1. Who we are
AVAIA is a media production and publishing-operations platform for news agencies. In this policy, “AVAIA”, “we” and “us” mean the operator of AVAIA: News LLC.
For this website and for the accounts of people who sign in to AVAIA, we decide how personal data is used (we act as the controller). For content that an agency uploads or produces in AVAIA — such as stories, photos, audio and video — the agency decides what is processed and why; we process that content on the agency’s behalf to provide the service (we act as a processor or service provider). Agencies that need a data processing agreement can request one from us.
2. Scope
This policy covers the public website at avaia.cc and the AVAIA platform used by agencies.
AVAIA is provided to news agencies and their authorised users; there is no public consumer sign-up. AVAIA’s Facebook, Instagram and Threads integration is in development: no such accounts can be connected yet, and AVAIA does not currently receive data from them. AVAIA’s TikTok and YouTube integrations are also in development, with the same status. Sections 5, 6 and 7 describe what will apply once account connection is available.
3. This website
- No cookies, analytics or advertising. This website sets no cookies and loads no analytics, advertising, social-media pixels or other third-party trackers. Fonts and images are served from our own domain.
- No forms. The website has no sign-up, contact or newsletter form.
- Hosting logs. The website is delivered by Cloudflare. To deliver pages and protect the site against abuse, Cloudflare processes technical data such as your IP address, browser user agent, the page requested and the time of the request. We do not use this data to identify or profile visitors.
- Theme preference. If you press the light/dark theme button, your choice is stored in your browser’s local storage under the key
avaia-theme. It never leaves your device. See the Cookie Policy. - Emails you send us. If you email us, we process your email address, name and message to reply to you.
4. Data processed in the AVAIA platform
When an agency uses AVAIA, we process the following categories of data:
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email address, the agency you belong to, your role in that agency | You or your agency administrator |
| Sign-in and session data | Session identifiers and authentication records needed to keep you securely signed in | Generated by the platform |
| Agency brand data | Logos, colours, fonts, templates and brand rules | Your agency |
| Content and media | Story text, photos, audio, video and other files the agency uploads, and the outputs AVAIA produces from them (cards, motion cards, videos, voice tracks). This content may include personal data about people who appear in the news. | Your agency |
| Operational records | Jobs, history and workflow events: which user started which job, from which story, with which brand and template version | Generated by the platform |
| Usage and cost records | Counts of rendering, voice and AI-provider operations attributed to an agency | Generated by the platform |
| Technical and security logs | IP address, browser and device information, error logs | Your device and our systems |
| Connected-account data | See sections 5, 6 and 7 (once account connection is available) | Meta platforms, TikTok and Google (YouTube), with the agency’s authorisation |
5. Facebook, Instagram and Threads data
Status: in development. Account connection is not yet available, and AVAIA does not hold data from Facebook, Instagram or Threads accounts.
Once available, an agency administrator will be able to connect accounts the agency owns or manages, using Meta’s own login and authorisation screens. AVAIA will receive only the data covered by the permissions the administrator approves:
| Platform | Permissions | What AVAIA would access and why |
|---|---|---|
| Facebook Pages | pages_show_list, pages_read_engagement, pages_manage_posts, read_insights | The list of Pages you manage so you can choose which to connect; Page details and engagement data; publishing posts the agency approves; Page and post performance metrics shown to that agency. |
| Instagram professional accounts | instagram_business_basic, instagram_business_content_publish, instagram_business_manage_insights | Basic account profile and media; publishing content the agency approves; account and media performance metrics shown to that agency. |
| Threads | threads_basic, threads_content_publish, threads_manage_insights | Basic profile; publishing posts the agency approves; profile and post performance metrics shown to that agency. |
We will update this policy before requesting any additional permission.
How we will handle Meta platform data:
- Access tokens issued by Meta are stored on our servers with restricted access, scoped to the agency workspace that connected the account, never exposed in web pages, and never shared with other agencies.
- We use this data only to perform the actions the agency requests (publishing and showing performance information to that agency).
- We do not sell this data, use it for advertising, build profiles of individuals from it, or transfer it to data brokers.
- We do not use data received from Meta platforms to train AI models.
- We comply with the Meta Platform Terms and Developer Policies.
- An agency will be able to disconnect an account at any time; you will also be able to remove AVAIA from your Meta account settings. On disconnection or removal, we delete the related access tokens and stop retrieving data. See the Data Deletion instructions.
6. TikTok data
Status: in development. Account connection is not yet available, and AVAIA does not hold data from TikTok accounts.
Once available, an agency administrator will be able to connect TikTok accounts the agency owns or manages, using TikTok’s own login and authorisation screens (TikTok Login Kit). AVAIA will receive only the data covered by the scopes the account holder approves:
| Scope | What AVAIA would access and why |
|---|---|
user.info.basic | The account’s open ID, display name and avatar, to show which TikTok account is connected. |
video.upload | Sending a video the agency has approved to the account’s TikTok inbox as a draft, which the account holder then reviews and posts in TikTok. |
video.publish | Posting a video the agency has approved directly to the account, only after the user reviews the post details and confirms in AVAIA. |
We will update this policy before requesting any additional TikTok scope.
How we will handle TikTok data:
- Access tokens issued by TikTok are stored on our servers with restricted access, scoped to the agency workspace that connected the account, never exposed in web pages, and never shared with other agencies.
- We use this data only to perform the actions the agency requests. AVAIA does not post automatically or on a schedule without a user’s action.
- We do not sell this data, use it for advertising, build profiles of individuals from it, or use it to train AI models.
- We comply with the TikTok Developer Terms of Service and TikTok’s developer guidelines.
- You will be able to disconnect the account inside AVAIA, or remove AVAIA in the TikTok app under Settings and privacy → Security & permissions → Apps and services permissions. On disconnection or removal, we delete the related access tokens and stop retrieving data. See the Data Deletion instructions.
7. YouTube data
Status: in development. Account connection is not yet available, and AVAIA does not hold data from YouTube or Google accounts.
AVAIA uses YouTube API Services. Once available, an agency administrator will be able to connect a YouTube channel the agency owns or manages by signing in on Google’s own consent screen. AVAIA will receive only the data covered by the permissions the account holder approves:
| Permission | What AVAIA would access and why |
|---|---|
openid, profile | The Google account’s name and profile picture, to show which account is connected. |
youtube.upload | Uploading a video the agency has approved to the connected channel, with the title, description and privacy setting the user chooses. This permission does not let AVAIA read, edit or delete other videos. |
By using AVAIA’s YouTube features, you agree to be bound by the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy. We will update this policy before requesting any additional Google permission.
How we will handle YouTube and Google data:
- AVAIA’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Access tokens issued by Google are stored on our servers with restricted access, scoped to the agency workspace that connected the account, never exposed in web pages, and never shared with other agencies.
- We use this data only to perform the actions the agency requests. AVAIA does not upload automatically or on a schedule without a user’s action.
- We do not sell this data, use it for advertising, build profiles of individuals from it, or use it to train AI models.
- You will be able to disconnect the account inside AVAIA; we then revoke the token immediately and delete the related data within 7 days. You can also revoke AVAIA’s access at any time on Google’s security settings page; we then delete the related data within 30 days. See the Data Deletion instructions.
- Questions or complaints about how AVAIA handles this data can be sent to the contact in section 17.
8. Purposes and legal bases
We use personal data to:
- provide the AVAIA platform to agencies: accounts, production, rendering, voice, storage, history and publishing;
- keep the platform secure, prevent abuse and keep agencies’ data separated from each other;
- operate, troubleshoot and improve reliability, and attribute usage and costs to the right agency;
- respond to enquiries, support requests and privacy requests;
- comply with legal obligations and enforce our terms.
Where data-protection law requires a legal basis, we rely on: performance of our contract with the agency; our legitimate interests in operating, securing and improving AVAIA; the consent given when an administrator connects a Meta, TikTok or Google account (which can be withdrawn at any time by disconnecting it); and compliance with legal obligations.
9. Service providers and sharing
We do not sell personal data. We share it only with service providers that help us run AVAIA, under contracts that limit their use of the data, and only as needed for the features an agency uses:
- Cloudflare — website delivery and security; object storage for platform media.
- OpenAI — AI processing of text or images when an agency uses AI-assisted features.
- ElevenLabs — voice synthesis: the text to be spoken is sent to generate audio.
- Buffer and Telegram — only when an agency publishes through them.
- Meta — only when an agency connects Facebook, Instagram or Threads accounts (not yet available).
- TikTok — only when an agency connects TikTok accounts (not yet available).
- Google (YouTube) — only when an agency connects a YouTube channel (not yet available).
- Cloud server hosting providers — hosting of AVAIA’s application servers and databases.
An up-to-date list of service providers is available on request.
We may also disclose data when required by law or valid legal process, to protect the rights, safety and security of agencies, users or the public, or in connection with a merger, acquisition or sale of assets, in which case this policy will continue to apply to the data transferred.
10. International transfers
Our service providers may process data in countries other than yours. Where the law requires it, we rely on appropriate safeguards for such transfers, such as contractual commitments from the providers.
11. Retention
We keep personal data only as long as needed for the purposes above:
- Account data and agency content: for as long as the agency uses AVAIA, then deleted or anonymised once it is no longer needed, unless the law requires us to keep it longer.
- Meta, TikTok and Google access tokens: deleted when the account is disconnected or AVAIA is removed from the Meta, TikTok or Google account.
- Technical and security logs: only as long as needed for security, troubleshooting and reliability.
- Backups: deleted data may remain in backups until those backups expire in their normal rotation.
- Emails and support requests: as long as needed to handle the request and any follow-up.
12. Security
We protect data with measures appropriate to the risk, including encrypted connections (HTTPS), access controls, separation of each agency’s data in the data layer, isolation of provider credentials, and tested backup and recovery procedures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
13. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive a copy of it, and to withdraw consent where processing is based on consent. You may also have the right to complain to a data-protection authority.
If your request concerns content that an agency controls (for example, a story in which you appear), we will forward it to that agency or help it respond.
To exercise your rights, email support@avaia.cc. We may need to verify your identity before acting on a request. We respond without undue delay and within the period required by applicable law.
14. Deleting your data
You can ask us to delete personal data associated with AVAIA at any time. The current process is a manual, verified request by email; AVAIA does not yet offer automated self-service deletion. Step-by-step instructions, including how to remove AVAIA’s access from Facebook, Instagram, Threads, TikTok and YouTube, are on the Data Deletion page.
15. Children
AVAIA is a professional tool for news organisations and is not directed to children. We do not knowingly collect personal data from children through this website or for AVAIA accounts.
16. Changes to this policy
We will update this policy when our practices change — including before any new Meta permission, TikTok scope or Google permission is requested or any new type of data is collected — and will change the date at the top of this page. Material changes will be communicated to agencies in advance.
17. Contact
Privacy questions and requests: support@avaia.cc
Operator: News LLC