or order number.

Purpose: to answer your question and resolve your problem.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) where you’re a customer, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Retention: 3 years after our last exchange, so we can refer back to earlier problems with your device.

Priority Care

Priority Care was called Priority Support until 25 September 2026.

Payment by Stripe

Priority Care is paid through Stripe (Stripe Payments Europe Ltd.). Stripe processes your name, email address, billing address and payment details. You enter your card details at Stripe and they stay with Stripe; we never see or store them. Stripe acts as our processor for payments, and as an independent controller for its own legal obligations, such as fraud prevention and anti-money-laundering checks.

We use the same Stripe account for other businesses operated by Informacijske storitve Žiga Flis s.p. Priority Care payments are kept separate by product, and data from one business isn’t used for another.

The Priority Care service

The service that manages subscriptions runs at priorityapi.ava.do on servers in Slovenia. It stores:

your AVADO’s node ID, the public identifier of your box, which links the subscription to that box;
your Stripe customer ID and subscription ID;
your plan (monthly or yearly), the subscription status and the start and end dates of the current period;
an audit log of actions, such as status checks and the creation of checkout and billing-portal sessions, including the IP address each request came from.

If you start a free trial, about 7 days before the first charge we send you one reminder with the date, the price and how to cancel. If you use the AVADO Care app, it also says how many check-ins and alert emails there were during your trial. For it we read the email address you gave at checkout from Stripe, or use your confirmed Priority Care address if there is none. It is sent through Resend (Resend, Inc.), which acts as our processor and receives your email address and the content of the email. Our alert log records each attempt to send it, including failed ones, and is kept for 1 year.

When you contact us as a Priority Care customer, the section on email support also applies.

Purpose: to sell the subscription, check whether a box is covered, remind you before a free trial is charged, provide support, keep accounting records, and detect misuse.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR), our legal obligations under accounting law (Art. 6(1)(c) GDPR), and, for the audit log, our legitimate interest in securing the service and preventing abuse (Art. 6(1)(f) GDPR).
Retention: the audit log is kept for 12 months. Subscription records are kept while the subscription exists and then for 10 years for accounting.

Priority Care monitoring

Priority Care alerts only work if you install the free AVADO Care app on your box and give us an email address. Without the app, your box sends none of the data below.

What the AVADO Care app sends

Every 10 minutes the app sends a short, signed check-in from your box to priorityapi.ava.do. It contains:

your AVADO’s node ID;
the names and versions of the installed apps;
how full the disk is, as a percentage;
the overall health result of the box’s own health checks;
short titles of any problems found, for example that an app has stopped.

It never contains your wallet, private keys, IP addresses, peers or validator data. As with any internet request, our server sees the IP address the check-in comes from, but we don’t store it with this data.

What we store

the check-ins from your box;
the email address you give us for alerts, whether you have confirmed it, and which types of alert you have switched on or off;
the state of each problem, so you get one email per problem and not a new one every 10 minutes;
an alert log of which emails were sent for your box, and when.

Changes to your email settings are also recorded in the audit log described above, without your IP address.

Purpose: to warn you when your box goes offline or has a problem, to warn you about known bad versions and network upgrades that affect your apps, to send the monthly health report, and to help you faster when you contact us.
Legal basis: performance of the Priority Care contract (Art. 6(1)(b) GDPR).
Email delivery: alert and report emails are sent through Resend (Resend, Inc.), which acts as our processor. Resend receives your email address and the content of the email.
Retention: check-ins are deleted after 90 days. The alert log is deleted after 1 year. Your email address is deleted once your subscription has ended and your box has not checked in for 90 days. If your box stops checking in for 90 days, its latest status and problem list are deleted too.

You can stop monitoring at any time by removing the AVADO Care app from your box or by cancelling your subscription. You can switch off each type of alert on the Priority page in the Admin UI.

Your AVADO device

Software updates

Once an hour, your AVADO contacts our update service at rpc.ava.do. It sends the box’s node ID and the list of installed packages with their versions, and receives information about available updates, which the Admin UI then offers to you. Like any internet request, this also transmits your IP address.

Packages are downloaded over IPFS, a peer-to-peer network, so the IPFS nodes that serve the files can see your IP address. Your AVADO also downloads TLS certificates from AVADO so you can open the Admin UI over an encrypted connection.

Purpose: to offer software and security updates and keep your device working.
Legal basis: performance of the contract for the device you bought (Art. 6(1)(b) GDPR) and our legitimate interest in keeping devices secure and up to date (Art. 6(1)(f) GDPR).
Retention: request logs of these services are kept for up to 90 days for operation and security.

Remote Connect

If you use Remote Connect to reach your AVADO from outside your home network, the connection is set up through ZeroTier (ZeroTier, Inc.). ZeroTier processes your devices’ IP addresses and network identifiers to establish the connection. This only happens when you use Remote Connect.

Monitoring

AVADO Monitoring (the Grafana package with Prometheus and Node exporter) runs entirely on your AVADO. The metrics stay on your box and are not sent to us or anyone else. The AVADO Care app for Priority Care is separate; see Priority Care monitoring.

Blockchain data

When you run a node or validator, your node talks to other nodes on that network, and your validator’s activity is recorded publicly on the blockchain. This is how blockchains work; we don’t control that data and can’t delete it.

Who receives your data

We only share personal data where needed for the purposes above:

Vercel Inc. (website hosting)
Google Ireland Ltd. / Google LLC (Tag Manager and Analytics, only with consent)
Twitter International Unlimited Company / X Corp. (X pixel, only with consent)
Klaviyo, Inc. (newsletter)
Stripe Payments Europe Ltd. (shop and Priority Care payments)
Resend, Inc. (order notification emails, Priority Care alert, report and trial-reminder emails)
Shopify International Ltd. (orders placed in our former shop at shop.ava.do)
ZeroTier, Inc. (Remote Connect, only when you use it)
carriers and customs authorities (delivery)
our email provider (support email)
public authorities, where the law requires it

Transfers outside the EU

Stripe, Vercel, Shopify, Google, Klaviyo, Resend and X may process data outside the European Economic Area, including in the United States. Where they do, the transfer is covered by the European Commission’s Standard Contractual Clauses or, where the recipient is certified, the EU–US Data Privacy Framework. You can ask us for more information about these safeguards.

Security

We use technical and organisational measures to protect your data, including encrypted connections (TLS), access controls, least-privilege access and backups. No system is completely secure; if a breach affects your data, we’ll inform you and the supervisory authority as the law requires.

Your rights

Under the GDPR and ZVOP-2 you have the right to:

access the personal data we hold about you;
correct inaccurate data;
erase your data, where there’s no legal reason for us to keep it;
restrict how we process it;
object to processing based on our legitimate interests, and to direct marketing at any time;
data portability: receive data you gave us in a machine-readable format;
withdraw consent at any time, without affecting earlier processing.

To use any of these rights, email support@ava.do. We may ask you to confirm your identity. We answer within one month.

You also have the right to lodge a complaint with the supervisory authority. In Slovenia this is:

Informacijski pooblaščenec (Information Commissioner)
Dunajska cesta 22, 1000 Ljubljana, Slovenia
Phone: +386 1 230 97 30
Email: gp.ip@ip-rs.si
Website: www.ip-rs.si

Children

Our website and products are not aimed at children under 16, and we don’t knowingly collect their data.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows when it last changed. If a change significantly affects how we use your data, we’ll tell you on the website or by email.