The short version
- We collect what the product needs to work: your account, your brand profile, the content you create, and data from the accounts you choose to connect.
- We do not sell your data, and we do not use your business content or your customers' data to train AI models.
- Platform data (Meta, Google and others) is used only to provide the features you asked for — publishing, replying, reporting and, where you enable it, advertising.
- You can export everything or delete everything from Settings → Privacy & Data inside the app. See Deleting your data.
01Who we are
Ava Social Canvas (“AvA”, “we”, “us”) is an AI marketing platform operated by PathOr Platforms, based in India. This policy covers the Ava Social Canvas web application at social.ava.pathor.ai, this marketing site, and the APIs behind them.
For the purposes of India's Digital Personal Data Protection Act 2023 (DPDP) we act as a Data Fiduciary for your account data, and as a Data Processor for the customer data you bring into the platform. Under the UK/EU GDPR the equivalent roles are controller and processor.
Contact for anything in this policy: support@pathor.ai.
02What we collect
Account and identity
Your name, email address, and — if you sign in through the AvA Enterprise console — the account identifier that single sign-on provides. If you contact support, we keep that correspondence.
Brand and business information
What you tell AvA about your business: brand name, description, tone of voice, target audience, content pillars, languages, colours, logo, website, and anything you add to a brand knowledge base (notes, uploaded text, imported page content). This is the material AvA uses to write in your voice.
Content you create
Drafts, captions, hashtags, generated images and carousels, campaigns, schedules and published posts, along with the media files you upload.
Connected account data
Access tokens for the platforms you connect, plus the data those platforms return: published post performance, comments, mentions and direct messages, audience and reach statistics, and — where you connect an advertising account — campaign structure, spend, and performance metrics. Detailed in Connected platform data.
Conversation data
If you use AvA's chat or voice interface, we process your messages and, for voice, the audio needed to transcribe what you said. If you enable messaging features that let AvA reply to your customers, we process those conversations so AvA can respond and so you can review what was said.
Technical and usage data
IP address, browser and device type, pages used, feature usage counts, and error diagnostics. We use error monitoring to find and fix crashes. Session replay is deliberately switched off, because unpublished campaigns and customer messages appear on screen.
03Connected platform data
You choose which accounts to connect, and you can disconnect any of them at any time. We request the narrowest set of permissions that makes the features work.
Meta (Facebook, Instagram, Threads, WhatsApp)
When you connect a Meta account we access the pages, profiles, ad accounts and message threads you grant us, in order to publish content, read engagement, manage advertising you have asked us to manage, and reply to messages where you have enabled that. We use this data solely to provide those features to you. Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies. We do not sell Meta platform data, and we do not use it for advertising unrelated to your own account.
Google (Google Ads, Google Business Profile, YouTube)
When you connect a Google account we access the advertising or profile data you grant us, to report performance and to create or manage campaigns you have approved.
Ava Social Canvas's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Other platforms
LinkedIn, X, TikTok, Pinterest and any other network you connect: the same principle applies. We access only what the connected feature needs, use it only to deliver that feature to you, and stop accessing it when you disconnect.
What we never do with platform data
- We do not sell it, rent it, or share it with data brokers.
- We do not use it to train AI models.
- We do not combine one customer's platform data with another's. Every brand's data is scoped to the account that owns it.
- We do not use it for any purpose you did not enable when you connected the account.
04How we use it
| Purpose | What that means in practice |
|---|---|
| Providing the service | Generating content in your brand voice, scheduling and publishing, reading engagement, drafting replies, reporting results, and running advertising you have approved. |
| Account and billing | Authenticating you, applying plan limits, taking payment, and sending service messages about your account. |
| Support | Investigating problems you report and, where necessary, reproducing them. |
| Reliability and security | Error monitoring, abuse prevention, rate limiting, and audit logs of actions taken on your account. |
| Improving the product | Aggregated, de-identified usage statistics — which features are used, where flows fail. Never your business content or customer data. |
| Legal obligations | Tax and accounting records, and responding to lawful requests. |
Where GDPR applies, our legal bases are: contract (to provide the service you signed up for), legitimate interests (security, abuse prevention, product improvement), consent (optional marketing communications and any non-essential cookies), and legal obligation (financial records). Under DPDP, processing rests on the consent you give when you create an account and connect each platform.
05AI processing
AvA uses large language models and image generation models to produce content. To do that, we send the relevant context — your brand profile, knowledge base extracts, the prompt you gave, and where applicable recent performance data — to AI model providers acting as our processors.
We do not permit these providers to train their models on your data, and our agreements with them are configured accordingly. Content is processed to fulfil your request and is not retained by us beyond what you store in the app.
AI output is a draft, not a fact. It can be wrong, and it can misrepresent your product. You are responsible for reviewing content before it is published or sent — see our Terms of Service.
07Payments
Subscriptions are processed by Razorpay. Card and banking details are entered directly with Razorpay and are never stored on our servers. We receive only the subscription status, the amount, and a payment reference, which we keep for accounting and tax purposes.
Advertising spend is separate and is never handled by us. You keep your own payment method on your own ad account with Meta or Google, and they bill you directly. See the Terms of Service.
08How long we keep it
| Data | Retention |
|---|---|
| Account & brand data | While your account is active, then deleted within 30 days of account deletion. |
| Content & media | Until you delete it, or your account is deleted. |
| Engagement events | Automatically purged after 180 days by a scheduled retention job. |
| Platform access tokens | Revoked and removed immediately when you disconnect an account. |
| Error diagnostics | Up to 90 days. |
| Billing records | Retained as long as Indian tax and accounting law requires, even after account deletion. |
09Your rights
Depending on where you live, you have the right to:
- Access and portability — get a copy of your data in a machine-readable format.
- Correction — fix anything inaccurate or incomplete.
- Erasure — have your data deleted.
- Withdraw consent — disconnect a platform, or close your account, at any time.
- Object or restrict — where GDPR applies, object to processing based on legitimate interests.
- Nominate — under DPDP, nominate someone to exercise your rights if you are unable to.
- Complain — to us first, and then to the Data Protection Board of India or your local supervisory authority.
Most of these are self-service in the app. For anything else, email support@pathor.ai and we will respond within 30 days.
10Deleting your data
How to delete your data
In the app (fastest): sign in and go to Settings → Privacy & Data. From there you can:
- Export everything — download a JSON copy of your account, brands, content and history.
- Delete everything — type-to-confirm deletion that purges your data across every store we hold it in, and returns a count of what was removed.
By email: write to support@pathor.ai from your account address with the subject “Delete my data”. We will verify you own the account and complete the deletion within 30 days.
To remove platform access only: disconnect the account in Channels, or revoke access from the platform's own settings — Facebook Settings → Business Integrations, or Google Account → Third-party apps. Tokens are removed on our side as soon as the disconnection reaches us.
Deletion is permanent and cannot be undone. Two things survive it, and both are required: billing records that tax law obliges us to keep, and backups, which are encrypted, inaccessible for normal use, and cycled out within 35 days.
Content you already published to a social platform is not ours to remove — delete it on that platform.
11Security
- All traffic is encrypted in transit with TLS.
- Platform OAuth credentials are stored encrypted, and are never exposed to the browser.
- Your session token is held in an
httpOnlycookie, so client-side scripts cannot read it. - Every action AvA takes on your behalf is written to an audit log with before-and-after state.
- Incoming platform webhooks are signature-verified before we act on them.
- Access to production data is restricted and logged.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant authority as the law requires. To report a vulnerability, email support@pathor.ai — we will not pursue good-faith security research.
12International transfers
We are based in India, and some of our service providers process data in the United States, the European Union and elsewhere. Where personal data leaves its home jurisdiction we rely on appropriate safeguards — Standard Contractual Clauses or an equivalent mechanism — and on the contractual protections described in Who we share with.
14Children
Ava Social Canvas is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.
15Changes to this policy
We will update this page when the product changes, and the “last updated” date at the top will always reflect the current version. If a change materially affects how we handle your data, we will tell you by email or in the app before it takes effect, so you have a chance to object or close your account.
16Contact us
PathOr Platforms
Ava Social Canvas
India
General and privacy enquiries: support@pathor.ai
Grievance Officer (DPDP, India). If you are unhappy with how we have handled your data or a request, write to the Grievance Officer at support@pathor.ai with “Grievance” in the subject line. We will acknowledge within 72 hours and resolve within 30 days. If you remain dissatisfied, you may complain to the Data Protection Board of India.