Privacy policy

Platform. AvenirGo — https://avenirgo.com

Version. 1.0

Last updated. 23 August 2026

1. Who is responsible for your data?

Data controller. Mutara SAS.

Data protection officer (DPO). contact@avenirgo.com.

Mediums' responsibility. Each medium is a separate data controller for information they manage in their own business, including private client notes, follow-up records, campaigns and messages they send. AvenirGo provides and secures the tool but determines neither the content nor the purposes of these notes. For requests specifically concerning this information, contact the medium concerned; we can help you reach them.

2. What data is collected?

2.1 Data you provide.

Identity. First name, surname and date of birth, particularly to verify legal age.

Contact details. Email address, telephone number, postal address, postcode and city.

Account. Identifiers, language preferences, notification preferences and marketing consent.

Content. Written questions, messages, reviews, profile photos, articles, stories and attachments, limited to 10 files of 10 MB each in JPG, PNG, WebP, GIF or PDF format.

Orders. Products purchased, delivery address for physical products and files delivered for digital products.

Support. Requests, complaints and documents submitted in a dispute.

2.2 Data specific to mediums. Legal structure, SIREN or SIRET number, VAT regime and rate, consultation languages, prices, schedule, identity and professional documents needed for KYC checks, payout details, billing data and activity statistics.

2.3 Data generated by use of the service.

Consultations. Date, duration, rate applied, amount charged, medium consulted and consultation status.

Technical call quality. Packet loss, jitter, reconnections, interruption duration and any associated goodwill credit. These metrics are cross-checked server-side.

Wallet and payments. Top-ups, debits, promotional credits, bonus codes used, refunds and payouts.

Interactions. Story views, review likes, availability alerts, favourites and aggregated medium performance data.

Notifications. Web push subscriptions, including the endpoint, encryption keys and user agent, along with sending history.

Technical data. IP address, browser and device type, connection logs and security logs.

2.4 What we do not collect.

Audio consultations. AvenirGo does not make or retain any audio recordings of consultations. Audio streams in real time and is not stored.

Banking data. AvenirGo never has access to your full card number. This information is processed directly by Stripe.

Session. No session data is written to browser local storage. The session relies on a server cookie Secure, httpOnly and SameSite.

2.5 Sensitive data. A consultation may lead someone to spontaneously mention their health, emotional or sexual life, or religious or philosophical beliefs. We never request this information and mediums are asked not to record it in their notes.

If such information nevertheless appears in content you write, you authorise its processing through your voluntary publication. You can request its deletion at any time.

3. Why is your data processed and on what legal basis?

Account creation and management, consultations and orders. Performance of the contract — Article 6(1)(b) of the GDPR.

Billing, prepaid wallet and payouts to mediums. Performance of the contract — Article 6(1)(b) of the GDPR — and legal obligation — Article 6(1)(c) of the GDPR.

Verification of mediums' legal age and identity (KYC). Legal obligation and legitimate interest — Articles 6(1)(c) and 6(1)(f) of the GDPR.

Retention of invoices and accounting records. Legal obligation — Article 6(1)(c) of the GDPR, Article L. 123-22 of the French Commercial Code and Article L. 102 B of the French Tax Procedures Code.

Support, dispute management and refunds. Performance of the contract and legitimate interest.

Security, fraud prevention, moderation and quality metric checks. Legitimate interest — Article 6(1)(f) of the GDPR.

Appointment, reply and availability notifications. Consent — Article 6.1.a GDPR. These notifications, by email and SMS, are turned on by default when you create your account. You can turn them off at any time, channel by channel, in My account > Preferences. SMS is only sent to the phone number on your account. Emails about account security, payments and payouts are still sent.

Marketing communications from AvenirGo or a medium. Consent or legitimate interest within an existing client relationship, with the right to object at any time.

AI-assisted reports. Consent, with activation by the medium and notice to the client.

Optional audience measurement. Consent — Article 82 of the French Data Protection Act.

Statistics and service improvement. Legitimate interest when the data used is aggregated.

4. AI-assisted reports. When a medium enables this option, a written consultation summary is generated automatically and made available to the client and medium.

Activation. The option is disabled by default and is the medium's choice. You are notified when it is enabled.

Processing. Processing covers the consultation details needed to produce the summary. No audio recording is retained beyond processing.

Nature of the summary. The summary is a memory aid, not a decision. It has no legal effect and is not an automated decision within the meaning of Article 22 of the GDPR.

Deletion. You may request deletion of a report concerning you at contact@avenirgo.com.

5. Who receives your data?

The medium consulted. The medium receives the information needed for the consultation, including your first name, the details you share, your exchange history with them and, when necessary, the delivery address for a physical product.

Mediums' private notes. Notes written by a medium are accessible only to that medium. They are never shared with other professionals on the platform.

Internal teams. Authorised internal teams, including support, finance, moderation and security, can access data needed for their duties under the principle of least privilege, with administration actions logged.

Processors and partners.

Cloudflare, Inc. Hosting, database, media storage and network protection. Location: European Union / United States.

Stripe Payments Europe, Ltd. Payments, subscriptions and payouts through Stripe Connect. Location: European Union / United States.

LiveKit. Real-time audio transport. Location: to be confirmed.

SMS provider. SMS notifications. Provider and location: to be confirmed.

Email provider. Transactional emails. Provider and location: to be confirmed.

AI provider. Report generation when the option is enabled. Provider and location: to be confirmed.

Each processor is bound by a contract compliant with Article 28 of the GDPR, prohibiting use of data for its own purposes.

Other recipients. Data may also be disclosed to administrative or judicial authorities upon requisition, to advisers and auditors subject to professional confidentiality, and to a prospective acquirer in a transaction involving the company, with prior notice where required.

Sale of data. Your data is never sold.

6. Transfers outside the European Union. Some providers may process data outside the European Economic Area.

Adequacy decision. Transfers may be covered by a European Commission adequacy decision, including the EU–US framework for certified entities.

Standard contractual clauses. Otherwise, transfers may be covered by the European Commission's standard contractual clauses, supplemented where appropriate by additional technical measures such as encryption in transit and at rest and data minimisation.

A copy of the applicable safeguards can be obtained from contact@avenirgo.com.

7. How long is your data retained?

Active account. Throughout the relationship.

Inactive account. 3 years after the last contact, then deletion or anonymisation.

Consultation history. Metadata is retained for 3 years, then anonymised.

Written questions and messages. 3 years after the last exchange.

Mediums' private notes. Under the medium's responsibility; deleted when their account is closed.

AI reports. 12 months, unless deletion is requested earlier.

Invoices and accounting records. 10 years, in accordance with applicable legal obligations.

Historical billing and VAT data. 10 years.

Medium KYC documents. 5 years after the relationship ends.

Call quality reports. 12 months.

Stories and associated media. Displayed for 24 hours, then the media is deleted according to the agreed technical retention period.

Published reviews. For as long as the profile is published, then 3 years.

Notification subscriptions. Until the browser subscription is revoked or expires.

Connection and security logs. 12 months.

Consent records. 3 years for cookies and marketing communications, in accordance with the CNIL recommendation cited in this policy.

Dispute and moderation records. 5 years after closure.

Financial histories and original moderation records are never silently deleted. A correction creates a linked entry rather than erasing the source data.

8. Your rights. Under the conditions set by applicable regulations, you have rights of access, rectification, erasure, restriction, objection and data portability. You may also withdraw your consent at any time and set instructions for your data after your death.

How to exercise your rights. Write to contact@avenirgo.com. You will receive a reply within one month, which may be extended by two months for complex requests. Proof of identity may be requested if there is reasonable doubt about your identity.

Limits to the right to erasure. Some data cannot be deleted immediately where a legal obligation requires retention, including invoices and accounting data, or where needed to establish, exercise or defend legal claims. It is then archived with restricted access.

Complaint to the CNIL. You may contact the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

9. Cookies and trackers.

Strictly necessary cookies. These enable, among other things, session management through a cookie Secure, httpOnly and SameSite, security, fraud protection and remembering your cookie choice. Their use does not require consent.

Preference cookies. These remember your language and certain display preferences. Consent is not required when strictly limited to ease of use.

Audience measurement. Audience measurement trackers used for traffic statistics require your consent and are disabled by default.

Consent management. The consent banner makes accepting and rejecting trackers equally simple. Optional audience measurement remains disabled until you agree. Your choice is retained for 6 months and can be changed at any time in the footer.

10. Security. AvenirGo implements technical and organisational measures to protect personal data.

Encryption and communication security. Communications are protected by HTTPS and application security headers are implemented.

Session management. The session relies on a server cookie Secure, httpOnly and SameSite, along with CSRF protection for write operations.

Authentication and permissions. Authentication and permission checks are applied to every server route, including administration functions.

Private files. Private files are accessible through short-lived signed URLs. Uploaded files are scanned and their actual type is checked.

Audio stream. Audio tokens are issued server-side with a validity period and permissions limited to what is strictly necessary.

Financial operations. Financial operations are designed to be idempotent and payment events sent by webhook are validated.

Administration. Administration actions are logged without including sensitive data.

Continuity and incidents. Backups, restore tests and an incident management procedure are implemented.

Data breach. If a data breach is likely to pose a high risk to your rights, you will be informed as soon as possible. The CNIL is notified within 72 hours when regulatory notification conditions are met.

11. Minors. The service is prohibited for persons under 18. No data is intentionally collected from minors.

When an account belonging to a minor is identified, it is closed, the data is deleted and the balance is returned. Reports may be sent to contact@avenirgo.com.

12. Changes to this policy. Any substantial change to this policy is communicated by email and/or in the application at least 30 days before taking effect. The last updated date appears at the top of the document.