This Privacy Policy ("Policy") describes the privacy and data governance practices of MyAiAvatar ("the Platform," "we," "us," or "our") with respect to the collection, ingestion, cryptographic protection, logical segregation, processing, and deletion of information gathered through our website, application programming interfaces, voice telecommunications gateways, and autonomous executive studio services (collectively, the "Services").
At MyAiAvatar, data privacy, cryptographic containment, and algorithmic confidentiality form the foundation of our engineering architecture. This Policy details our technical and operational safeguards, including our comprehensive AES-256 Server-Side Encryption (SSE), logical multi-tenant sandboxing, and our binding Zero Model Training Guarantee. By accessing, registering for, or operating any capability of MyAiAvatar, you acknowledge and consent to the data practices described herein.
1. Categories of Information We Process
We process information only to the minimum extent necessary to calibrate, host, execute, and safeguard your personal AI avatar fleet and associated autonomous telecommunications:
- Account & Identity Metadata: Name, verified electronic mail address, hashed password credentials, cryptographic session tokens, IP addresses, browser user-agent signatures, account status, and subscription tier identifiers.
- Biometric Voice Calibration & Identity Data: Audio recordings, vocal frequency vectors, speech cadence samples, phoneme calibrations, synthetic neural voice IDs, and user-provided biographical background narratives used to calibrate your synthetic avatar.
- Electronic Mail & Inbound Communication Data: Inbound message bodies, sender identities, subject lines, header metadata, timestamps, and drafted outbound responses synced via connected IMAP, JMAP, or Google API gateways for autonomous or human-supervised triage.
- Voice Telephony, Audio Streams & Call Transcripts: Inbound and outbound caller telephone numbers, call duration metrics, answering machine detection (AMD) results, WebRTC bidirectional audio packets, and machine-generated speech-to-text transcripts generated during telephone consultations or automated voicemails.
- Calendar & Scheduling Data: Free/busy availability metadata, appointment booking requests, meeting duration preferences, meeting provider links (e.g., Zoom, Google Meet), and confirmed calendar invitations.
- Contact Management Records: Contact names, corporate affiliations, professional titles, communication notes, and "do not contact" / blocklist directives managed within your private studio contacts catalog.
- Billing & Transactional Metadata: Transaction identifiers, subscription periods, payment status, and compute credit reload history processed through PCI-DSS Level 1 certified payment processors (e.g., Stripe). MyAiAvatar never stores raw primary credit card numbers or CVV codes on its servers.
2. Cryptographic Architecture: Server-Side Encryption (AES-256-GCM)
2.1 Encryption at Rest: MyAiAvatar enforces comprehensive Server-Side Encryption (SSE) across all persistent storage environments. All sensitive subscriber credentials, mailbox authentication secrets, OAuth access and refresh tokens, private email contents, and audio call transcripts stored in database tables are encrypted utilizing the Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode (AES-256-GCM).
2.2 Unique Initialization Vectors & Authentication Tags: Every encrypted database record is processed with an independent, cryptographically secure 12-byte Initialization Vector (IV) and verified via a 16-byte authentication tag (`enc:v1:
2.3 Isolated Key Management: Encryption keys are segregated from application databases and maintained exclusively in isolated server runtime environments. Database dumps, disk backups, and raw cloud storage tables hold solely indecipherable ciphertext, preventing data exposure even in the event of unauthorized physical storage inspection.
2.4 Transport Layer Security (TLS 1.3 / 1.2): All communications between your client workstations, mobile browsers, carrier telecommunications switches, third-party mail servers, and MyAiAvatar ingress endpoints are protected in transit using modern Transport Layer Security (TLS 1.3 and TLS 1.2) cryptographic protocols. Unencrypted HTTP connections are rejected and automatically upgraded.
3. Logical Multi-Tenancy & Runtime Memory Sandboxing
3.1 Tenant Isolation: MyAiAvatar operates on a strictly partitioned logical multi-tenant architecture. Every database query, execution thread, and administrative API call is cryptographically validated and scoped exclusively to verified subscriber account identifiers (`user_id` / `avatar_id`). No subscriber is granted system-level authorization or architectural capability to probe, query, or view another subscriber's records, avatar configurations, or communication logs.
3.2 Runtime Execution Sandboxes: When your avatar executes real-time inferences—such as evaluating an inbound phone call, synthesizing a voice stream, or drafting an email reply—processing occurs inside ephemeral memory sandboxes. Prompt assembly buffers, dynamic context vectors, and conversational state machines exist in transient server memory solely for the microsecond duration required to synthesize the response, after which memory buffers are immediately cleared and reclaimed by system garbage collection.
3.3 Hardware & Framework Hardening: Production servers operate with disabled server identification headers (`X-Powered-By`), strict anti-framing policies (`X-Frame-Options: SAMEORIGIN`), anti-MIME-sniffing headers (`X-Content-Type-Options: nosniff`), and disabled client-side console logging in production environments to prevent client-side introspection and debugging leakage.
4. Zero Model Training & Enterprise AI Inference Commitments
We believe that your personal voice, thoughts, writings, and corporate relationships belong solely to you. We provide the following explicit institutional guarantees:
- No Public Foundation Model Training: Your voice calibration audio recordings, uploaded knowledge documents, private email correspondence, contact records, and prompt directives are never used to train, fine-tune, align, or calibrate public artificial intelligence foundation models or general-purpose commercial models.
- Commercial Enterprise Inference APIs: All generative text synthesis, speech-to-text transcription, and neural voice operations are executed exclusively through commercial enterprise API agreements (including Google Cloud, OpenAI, and Anthropic). Under the commercial terms governing our deployments, user data sent via these enterprise endpoints is processed strictly for real-time inference and is not logged, retained, or utilized for provider model training.
- No Data Monetization: MyAiAvatar does not sell, lease, rent, trade, or commercially monetize user data, contact records, or communication telemetry to data brokers, advertisers, or third-party marketing networks.
5. How We Use Processed Information
Information processed by MyAiAvatar is utilized strictly to deliver the specific autonomous avatar capabilities activated by the subscriber:
- Synthesizing your calibrated neural voice for real-time inbound/outbound telephone consultations, voicemails, and audio notes.
- Generating intelligent drafted replies to inbound emails and direct messages tailored to your unique executive tone and instructions.
- Evaluating recipient intent, identifying meeting promises, and autonomously scheduling calendar appointments in accordance with your availability rules.
- Routing telephone calls through carrier networks, evaluating answering machine detection (AMD), and managing voice consultation rooms.
- Maintaining platform security, authenticating session tokens, preventing fraudulent robocall abuse, and enforcing our Terms of Service.
6. Third-Party Infrastructure & Sub-Processors
To deliver real-time voice, telephony, email, and cloud storage capabilities, MyAiAvatar partners with industry-leading cloud infrastructure providers and telecommunications carriers. All sub-processors are vetted for enterprise security compliance, data confidentiality, and regulatory alignment:
- Telecommunications & Carrier Gateways: Dedicated carrier trunking, telephone number leasing, WebRTC audio media streaming, and SMS message routing.
- AI Model & Voice Synthesis Infrastructure: Real-time neural voice inference, phonetic tuning, and large language model orchestration executed over zero-retention enterprise APIs.
- Database & Cloud Hosting Providers (e.g., TiDB Cloud, AWS, Debian VPS): Encrypted multi-tenant distributed storage, automated daily backups, and secure compute hosting.
- Payment & Billing Gateways (e.g., Stripe): PCI-DSS Level 1 certified recurring subscription billing, invoicing, and compute credit checkout processing.
7. Data Retention, Account Deletion & Cryptographic Purge
7.1 Subscriber Data Control: You retain complete operational control over your data. You may review, edit, or delete individual contacts, drafted emails, voice notes, and avatar knowledge bases at any time directly through the studio interface.
7.2 Complete Account Deletion & Cryptographic Purge: When you delete an avatar profile or cancel your account, MyAiAvatar initiates an automated data purge protocol:
- Active database records, encrypted credentials, stored email contents, and audio calibration recordings are permanently deleted from active production databases within thirty (30) calendar days.
- Cryptographic decryption keys associated with your account are revoked and expunged, rendering any residual encrypted database backups permanently and irreversibly indecipherable.
- Carrier-assigned phone numbers are released back to carrier pools in accordance with standard telecommunications regulations.
8. International Data Transfers & Global Compliance
MyAiAvatar is hosted on cloud servers located in the United States. If you access the Services from the European Economic Area (EEA), the United Kingdom, Switzerland, Canada, or other regions with laws governing data collection and processing, please be advised that your information is transferred to, stored, and processed in the United States under robust technical and organizational safeguards conforming to standard contractual clauses and applicable international transfer frameworks.
9. Your Privacy Rights (GDPR / UK GDPR / CCPA / CPRA)
Depending on your geographic location and applicable data privacy legislation, you possess specific legal rights regarding your personal information, which you may exercise at any time:
- Right to Know & Access: The right to request confirmation of whether we process your data and to obtain a copy of the specific personal information collected.
- Right to Rectification: The right to correct inaccurate, incomplete, or outdated personal information maintained within your account.
- Right to Erasure ("Right to Be Forgotten"): The right to request the permanent deletion and cryptographic purge of your personal data, subject only to mandatory legal record-keeping obligations.
- Right to Restrict or Object to Processing: The right to restrict certain forms of data processing or object to automated decision-making.
- Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format.
- Right to Non-Discrimination: We will never deny services, charge different prices, or degrade service quality because you choose to exercise any of your statutory privacy rights.
Subscribers may exercise these rights directly within the application settings portal or by initiating an account deletion request through the administrative dashboard.
10. Children's Privacy
MyAiAvatar is strictly designed for adult business professionals, executives, and organizations. The Platform is not intended for, marketed to, or directed at individuals under eighteen (18) years of age. We do not knowingly collect, calibrate, or process personal data or voice recordings from minors. If we discover that personal data of an individual under 18 has been collected without verified parental consent, we will immediately purge such data and terminate the associated account.
11. Amendments to this Privacy Policy
We may update, refine, or amend this Privacy Policy periodically to reflect technological advancements, infrastructure upgrades, cryptographic enhancements, or changes in applicable privacy regulations. When updates are published, we will revise the "Last Updated" date at the top of this document. Your continued use of MyAiAvatar following the publication of an updated Policy constitutes your acknowledgment and acceptance of the revised data practices.