Privacy Policy — Avlira Back Office

Effective: November 4, 2026

Avlira ("Avlira," "we," "us," "our") operates Avlira Back Office, available at https://avlira.ai, including the application hosts app.avlira.ai and each brokerage's own address at <brokerage>.avlira.ai. This policy explains what we collect, why, who sees it, and what you can ask us to do about it. If anything here is unclear, email hello@avlira.ai.

We are based in the United States and this policy is written for our US customers, including under Florida law.

Who this policy covers

There are two groups of people in Avlira:

• Brokerages — our customers. A brokerage signs up for Avlira, is the account owner, and decides who on its team gets access.
• Agents at those brokerages. An agent's records belong to the brokerage, which controls them. We process agent data on the brokerage's behalf, as a service provider, following the brokerage's instructions. If you are an agent, the brokerage is the party that decides what happens to your data; these practices describe how we handle it for them.

What we collect

Brokerage and owner details: the brokerage name, and the owner's name and email address.

Agent details typed in during onboarding: name, email, mobile number, license number, and mailing address.

Business records: commission plans, deals and the amounts on them, and dues invoices.

Uploaded files: W-9s and E&O and insurance documents. These are stored on our servers with access restricted to your brokerage's admins: only brokerage admins can open them.

Sign-in and audit records: IP address, browser user-agent, and the times you sign in, plus audit logs of actions taken in the account — including actions taken by connected AI assistants (see below).

What we never store

We never store Social Security numbers or TINs as data. The forms reject them, so they are not captured and are not kept.

AI assistants

Assistants you connect yourself (ChatGPT, Claude)

An agent or owner can connect their own ChatGPT or Claude account to Avlira. When they do, that assistant receives only the records the connection is allowed to read:

• Agents: their own records only.
• Owners and admins: their brokerage's records.

Once the assistant receives those records, the assistant provider's own privacy policy applies to what it receives — not ours. Actions an assistant takes in Avlira are recorded in the account's audit log.

Our built-in assistant (Pro)

Our own assistant sends the question you ask, plus the records needed to answer it, to a model provider, routed via OpenRouter, with provider data retention disabled where available. Those records are sent only to answer that question.

In short: what an AI assistant receives

Five plain answers about AI assistants and your data: Here is how this policy answers each:

1. Which third party receives data. Only the assistant provider you choose to connect, or the model provider behind our built-in Pro assistant.
2. Exactly what it receives. Only the records the connection is permitted to read — your own records as an agent, your brokerage's records as an owner or admin — or, for Pro, the question plus the records needed to answer it.
3. Whose policy applies afterwards. The assistant provider's own privacy policy governs what it receives once it has it.
4. How long records are kept. The retention periods below; for Pro, provider retention is disabled where available.
5. How to reach the operator. hello@avlira.ai.

Third parties we use

We use the following service providers to run Avlira:

• Hosting in the United States: Hetzner, Ashburn, Virginia.
• Email delivery: Amazon SES.
• Text messages for sign-in codes: Twilio.
• Optional payment processor: only when the brokerage turns payments on.
• Optional e-file service for 1099s: chosen by the brokerage.

What we do not do

• We do not sell personal information.
• We do not use it for advertising.
• There are no third-party advertising trackers or analytics cookies on the apps.
• The marketing site uses no tracking cookies.

Cookies

The app hosts (app.avlira.ai and <brokerage>.avlira.ai) use strictly necessary session cookies only — the ones that keep you signed in.

How long we keep data

• While the account is active: we keep the data needed to run it.
• After closure: data is deleted within 30 days, and backups roll off within 30 more days.
• Logs: kept up to 1 year for security.

Security

TLS everywhere, per-brokerage isolated databases, one-time sign-in codes, and no passwords stored.

Your rights

You can ask for access, correction, export, or deletion of personal information by emailing hello@avlira.ai.

If you are an agent, ask your brokerage first — it controls your records — and we will help the brokerage carry out the request.

We respond within 30 days.

Children

Avlira is a business tool and is not for anyone under 18.

Changes to this policy

If we change this policy, we will give notice by email or in-app.

Contact

hello@avlira.ai