Avoylo Privacy Policy

Version: 0.1 Last Updated: September 28, 2026 Effective Date: [TBD BEFORE PUBLICATION]

This Privacy Policy explains how [COMPANY LEGAL NAME TBD], doing business as Avoylo ("Avoylo," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information in connection with Avoylo's websites, applications, Seller services, Host services, logistics network, support, billing, payouts, shipping integrations, and related services.

This Policy should be read together with the Avoylo Privacy & Location Policy, which contains additional rules for precise Host Location data, recipient information, operational photographs, and other location-sensitive information.

1. Scope

This Privacy Policy applies to personal information we process in connection with:

• website visitors;
• Seller users;
• Host applicants and Hosts;
• Seller customers whose orders are fulfilled through Avoylo;
• people who contact support;
• authorized organization users;
• equipment purchasers;
• claimants;
• payment and payout participants; and
• other people whose information is processed through the Services.

This Policy does not govern a third party's independent processing under its own privacy policy.

2. Seller Customer Data

When a Seller sends customer order data to Avoylo for fulfillment, Avoylo processes that information to provide logistics and related services.

Depending on the relationship and applicable law, Avoylo may act as a service provider, processor, contractor, or independent business/controller for specific processing activities.

The Seller remains responsible for providing any privacy notice and obtaining any lawful authorization required for the Seller's own collection and disclosure of customer information to Avoylo.

3. Information You Provide

We may collect information you provide directly, including:

• name;
• email address;
• phone number;
• account credentials;
• organization name;
• role;
• support messages;
• profile information;
• preferences;
• Seller business information;
• Host application information;
• Host Location information;
• equipment order information;
• tax information;
• payout information;
• identity-verification information;
• product information;
• Parcel information;
• shipment data;
• customer recipient information;
• incident reports;
• claims;
• photographs or evidence; and
• other information you choose or are required to provide.

4. Account Information

Account information may include:

• user identifier;
• email;
• verified login identity;
• authentication provider;
• organization membership;
• roles;
• account status;
• session/security events; and
• consent or policy-acceptance records.

We do not need your third-party login-provider password to authenticate you through an approved OAuth flow.

5. Seller Information

Seller-related information may include:

• business name;
• business contact details;
• authorized users;
• Parcel profiles;
• products;
• dimensions;
• weights;
• declared values;
• categories;
• storage bids;
• inventory quantities;
• orders;
• returns;
• billing records;
• claims;
• customer shipping data; and
• connected commerce-account information.

6. Host Information

Host-related information may include:

• legal or preferred name;
• contact information;
• exact Host Location;
• coarse service area;
• capacity;
• availability;
• processing windows;
• storage conditions;
• security features;
• optional CCTV status;
• pickup preferences;
• operational photographs;
• identity-verification information;
• tax information;
• payout information;
• equipment;
• Host earnings;
• incident history; and
• fulfillment activity.

7. Customer Recipient Information

For fulfillment, we may process information about a Seller's customer such as:

• recipient name;
• shipping address;
• phone number where required;
• email where required;
• order identifier;
• shipment information;
• carrier tracking;
• delivery instructions; and
• return information.

We do not require Hosts to receive customer payment-card credentials.

8. Identity Verification

Where identity verification is required, we or an authorized verification provider may process:

• legal name;
• date of birth;
• government-issued identification;
• document images;
• verification result;
• address;
• selfie or liveness information where required by the provider; and
• fraud-risk signals.

Avoylo should minimize retention of raw identity documents where the verification purpose can be satisfied by retaining a result or provider reference.

9. Payment Information

Seller payments may be processed by a payment provider such as PayPal.

We may receive or retain:

• payment-provider customer/reference identifiers;
• provider order ID;
• capture ID;
• amount;
• currency;
• payment status;
• timestamps;
• statement linkage;
• dispute status; and
• refund information.

We do not need to store a Seller's PayPal password.

Where payment credentials are entered directly into a third-party provider's interface, the provider processes those credentials under its own terms.

10. Host Payout Information

Where Host payouts are enabled, we may process:

• payout-provider account/reference;
• payout destination details;
• verification result;
• payout status;
• amount;
• currency;
• tax information;
• provider transaction reference; and
• compliance information.

Access to payout information is restricted.

11. Tax Information

Where required, we may collect or process:

• taxpayer name;
• taxpayer identification information;
• tax forms;
• business classification;
• tax address;
• withholding information; and
• reporting records.

Tax information is used for lawful payment, payout, accounting, and reporting purposes.

12. Location Information

We process different kinds of location information, including:

• coarse Seller or Host area;
• exact Host Location;
• customer shipping address;
• carrier origin and destination;
• transfer destination;
• serviceability data; and
• operational location evidence.

Exact Host Location is subject to the additional restrictions in the Privacy & Location Policy.

13. Photos and Operational Evidence

We may process:

• staging photographs;
• inbound damage photographs;
• incident photographs;
• storage-area verification images;
• equipment images;
• screenshots provided to support;
• carrier proof-of-delivery; and
• other operational evidence.

We may record metadata such as uploader, timestamp, linked object, file type, file size, and integrity hash.

14. Information From Carriers

Carriers and shipping providers may provide:

• tracking events;
• pickup status;
• carrier acceptance;
• delivery status;
• delivery evidence;
• shipment adjustments;
• weight/dimension corrections;
• carrier claim data; and
• service exceptions.

15. Information From Commerce Platforms

If a Seller connects a commerce platform such as Shopify, we may receive information authorized through that integration, such as:

• connected shop identifier;
• shop domain;
• product or variant identifiers;
• order identifiers;
• order status;
• fulfillment data;
• cancellation data; and
• webhook events.

We should request only the scopes reasonably necessary for the enabled integration.

16. Information From Login Providers

If you sign in through an identity provider such as Google, we may receive:

• provider user ID;
• email;
• verified-email status;
• display name;
• profile image where supplied; and
• authentication metadata.

We do not receive your provider password.

17. Device and Technical Information

We may automatically collect:

• IP address;
• browser type;
• device type;
• operating system;
• app version;
• language;
• timestamps;
• request identifiers;
• session information;
• security events;
• error logs;
• network information; and
• other technical data reasonably necessary to operate and secure the Services.

18. Cookies and Similar Technologies

We may use cookies, local storage, session storage, and similar technologies for:

• authentication;
• security;
• preferences;
• fraud prevention;
• session continuity;
• service operation;
• analytics; and
• performance.

Advertising or nonessential analytics technologies, if used, are addressed in Avoylo's cookie disclosures and consent controls where required.

19. Sources of Information

We may receive personal information from:

• you;
• your Seller or Host organization;
• Sellers;
• Hosts;
• carriers;
• payment providers;
• payout providers;
• identity providers;
• ecommerce platforms;
• identity-verification providers;
• support providers;
• fraud/security providers;
• public authorities;
• insurers or claims providers where applicable; and
• other service providers used for the Services.

20. Why We Use Personal Information

We may use personal information to:

• create and secure accounts;
• authenticate users;
• verify eligibility;
• operate Seller and Host services;
• match Placements;
• coordinate inbound and outbound shipping;
• maintain inventory custody;
• create and verify labels;
• process billing;
• record Host earnings;
• process payouts;
• provide support;
• investigate incidents;
• manage claims;
• prevent fraud;
• enforce agreements;
• maintain security;
• comply with law;
• improve product reliability;
• communicate service updates;
• manage equipment programs; and
• perform other purposes disclosed at collection.

21. Legal Bases Where Required

Where laws such as the GDPR or UK GDPR require a legal basis, we may rely on:

• performance of a contract;
• steps requested before entering a contract;
• compliance with legal obligations;
• legitimate interests;
• consent;
• protection of vital interests; or
• another lawful basis available under applicable law.

The applicable basis depends on the processing context.

22. Legitimate Interests

Our legitimate interests may include:

• operating a secure logistics network;
• preventing fraud;
• protecting users and inventory;
• maintaining accurate financial records;
• improving reliability;
• enforcing agreements;
• investigating abuse;
• defending legal claims; and
• understanding service performance.

Where required, we balance these interests against the rights and interests of affected individuals.

23. Service Communications

We may send transactional or service communications such as:

• login/security notices;
• Host Opportunities;
• shipment updates;
• billing notices;
• payout notices;
• policy notices;
• incident updates;
• support responses; and
• other operational messages.

You may not be able to opt out of communications necessary to provide or secure an active service.

24. Marketing Communications

Where permitted, we may send marketing communications.

You may opt out of promotional emails through the unsubscribe mechanism or applicable account setting.

Opting out of marketing does not stop necessary service communications.

25. Host Exact Address

A Host's exact address is not ordinary public marketplace information.

We disclose or use it only for legitimate operational, safety, legal, shipping, transfer, claims, security, or compliance purposes as described in the Privacy & Location Policy.

26. Customer Data Minimization

Hosts receive only the customer information reasonably necessary to complete assigned fulfillment.

A Host must not use customer information for unrelated marketing or personal purposes.

27. When We Share Information

We may disclose personal information to:

• service providers;
• carriers;
• payment providers;
• payout providers;
• identity-verification providers;
• commerce platforms;
• cloud and database providers;
• support vendors;
• analytics providers;
• security vendors;
• professional advisers;
• insurers or claims administrators where applicable;
• legal authorities; and
• parties to a corporate transaction.

Disclosure is limited according to role, purpose, contract, and law where applicable.

28. Seller-Host Disclosure

Seller and Host participants may receive limited information about each other when required to perform an authorized Placement, Shipment, transfer, removal, Incident, or Claim.

Participation in one transaction does not provide unrestricted access to the other party's account.

29. Service Providers

We may engage processors, contractors, or service providers to process information on our behalf.

We seek to provide them only the information reasonably necessary for their service and to impose appropriate contractual or confidentiality protections where required.

30. Carriers

Carriers receive shipping information necessary to perform transportation.

Carrier processing is also subject to the carrier's own privacy practices and legal obligations.

31. Payment and Payout Providers

Payment and payout providers receive information necessary to process transactions, verify participants, prevent fraud, comply with financial laws, and resolve disputes.

Those providers may independently determine some processing under their own legal obligations.

32. Legal Disclosure

We may disclose information where reasonably necessary to:

• comply with law;
• respond to lawful process;
• protect rights;
• prevent fraud;
• protect safety;
• investigate abuse;
• enforce agreements;
• respond to emergencies; or
• defend legal claims.

33. Corporate Transactions

If Avoylo is involved in a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be disclosed or transferred as part of that transaction subject to applicable law.

34. No Sale for Money

Avoylo does not sell personal information for money as part of its ordinary service model.

If Avoylo later engages in activity that applicable privacy law defines as "sale" or "sharing" for cross-context behavioral advertising, Avoylo will provide the required disclosures and opt-out mechanisms before doing so.

35. Precise Host Location and Advertising

We do not use precise Host residential addresses as advertising-targeting data merely because a person is a Host.

Coarse location may be used for service coverage, operational planning, and aggregated analytics.

36. Data Retention

We retain personal information for as long as reasonably necessary for the purpose for which it was collected and for legitimate legal, operational, accounting, security, and dispute needs.

Retention depends on the data category.

Examples include:

• active account information: while the account remains active and for a reasonable period afterward;
• transaction, billing, payout, and tax records: for the period required by accounting, tax, anti-fraud, and legal obligations;
• custody and shipment records: as needed for transaction history, claims, audit, and legal defense;
• incident and claims evidence: through resolution and an appropriate post-resolution period;
• security logs: for a period reasonably necessary for security and investigation;
• precise Host Location: while operationally active and afterward where linked to historical custody, claims, tax, fraud, or legal records.

We may de-identify information instead of deleting it where appropriate.

37. Deletion Limitations

We may retain information despite a deletion request where necessary for:

• legal compliance;
• tax or accounting;
• fraud prevention;
• security;
• active inventory custody;
• payment or payout;
• claims;
• dispute resolution;
• enforcement of agreements; or
• exercise or defense of legal rights.

38. Security

We use administrative, technical, and organizational measures designed to protect personal information.

Measures may include:

• encryption in transit;
• access controls;
• role-based authorization;
• private storage;
• session controls;
• audit logging;
• service-role isolation;
• secrets management;
• request validation;
• rate limits;
• authentication;
• step-up controls; and
• security monitoring.

No system is guaranteed to be perfectly secure.

39. Access Controls

Sensitive data such as:

• Host exact addresses;
• identity records;
• payout data;
• tax information;
• private evidence;
• customer recipient data; and
• financial records

should be limited to authorized users, staff, and providers with a legitimate need.

40. International Transfers

Avoylo may process information in countries other than where you live.

Where required, we use an appropriate transfer mechanism or safeguard, which may include:

• adequacy decisions;
• standard contractual clauses;
• contractual safeguards;
• or another legally recognized mechanism.

41. Your Privacy Rights

Depending on your location, you may have rights to:

• access;
• know;
• correct;
• delete;
• obtain a copy;
• restrict processing;
• object;
• withdraw consent;
• opt out of certain sales/sharing;
• appeal a privacy decision; or
• complain to a regulator.

Rights vary by jurisdiction and may be subject to exceptions.

42. Exercising Rights

Privacy requests may be submitted through:

Privacy Contact: [TBD]

We may need to verify your identity and authority before fulfilling a request.

If you make a request for another person, we may require proof that you are authorized to act for that person.

43. Authorized Agents

Where applicable law permits an authorized agent to submit a privacy request, we may require:

• proof of authorization;
• identity verification;
• direct confirmation from the individual; or
• another legally permitted verification step.

44. Appeals

Where applicable law grants a right to appeal a denied privacy request, you may submit an appeal through the Privacy Contact identified below.

We will respond according to applicable law.

45. EEA and UK Rights

Where the GDPR or UK GDPR applies, you may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• portability;
• objection; and
• withdrawal of consent.

You may also lodge a complaint with the competent supervisory authority.

46. U.S. State Privacy Rights

Residents of certain U.S. states may have rights concerning:

• categories of information collected;
• sources;
• purposes;
• categories of disclosures;
• access;
• correction;
• deletion;
• portability;
• opt-out of sale/sharing or targeted advertising where applicable;
• and non-discrimination for exercising privacy rights.

Avoylo will provide jurisdiction-specific notices where required.

47. California Notice

If the California Consumer Privacy Act, as amended, applies to Avoylo, California residents may have rights to know, delete, correct, and opt out of certain sale/sharing activities, subject to statutory exceptions.

Avoylo does not currently sell personal information for money as part of its ordinary service model.

A final California notice should be updated based on Avoylo's actual launch data practices and legal-entity status before public launch.

48. Children

Avoylo operational Seller and Host accounts are not intended for children under 18.

Avoylo may process a minor recipient's name or shipping address when a Seller lawfully submits an order for fulfillment, but Avoylo does not use that fact to create an operational account for the minor.

If you believe a child has independently created an unauthorized operational account, contact Avoylo.

49. Automated Decision-Making

Avoylo may use automated rules to support:

• matching eligibility;
• fraud detection;
• security;
• operational prioritization;
• rate calculations; and
• other service functions.

Where applicable law grants rights concerning solely automated decisions with legal or similarly significant effects, Avoylo will provide the required process.

50. Fraud and Abuse Prevention

We may use account, device, transaction, shipping, evidence, and security information to detect:

• duplicate accounts;
• fabricated events;
• unauthorized access;
• payment fraud;
• payout fraud;
• inventory theft;
• policy evasion;
• suspicious shipping;
• and other abuse.

51. Analytics

We may use analytics to understand:

• service performance;
• errors;
• feature usage;
• operational throughput;
• conversion;
• capacity;
• reliability; and
• product improvement.

Where required, nonessential analytics are subject to consent or opt-out controls.

52. De-Identified and Aggregated Information

We may create aggregated or de-identified information that does not reasonably identify an individual.

We may use such information for:

• analytics;
• planning;
• research;
• network design;
• product improvement;
• security;
• and business operations.

Where applicable law requires, we will maintain de-identified information in de-identified form and not attempt to re-identify it except as permitted.

53. Links to Other Services

The Services may link to third-party sites or services.

Their privacy practices are governed by their own policies.

54. Changes to this Privacy Policy

We may update this Privacy Policy prospectively.

We will change the "Last Updated" date and provide additional notice where required for material changes.

55. Contact and Controller Information

Company Legal Name / Controller: [TBD] Privacy Contact: [TBD] Data Protection Contact: [TBD IF APPLICABLE] Security Contact: [TBD] Business Address: [TBD] EEA/UK Representative: [TBD IF REQUIRED] Data Protection Officer: [TBD IF REQUIRED]