myAVA (Activity Value Assistant) is provided by ARK Advisory Group. For the information described here, ARK Advisory Group is the data controller — we decide what is collected and why.
What we collect
- Account details — your email address, sign-in credentials, and your first and last name if you add them.
- Your work records — hours, overnight fees, expenses, notes, receipt images and files, rates, pay periods and the summaries you send.
- Support messages — anything you send us by email or in the app.
- Technical data — IP address, device and browser information, and basic usage and error logs.
Why we use it, and on what basis
- To provide myAVA — creating your account, storing and displaying your records, sending summaries and reports (performance of our contract with you).
- Security and fraud prevention — protecting accounts and detecting abuse (legitimate interests).
- Support — answering your questions (contract and legitimate interests).
- Service emails — sign-in links, password resets, trial reminders and billing notices (contract and legitimate interests).
- Improving the product — understanding which features are used and fixing faults (legitimate interests).
- Marketing emails — only if you opt in, and you can unsubscribe at any time (consent).
- Legal obligations — keeping records we are required to keep (legal obligation).
Who we share it with
- Service providers — hosting, database and file storage, email delivery, and error monitoring, acting on our instructions.
- Paddle.com, our Merchant of Record, for the sale of subscriptions, subscription management, payments, invoicing and tax compliance. Paddle handles your payment details directly; we never see your full card number.
- Professional advisers — legal and accounting, where needed.
- Authorities — where required by law.
We do not sell your personal information.
How long we keep it
We keep your account and work records while your account is open, and for a limited period afterwards so you can return or export your history. When data is no longer needed it is deleted or anonymised. You can ask us to delete your account and its contents at any time.
Receipt images are an exception with a fixed limit: we delete the image file seven years after it was uploaded. The expense record it belongs to — date, merchant, amount, category and notes — stays in your history. You can delete any receipt yourself at any time.
Your rights
Depending on where you live, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format, and you may withdraw consent where we rely on it. Email support@myava.app and we will respond within one month. If you are in the UK or EEA you may also complain to your local supervisory authority.
International transfers
We and our providers may process data in the United States and other countries. Where data leaves the UK or EEA we rely on appropriate safeguards, such as Standard Contractual Clauses or an adequacy decision.
Security
We use appropriate technical and organisational measures, including encryption in transit, access controls and per-account data isolation, so only you can see your records. No system is perfectly secure, but we treat your records as private by default.
Cookies and local storage
myAVA uses essential cookies and browser storage that keep you signed in and remember your preferences. If analytics is enabled (see below), PostHog also stores a random identifier in your browser. We do not use advertising cookies and we do not sell or share personal information for cross-context behavioural advertising.
Product analytics (PostHog)
We use PostHog, a product analytics service provided by PostHog, Inc., to understand how visitors find myAVA and whether our sign-up flow works. Analytics data is hosted in the United States. This is not anonymous: it is pseudonymous personal data.
- What is collected — a random browser identifier; pages you visit on our public website (path only, without query strings); campaign tags in links you followed (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the referring website's domain, and the first page you landed on; clicks on sign-up buttons; and sign-up, account confirmation and welcome-screen events. PostHog also receives standard technical data such as IP address, browser, device type and approximate location derived from IP.
- Linking to your account — when you sign up or sign in, we link that identifier to your internal myAVA account ID (a random code). We do not send your name or email address.
- What is never sent — your hours, rates, amounts, notes, work descriptions, client names, receipts or receipt contents, form inputs, payment details, email address or name. Automatic click capture and session recording are turned off.
- Why — to measure and improve our marketing and sign-up experience (legitimate interests in the US; your consent where the law requires it, such as the UK and EEA).
- Retention — events are stored by PostHog under its standard retention for our plan (typically up to seven years on paid plans and twelve months on the free plan). We may ask PostHog to shorten this; the current setting is managed in our PostHog project.
- IP addresses — PostHog receives your IP address with each event. Whether it is stored or discarded depends on a setting in our PostHog project; please contact us if you want the current status.
Your choices. Visitors whose connection appears to come from the UK, EEA or Switzerland — and any visitor whose region we cannot determine — are asked before analytics starts, and it stays off unless you accept. Everywhere else you can opt out at any time below. We honour Do Not Track and Global Privacy Control browser signals — when either is on, analytics never loads. California residents may also use these controls, or email us, to exercise their right to opt out and their rights to know, correct and delete personal information; we will not discriminate against you for using them.
Contact
ARK Advisory Group — support@myava.app