This Customer & B2B Privacy Notice describes how Avrio AI, Inc. ("Avrio," "we," "us") handles data associated with recruiters, hiring managers, administrators, and enterprise organizations ("Customers") using the Avrio platform, as well as visitors to customer.avrioai.com and avrioai.com.
1. Scope and Legal Roles
Customer Account Data (Avrio as Data Controller)
Avrio acts as a data controller (or "business") for administrative details, business contact information, billing records, login credentials, and audit logs belonging to Customer Users (recruiters, account administrators, and hiring team members).
Candidate Workflow Data (Avrio as Data Processor)
For job descriptions, candidate applications, interview transcripts, Fit Scores, and hiring notes processed within a Customer's hiring pipeline, the Customer acts as the data controller (or "business"), and Avrio acts as the data processor (or "service provider"). Spoken answers during voice interviews are processed in real time using speech models, and ephemeral voice data is deleted immediately following speech-to-text processing. Processing of candidate workflow data is governed by the Customer Agreement and Data Processing Addendum (DPA).
2. Information Collected from Customer Users
- Account Registration: Name, work email address, company name, job title, phone number, password hash, and, where configured, single sign-on (SSO) identifiers.
- Billing & Plan Data: Payment card details (collected and stored by our payment processor, Stripe; Avrio does not store card numbers), invoicing addresses, plan, and order history.
- Customer Usage & Security Logs: IP addresses, login timestamps, user activity, role assignments, and records of changes made within the platform.
- Job Requisition Content: Job descriptions, required skills, and hiring team notes.
- Website Visits: Pages viewed, referring site, and links followed on avrioai.com, measured without cookies by an analytics tool we host ourselves.
3. How We Use Customer Account Data
We use Customer business and account data to:
1. Provide, maintain, and secure Customer accounts and tenant isolation.
2. Process invoicing, usage billing, and per-hire charges.
3. Maintain security audit trails, detect unauthorized account access, and enforce administrative permissions.
4. Provide technical support, service availability alerts, and feature updates.
5. Comply with legal, accounting, tax, and regulatory obligations.
4. Candidate Data Processing on Behalf of Customers
When processing candidate data within a Customer's workflow, Avrio adheres to the following operational parameters:
- Tenant Isolation: Candidate interview outputs and hiring notes generated for a Customer are logically isolated within that Customer's account.
- Human-in-the-Loop Controls: Automated Fit Scores act strictly as recommendations. The platform has no automated rejection or hiring action; only a user can reject or hire a candidate.
- Legal Retention Support: Candidate evaluation records are retained in the Customer's account for at least 2 years to support Customer compliance with equal employment opportunity statutes (such as EEOC and Title VII recordkeeping).
- Automated Decision Tool (AEDT) Support: On request, Avrio supports Customer compliance with automated employment decision tool regulations, including information about how Fit Scores are produced.
5. Sub-processors and Infrastructure
Avrio engages sub-processors to deliver cloud hosting, AI processing, email, and payments; these sub-processors are bound by data processing terms. Our websites are also hosted by, and load assets from, the providers listed under Website hosting and Website assets below.
- Cloud Infrastructure & Hosting: Amazon Web Services (AWS), Microsoft Azure (United States), CoreWeave, Inc. (GPU infrastructure), Nebius Group N.V. (GPU infrastructure), and Railway (hosting avrioai.com and website analytics).
- AI & Speech Models: Amazon Bedrock, Microsoft Azure OpenAI, and NVIDIA Speech Services.
- Email Service: Amazon Simple Email Service (SES).
- Mobile Applications & Push Notifications: Apple Inc. (iOS) and Google LLC (Android & Google Play).
- Payment Processing: Stripe.
- Website & Content Delivery Assets: Google Fonts, Webflow, and unpkg (content delivery), which receive a visitor's IP address when a page loads.
A current list of sub-processors is published at avrioai.com/subprocessors or available via privacy@goavrio.com.
6. Security Safeguards
Avrio maintains technical, physical, and administrative measures to protect Customer and candidate data, including:
- AES-256 encryption for data at rest and TLS 1.2+ encryption for data in transit.
- Role-based access control (RBAC) for platform accounts.
- Automated vulnerability scanning and pre-release security testing.
- Operational safeguards ensuring staff do not store Customer or candidate data on local devices.
7. Data Location and Cross-Border Transfers
Customer and candidate data is processed and stored in the United States. Where personal data is transferred from the European Economic Area (EEA), the United Kingdom, or Switzerland, Avrio relies on standard contractual clauses (SCCs) or applicable transfer frameworks.
8. Rights of Customer Users
Customer Users may access, update, or correct their account details through their account dashboard or by contacting support@goavrio.com. Account administrators can manage user roles and remove departed team members, and can request an export of their account's data by contacting support.
9. Contact and Notices
Avrio AI, Inc., Attn: Enterprise Privacy & Legal, 131 Dartmouth Street, Boston, MA 02116
Legal & Privacy Notices: privacy@goavrio.com · Support: support@goavrio.com