Privacy Policy
Last updated: March 11, 2026
Privacy at a Glance
We collect minimal data to power your meeting scheduling and AI chat. We use Google OAuth for authentication — we never store passwords. We never sell your personal information. Google Calendar data is used solely to check availability and create meetings. You can revoke access and request deletion of your data anytime.
Service Overview
AvatarVA provides AI-powered customer engagement tools for small businesses: Avatar Chat (AI chat assistant), Avatar Meet (meeting scheduling with Google Calendar), and Avatar Message (automated messaging and campaigns). All three products are operated by CloudIntelligence.ai LLC, Irvine, California.
1. Introduction
CloudIntelligence.ai LLC ("we," "us," or "our") operates Avatar Meet (avatarva.com, avatarva.com), Avatar Chat (avatarva.com, avatarva.com), and Avatar Message (avatarva.com, avatarva.com), collectively "AvatarVA" or "the Service." AvatarVA is operated by CloudIntelligence.ai LLC, which also operates ToolsInfo.com, AI NewsCycle (ainewscycle.com), and AIPapers.ai. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.
2. Information We Collect
Information You Provide
- Google account information (name, email, profile picture) when you sign in via Google OAuth — we never store your Google password
- Business profile information (business name, email, phone, website) when you create a tenant account
- Team roster data (employee names, emails, roles) when you upload CSV files
- Knowledge base documents (PDFs, CSVs, text files) uploaded to Avatar Chat
- Widget configuration (button colors, intake questions, availability settings)
- Feedback and correspondence when you contact us
Information Collected from Visitors
When a visitor interacts with your Avatar Chat, Avatar Meet, or Avatar Message tools on your website, we collect:
- Visitor-provided information: Name, email address, and responses to intake questions configured by you (the tenant)
- Page context: The URL, page title, and relevant element data from the page where they clicked the widget — used to provide contextual AI responses
- Chat messages: Conversation content exchanged through Avatar Chat
Automatically Collected Information
- Device and browser information (IP address, browser type, operating system)
- Usage data (widget opens, bookings created, pages visited)
- Authentication cookies for maintaining your login session
3. Google Calendar Data
What we access:
- ✅ Free/busy status — we check when you have events to determine available time slots. We do NOT read event titles, descriptions, attendees, or any event details.
- ✅ Create calendar events — when a visitor books a meeting, we create a new Google Calendar event on your behalf with a Google Meet video link.
- ✅ Cancel events we created — if a booking is cancelled, we remove the calendar event we created.
What we NEVER access:
- ❌ We NEVER read your existing calendar event details (titles, descriptions, attendees, locations)
- ❌ We NEVER modify or delete events we did not create
- ❌ We NEVER access your Gmail, Google Drive, Contacts, or any other Google service
- ❌ We NEVER share your calendar data with third parties or use it for advertising
Token storage: Your Google Calendar API refresh token is stored encrypted in our database, used solely to maintain the calendar connection. Tokens are deleted immediately when you disconnect Google Calendar or delete your account.
4. How We Use Your Information
- Authentication: Google account data logs you in and identifies your account
- Meeting scheduling: Calendar access checks your availability and creates meeting events with Google Meet links
- AI chat responses: Uploaded documents and conversation history are sent to Google Gemini API to generate AI-powered responses for your visitors
- Page context: Captured page information helps the AI understand what your visitor is looking at and provide relevant answers
- Analytics: Anonymized usage data (widget opens, bookings, chat messages) is displayed in your admin dashboard
- Service improvement: Aggregate, anonymized usage patterns help us improve the platform
5. Google API Services — Limited Use Disclosure
AvatarVA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We only use Google Calendar data to check free/busy status and create meeting events as explicitly requested by you
- We do not use Google data for advertising purposes
- We do not transfer Google data to third parties except as necessary to provide the Service (creating calendar events on your behalf)
- We do not use Google data for any purpose not explicitly described in this policy
- Humans do not read your Google Calendar data unless required for security purposes, to comply with law, or with your explicit consent
6. Data Storage and Security
Where Your Data is Stored
- Database: MySQL database on Amazon Web Services (AWS) Lightsail, hosted in the United States
- File storage: Uploaded documents are processed into text chunks and stored in our database. Original files are not retained after processing.
- CDN: Cloudflare is used for DDoS protection, SSL termination, and content delivery
Security Measures
- All data transmitted over HTTPS (TLS encryption via Cloudflare)
- Google OAuth for authentication — we never store passwords
- JWT-based session management with httpOnly, secure cookies
- Google Calendar refresh tokens stored securely, never exposed to visitors or third parties
- Database access restricted to authorized application processes only
- We do not sell, rent, or share personal data with any third parties
Security Practices
We implement industry-standard security protections including HTTPS/TLS encryption, Cloudflare DDoS protection, Web Application Firewall, and private database servers. We recommend not uploading highly sensitive documents (SSNs, credit card numbers, medical records, passwords) to the Avatar Chat knowledge base.
7. Third-Party Services
We use trusted third-party services to operate the platform:
- Google OAuth — Authentication (we never store your Google password)
- Google Calendar API — Meeting scheduling and availability checking
- Google Meet — Auto-generated video meeting links (included with Calendar events)
- Google Gemini API — AI-powered chat responses in Avatar Chat. Conversation content and knowledge base chunks are sent to Google's Gemini API for processing. Google Gemini API Terms apply.
- Amazon Web Services (AWS) — Cloud infrastructure and hosting
- Cloudflare — CDN, DDoS protection, and SSL termination
- MySQL — Database storage
8. Data Retention
- Account data: Retained as long as your account is active
- Booking records: Retained for 12 months, then archived
- Chat conversations: Retained for the duration of your account. Deleted when you delete your account or upon request.
- Knowledge base documents: Retained until you delete them from your dashboard
- Calendar tokens: Revoked and deleted when you disconnect Google Calendar or delete your account
- Analytics events: Retained for 90 days
- Server logs: 90 days
9. Cookies
We use a single authentication cookie (va_jwt) to maintain your login session. This is an essential, httpOnly cookie. We do not use tracking cookies, advertising cookies, or any third-party analytics cookies.
10. Your Rights
You have the right to:
- Access your data through your admin dashboard
- Delete your account and all associated data by contacting us
- Disconnect Google Calendar at any time through Google Account permissions
- Export your booking and conversation data
- Correct inaccurate personal information in your dashboard
11. California Privacy Rights (CCPA/CPRA)
California residents have the right to: know what personal information is collected; delete personal information; opt-out of sale (note: we do not sell personal information); non-discrimination for exercising privacy rights; and correct inaccurate information.
To exercise these rights, email [email protected] with "California Privacy Request" in the subject line. We will respond within 45 days.
12. European Privacy Rights (GDPR)
EEA/UK residents have rights of access, rectification, erasure, restriction, portability, objection, and consent withdrawal. We process data based on consent, contract performance, legal obligations, and legitimate interests.
To exercise these rights, email [email protected] with "GDPR Request" in the subject line.
13. Visitor Data Responsibility
When visitors interact with your widget, you (the tenant) are the data controller for the personal information they provide. You agree to inform your visitors that their data is collected, have an appropriate privacy policy on your own website, and handle visitor data in compliance with applicable laws.
14. Children's Privacy
AvatarVA (Avatar Chat, Avatar Meet, and Avatar Message) is designed for business professionals and is not intended for children under 16. We do not knowingly collect information from children under 16.
15. Changes to This Policy
We may update this Privacy Policy periodically. We will post the updated policy with a new "Last Updated" date. Continued use after changes constitutes acceptance.
16. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights:
Email: [email protected]
Legal: