Privacy Notice

This notice explains how Avanta Technologies LTD (“Avanta”, “we”, “us”) collects, uses and protects your personal information when you use the Avanta app and website. Avanta is the data controller for the information described here.

Information we collect

Almost everything we hold about you is information you enter yourself while building your work wallet:

• Account details — your email address and password. Passwords are stored only as a salted hash; we never see them.
• Personal details — name, date of birth, phone number, home address, National Insurance number, job role, employer, a short professional bio and any profile photos you add.
• Health information — medical notes, allergies and blood type, and next-of-kin / emergency contact details. See the section below.
• Credentials — worker cards, qualifications and certificates, including photographs and documents you upload, along with issue and expiry dates, card numbers and any expiry-reminder preferences you set.
• Work history — the roles, employers and dates you choose to record.
• Company details — if you register your business, its name, company number and address.
• Contact form messages — if you write to us through the website, the name, email address, company and message you submit.
• Technical information — the minimum needed to operate the service, such as your authentication session.
• Product analytics — how the app and this website are used: pages and screens visited, the steps you take through sign-up, which of your buttons and links are used, and basic device and browser information. This is handled for us by PostHog, hosted in the European Union. We do not run advertising trackers, and we never sell or share this information for advertising. See the section below.

Health information

Medical notes, allergies and blood type are special category data under the UK GDPR, which means they get extra protection. Providing them is entirely optional — the app works without them. We process this information only on the basis of your explicit consent, given when you enter it, and only to make it available to you and to anyone you deliberately share it with. You can delete it at any time by editing your profile, and withdrawing consent is as simple as removing the entry.

Emergency contacts are usually someone else’s details. Please make sure the person is happy for you to record their name and phone number before you add them.

Card scanning

When you scan a card, the photos you take are sent to Anthropic, an AI provider, whose service reads the card and returns the details — card type, name, numbers and dates — so you don’t have to type them. The photos are used only to do that reading, on our instructions, and are not used to train AI models. Scanning is optional: you can always enter a card by hand instead.

Product analytics and session recording

We measure how the platform is used so we can see which parts work and which get people stuck. This covers the pages and screens you visit, the steps you take through sign-up and setup, the buttons and links you use, and basic device, browser and approximate location (country or region, from your IP address) information. It is processed on our behalf by PostHog, using their European Union region, and it is never sold, shared for advertising, or used to make automated decisions about you.

We also record how pages behave as you use them, so we can reproduce faults we could not otherwise see. These recordings are masked: text and the contents of form fields are replaced with blocks before anything leaves your device, so we see the shape of a screen and where you clicked, not what it said. Your medical notes, National Insurance number and GP details are additionally excluded from recording entirely. We never record passwords.

We rely on our legitimate interest in understanding and improving a service you have chosen to use. You can switch this off at any time: Business settings → Legal & compliance → Analytics cookies. Turning it off stops analytics and recording and clears the identifiers stored on your device. Analytics data is kept for up to 12 months, and recordings for up to 30 days.

How we use your information

• To create and secure your account.
• To store your wallet and synchronise it between your devices, so it is available offline and is not lost if you lose your phone.
• To produce a CV or credential summary when you ask for one. Sensitive fields such as your NI number, medical notes and next of kin are excluded from exports unless you switch them on explicitly.
• To remind you before a card or qualification expires, if you turn reminders on. Reminders are scheduled on your own device — the notification itself never passes through our servers, and we do not send push notifications.
• To respond to you when you contact us for support.
• To meet our legal obligations.

Our lawful bases are: performance of a contract with you (running your account), your consent (health information, and sharing anything with a third party), and our legitimate interests in keeping the service secure and working.

Who we share it with

We do not sell your personal information, and we do not share your wallet with employers or anyone else unless you choose to share it. We use a small number of processors to run the service, acting only on our instructions:

• Hosting and database infrastructure (Supabase).
• An email delivery provider, for account emails such as password-reset codes and for messages sent through the website contact form.
• Anthropic, for reading card photos when you use the scanner (see above).
• Cloudflare, whose Turnstile check protects the website contact form from bots. It runs only on that form, not in the app.
• PostHog, for the product analytics described above. Their EU region is used, so this data stays in the European Union.

Where your data is stored

Your data is held on managed cloud infrastructure and encrypted in transit and at rest. A copy of your wallet is also stored on your own device so the app works without a signal; signing out removes that on-device copy.

Some of our processors operate outside the UK. Where personal data leaves the UK we rely on recognised safeguards — an adequacy decision or the UK’s approved standard contractual clauses — with the processor concerned.

How long we keep it

We keep your information for as long as your account exists. If you delete your account, we delete your profile, wallet, uploaded documents and login credentials. Backups are cycled out shortly afterwards. Messages sent through the contact form are kept only as long as we need them to deal with your enquiry.

Your rights

Under UK data protection law you have the right to:

• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased.
• Restrict or object to how we process it.
• Receive your data in a portable format.
• Withdraw consent at any time, without affecting past processing.

Most of these you can exercise yourself in the app: your profile is editable, and Settings → Delete account permanently removes your account and everything in it. For anything else, contact us at [email protected].

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.

Children

Avanta is intended for people in work and is not directed at children under 16. We do not knowingly collect their information.

Changes to this notice

If we make a material change we will update the date at the top of this page and, where the change affects you significantly, tell you in the app.

Contact us

Avanta Technologies LTD — [email protected]