Privacy Policy

Introduction

Avio (“we,” “our,” or “us”) provides equipment booking and management software for educational institutions. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

Information We Collect

Information You Provide

• Account Information: Name, email address, and profile picture (obtained through Google OAuth)
• Booking Information: Equipment reservation details, usage history, and related notes
• Organization Information: University or institution affiliation

Automatically Collected Information

• Usage Data: Pages visited, features used, time spent on platform
• Device Information: Browser type, operating system, IP address
• Cookies: Session management and authentication tokens

How We Use Your Information

We use your information to:

• Provide and maintain the equipment booking service
• Authenticate your identity and manage your account
• Process and manage equipment reservations
• Send administrative notifications about your bookings
• Improve our platform and develop new features
• Ensure security and prevent fraudulent activity
• Comply with legal obligations

Data Sharing and Disclosure

Within Your Organization

Your booking information and profile are visible to authorized administrators and staff within your institution.

Third-Party Service Providers

We use the following third-party services:

• Google OAuth: For authentication (subject to Google’s Privacy Policy)
• Supabase: For database hosting and authentication infrastructure
• Vercel: For application hosting

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

Legal Requirements

We may disclose your information if required by law, court order, or to protect our rights and safety.

Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encrypted data transmission (HTTPS/SSL)
• Secure authentication via Google OAuth 2.0
• Row-level security policies in our database
• Regular security audits and updates

However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Data Retention

We retain your information for as long as your account is active or as needed to provide services. You may request deletion of your account at any time by contacting your organization’s administrator.

Booking history may be retained for administrative and audit purposes in accordance with your institution’s policies.

Your Rights

Depending on your location, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Object to processing of your information
• Export your data in a portable format

To exercise these rights, contact your organization’s administrator or email us at admin@avio.work.

Children’s Privacy

Our service is intended for use by university students, staff, and faculty. We do not knowingly collect information from individuals under 13 years of age. If you believe we have collected information from a child under 13, please contact us immediately.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last Updated” date.

Contact Us

If you have questions about this Privacy Policy, please contact us at:

Google OAuth Specific Disclosures

Avio’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We only request the following Google account information:

• Basic profile information (name, email address)
• Profile picture

This information is used solely for authentication and account management within Avio. We do not use this information for any other purpose, and we do not share it with third parties except as described in this policy.