Privacy Policy

Aven-AI provides a governed AI platform for construction. It reads a project's contract and programme, flags notices and time-bars, and surfaces risks for human review. It is advisory-only: it flags and drafts; people decide. This policy explains what personal data we handle and why.

Account information you give us: name, work email, company, role, and a password (stored only as a salted hash — see Security). If you request early access, we collect the name, work email, company, role and message you submit.

Project data you upload to use the platform: contracts (e.g. FIDIC, NEC4, amended), programmes (Primavera P6 / MS Project), and related project records such as correspondence, method statements and risk assessments. This may contain personal data about your project's people.

Technical data created by normal operation: log and usage data needed to run, secure and debug the service.

Newsletter subscription if you subscribe to our newsletter: your email address, the date and time you confirmed your subscription, the exact consent wording shown to you at the time, and which page you subscribed from. We keep the consent record so we can show what you agreed to and when.

We do not intentionally collect special-category personal data, and the platform is not intended for anyone under 18.

We use this data solely to provide and operate the platform for you — to read your contract and programme, surface flags and risks, prepare draft letters and notices for your review, authenticate you, secure the service, and respond to your requests. If you subscribe to our newsletter, we use your email address only to send that newsletter; we do not use it for any other purpose and we do not share it with anyone outside the sub-processors listed below. We do not sell your data, and we do not use it to serve advertising.

We rely on a small number of vetted third parties to run the service. They process only what is needed to deliver their function:

The database is hosted in the United States (AWS US-West, Oregon). If a client requires it, we can deploy to the EU region (Frankfurt). All traffic is encrypted in transit (HTTPS/TLS), and data is encrypted at rest at the storage layer.

Passwords are stored only as salted hashes (bcrypt). Two-factor authentication is supported. Access is governed by a four-axis model (project, company, role, authority) so people see only what they are permitted to. Consequential actions are recorded in an append-only audit trail. The AI is advisory only — it never sends, signs, files or shares anything on its own — and an administrator can switch AI advisory off for a project at any time.

We keep account and project data for as long as your account or engagement is active, and delete or anonymise it within a reasonable period after it is no longer needed, unless we must retain it to meet a legal obligation. AI-provider retention is described in Section 4. Newsletter subscription records are kept while you remain subscribed. If you unsubscribe, we retain your email address and consent record only so that we can honour the unsubscribe and demonstrate that consent was given and withdrawn, and delete them when they are no longer needed for that purpose.

You can ask us to access, correct, or delete your personal data, or to export it. Email info@aven-ai.com and we will respond within a reasonable time. Depending on where you live, you may have additional rights under laws such as the EU/UK GDPR or the UAE PDPL; we aim to honour these. You can unsubscribe from the newsletter at any time using the link in any newsletter email. It takes effect immediately and needs no account or sign-in.

We keep this minimal: essential items needed to sign you in and run the app, plus a small local-storage value that remembers your light/dark theme preference. We do not use advertising or cross-site tracking cookies.

We may update this policy as the product develops. We will change the “last updated” date above and, for material changes, tell account holders.

Questions or data requests: info@aven-ai.com.