Privacy Policy

Last updated: 29 October 2026

This policy explains how we process personal data on the website avokado.chat and in Avokado — an AI assistant that replies to messages on behalf of businesses (“our customers”) on Instagram, Facebook Messenger, WhatsApp, Telegram and in chat windows on their websites.

1. Who is responsible

For this website and for our own business contacts, the controller is:

Aleksandr Kadesnikov, sole trader, operating Avokado
Olgy Havlové 2931/37, 130 00 Praha 3 – Žižkov, Czech Republic
Company ID (IČO): 23037717
Email: hello@avokado.chat · Phone: +420 777 227 817

For messages that people send to our customers, see section 3: there, the business you message is responsible, and we process the data on its behalf.

2. Visiting this website

Hosting and server logs

This website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you open a page, Cloudflare processes your IP address, the date and time of the request, the page requested, your browser’s user agent and the referring page. This is needed to deliver the site and protect it against attacks. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a secure and working website. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

No cookies, no tracking

We don’t set cookies, use analytics or embed tracking pixels or third-party fonts. All fonts and files are served from our own domain.

Chat on this website

The chat window on avokado.chat is our own AI assistant. When you write in it, we process your messages and anything you tell us — for example your name, email and details about your business — to answer you and, if you wish, to arrange a demo call. Legal basis: Art. 6(1)(b) GDPR (steps before a contract that you ask for) and Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries). Section 3 describes how the assistant works; for this chat, we are the controller.

So that the conversation continues if you reload the page, your browser stores a random chat token in its local storage. It is created only when you start chatting, is used for nothing else and expires after 30 days. Before your first message, Cloudflare Turnstile checks that you are a human and not a bot; for this, Cloudflare processes your IP address and technical data about your browser. To limit abuse, we keep a pseudonymised (hashed) form of your IP address in our rate limits for at most one hour.

Contacting us by email

If you email us, we process your email address, your message and any details you include, to answer you. Legal basis: Art. 6(1)(b) GDPR when your request relates to a contract or to steps before one, otherwise Art. 6(1)(f) GDPR. Incoming mail is forwarded by Cloudflare Email Routing to our email provider. We delete correspondence once it’s no longer needed, unless we must keep it for legal reasons (for example, tax and commercial record-keeping).

3. Messages handled by the Avokado assistant

Our role

When you send a message to a business that uses Avokado, that business decides why and how your data is processed: it is the controller. We process the data on its behalf and on its instructions, as a processor under Art. 28 GDPR. For questions about how a particular business uses your data, please contact that business — or write to us and we’ll pass your request on and help it answer.

This section also covers the data we receive through Meta’s platforms (Instagram, Messenger, WhatsApp), directly or through the tools Manychat and Chatwoot, through the Telegram Bot API, and through chat windows on our customers’ websites. Your use of those platforms is also governed by their own privacy policies.

What we process

• Your profile on the messaging platform: the platform’s ID for you, your display name and username (for example, your Instagram handle) and, on WhatsApp, your phone number. In a website chat, only a random chat ID.
• Your messages: texts; voice and video messages, which we convert to text; photos and files you send, or a note that you sent one. Photos may be shown to the AI model so it can understand your request.
• What you tell the assistant: for example your name, phone number, the service you’re interested in and preferred dates.
• Appointment details, if the business offers online booking: service, date and time.
• Technical data: timestamps, channel, delivery status, and a log of the actions the assistant took in your conversation (for example “offered free slots”, “booked”, “handed over to a person”).

Why we process it

• to answer your messages on behalf of the business and in its name;
• to check free slots and book the appointments you ask for;
• to pass your request — with a short summary — to the business’s staff when a person is needed;
• so the business can review conversations and improve the assistant’s instructions;
• to keep the service secure and prevent abuse.

The legal basis is the business’s: usually Art. 6(1)(b) GDPR (steps you ask for before or under a contract, such as booking an appointment) and Art. 6(1)(f) GDPR (the business’s legitimate interest in answering inquiries quickly).

How the AI is involved

Replies are written by a large language model based on the business’s instructions, prices and rules. Every conversation starts with a note that you’re talking to an AI assistant, and by default you can type “stop” at any time to switch it off and reach a person. The assistant does not make decisions about you that have legal or similarly significant effects (Art. 22 GDPR): it answers questions and books what you ask for. AI answers can contain mistakes — the business remains responsible for its offers and prices.

What we don’t do

We don’t sell your data, don’t use it for advertising or marketing profiles, don’t use your messages to train AI models, and don’t message you on our own initiative.

4. How long we keep data

• Message history (texts and transcripts) is deleted automatically after 180 days.
• Contact and lead details, appointment data and the log of the assistant’s actions are kept for as long as the business uses Avokado, and deleted when it ends its contract with us or when you or the business ask us to delete them.
• Data that the business has copied into its own tools — its calendar, CRM or the notifications its staff receive — is controlled by the business.

5. Service providers

We use carefully selected providers who process data on our instructions under data processing agreements. Depending on how a business has set up Avokado, these include:

A business may choose a different AI model provider for its assistant. Where data is transferred outside the EU/EEA, we rely on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework) or on Standard Contractual Clauses.

6. Security

Data is transmitted over encrypted connections. Access to conversations is limited to authorised staff of the business and of Avokado, with separate roles and permissions, and access credentials for connected tools are stored encrypted.

7. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or deleted (Art. 17), to restrict processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, contact the business you messaged, or write to us at hello@avokado.chat.

You also have the right to lodge a complaint with a data protection supervisory authority — in the EU country where you live or work, or with the authority responsible for us: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz.

8. Deleting your data

How to ask us to delete your conversation and contact details is described on our Data deletion page.

9. Children

Avokado is a tool for businesses and is not directed at children. If you believe a child has shared personal data with an assistant run by Avokado, contact us and we’ll delete it.

10. Changes to this policy

We update this policy when our services or legal requirements change. The date at the top shows the latest version.