Privacy Policy

DRAFT — legal review required. Updated October 13, 2026.

Operator: AVORA Assets — brand of a pilot (MVP); the legal entity is not yet incorporated. Postal address and public support/privacy email: TO BE CONFIRMED BY AVORA before public launch.

AVORA is the proposed controller for this pilot. The legal identity and contact channel above must be completed. This draft does not certify LGPD or GDPR compliance.

Name, email, optional phone, authentication records and user-entered assets, debts, costs, scenarios and outcomes support your private workspace. Technical audit records protect the service. Session, language and local portfolio storage support app functionality. Phone is not required.

Advisor waiting list: if you choose to join it on the campaign page, AVORA stores your name, email, the type of asset (car, boat or property) and the page language, with your consent, only to contact you about the advisor network. No asset data is collected there. You may ask to be removed through the contact channel.

Account processing is proposed as necessary to provide the requested service. Security requires a documented legitimate-interest assessment or applicable legal obligation. Final legal bases require review. Meta Pixel is disabled until optional-cookie consent. AVORA also counts visits and funnel steps in aggregate (day, page, traffic source and step name only), without cookies, device storage, names, emails or answers; this count does not depend on optional cookies. Refuse or withdraw in Cookie preferences without losing access. Your choice stays in this browser for up to 180 days. Withdrawal stops future optional tracking without invalidating prior lawful processing.

Supabase handles authentication and portfolio storage; Sites/Cloudflare supports hosting and operations. Explanation requests may send asset inputs and deterministic results to the configured AI report service. Meta receives browser visit information only after consent. Provider contracts, AI provider identity, processing locations and international-transfer safeguards are TO BE CONFIRMED. Your portfolio is not a public listing.

AI-written reports are disabled in this pilot; explanations come from the AVORA model. If they are enabled in the future, this policy will be updated before any asset data is sent to an AI provider. Market references are read by AVORA servers from its own reference base; no portfolio data is sent to the public data sources cited. Sources are named in the panel with their required attributions.

Data is retained to operate your account, with possible legal, security and backup exceptions after deletion. Exact retention periods and coordinated deletion across databases and backups are TO BE CONFIRMED. Authentication and access checks reduce risk but do not guarantee absolute security.

Depending on applicable law, you may request access, correction, deletion, portability, restriction or objection, sharing information and withdrawal of consent. You may seek review of automated decisions where applicable and complain to the ANPD or competent European authority. The pending contact channel must be completed to receive requests. Identity verification must be proportionate; response deadlines follow applicable law.

The pilot does not knowingly solicit children’s data. Material changes should be communicated, and new optional purposes require appropriate consent.