Legal

Privacy policy

Effective [Effective date] · Last updated [Last updated date]

Draft. This policy is being finalized and is not yet in effect.

This policy explains what information Entropy Logic LLC (“Avento”, “we”, “us”) processes when you use Avento: this website, the Avento dashboard and API, Quick Scans and Full Scans, Avento in ChatGPT and other MCP clients, and uploads from the Avento command-line tool. It also covers our early-access list and messages you send us. The short version: we collect what we need to run the service, we don’t sell it, and we don’t use it for advertising or to train AI models.

Quick Scans without an account

You can ask for a Quick Scan of a website on this website, or through ChatGPT or another MCP client, without signing in. We process:

• The address you ask us to check. We fetch the site’s public pages and JavaScript files, as any visitor’s browser could, and return the findings to you. The scan result itself is not saved.
• A usage record: the website’s host name, the time, and one-way keyed hashes of the network address the request came from and, when ChatGPT provides one, of the anonymized user identifier issued by OpenAI. We use these only to enforce fair-use limits and prevent abuse. We do not store the network address or the identifier itself.
• An activity record that a Quick Scan of that host ran, whether it came from this website, ChatGPT or another MCP client, and how it ended, for security and to run the service.

MCP clients may attach other metadata, such as your locale or an approximate location. Avento does not use or record it, apart from the anonymized identifier described above. Your conversations with your assistant are handled by its provider (for example OpenAI) under that provider’s own privacy policy; Avento receives only what the client sends to Avento’s tools.

Websites and repositories we scan

Websites. A scan fetches publicly available pages, scripts and response headers from the website you name. Full Scans of a domain you have verified in Avento can also make a small number of targeted requests to confirm a finding, such as checking whether a database table can be read without signing in. These pages and responses may contain information about people that the site’s owner has published. We process it only to produce findings, which quote evidence such as URLs, response headers and short excerpts.

Repositories. When you connect GitHub through the Avento GitHub App, we store the installation, the GitHub account or organization it belongs to, and the repositories you connect to projects. For each Full Scan we obtain a short-lived, read-only access token for that one repository, copy the repository to temporary storage, scan it, and delete the copy when the scan ends. The token is never stored. Findings keep file paths, line numbers and short excerpts of code.

Secrets. When a scan finds a secret, such as an API key, we never store or log its value: findings record where it is and a redacted fingerprint only.

Avento accounts

When you create and use an Avento account, we process:

• Account details: your name, your email address, which we ask you to confirm, and your password, which we store only in hashed form.
• Sign-in sessions: the IP address and browser user agent of each signed-in session, to keep accounts secure.
• Workspaces: workspace names, members and roles, and the email addresses of people you invite.
• Projects and scans: your projects’ names, deployment addresses and repositories, domain verification records, the results of your scans (findings and their evidence), and how many scans you use each month.
• Connected apps and tokens: when you link Avento to ChatGPT or another app, the app and the permissions you granted; and the API tokens you create. We store tokens only in hashed form.
• Workspace activity: a log of actions such as creating a project, starting a scan or creating a token, which workspace administrators can see.
• Command-line uploads: the Avento command-line tool runs on your computer and sends us nothing by default. If you run it with --upload, it sends that scan’s report to your workspace: the findings with their redacted evidence and file locations, the checks that ran and their timings, the address scanned and the repository’s folder name.
• Emails we send you: email confirmation, password reset and workspace invitations, delivered by our email provider, Resend.
• Payments: when you subscribe to a paid plan, Stripe handles the payment on its own checkout and billing pages, and we never receive full card numbers. We keep your Stripe customer and subscription references, your plan, its status, and its renewal and cancellation dates. Stripe also processes your payment information under its own privacy policy.

We use this information to provide your account and your plan’s features, send the emails described above, bill you, keep the service and accounts secure, and meet our legal and tax obligations.

Visiting this website

This website does not use analytics, advertising pixels or third-party scripts, serves its fonts itself, and its public pages set no cookies. The Avento dashboard uses essential cookies that keep you signed in and complete account linking; they are not used for tracking. The dashboard also keeps your theme and the workspace you last opened in your browser’s local storage. Our servers log the kind of each request, the route and the response status, and error descriptions with secrets removed. Our hosting provider may keep standard request logs, which can include IP addresses, for security and operations.

The early-access list

If you join the early-access list, your email address is sent directly to Kit, our email list provider, and stored there. We use it only to tell you about Avento’s availability. Every email includes an unsubscribe link, and you can ask us to delete your address at any time.

Contacting us

If you email us, we keep the correspondence for as long as we need it to help you and to keep a record of the request.

How we share information

We do not sell personal information or share it for cross-context behavioral advertising. We share it only with service providers that help us run Avento, under their terms and only for that purpose:

• Railway hosts this website and the Avento service, its database and the workers that run scans (United States).
• Resend delivers account emails.
• Stripe processes subscription payments.
• GitHub provides access to the repositories you connect, under your GitHub App installation.
• Kit stores early-access email addresses and sends those emails.
• Our email provider receives messages sent to support@avento.run.

We may also disclose information when the law requires it, to protect the rights, safety or security of Avento, its users or others, or as part of a merger or acquisition, subject to this policy.

How long we keep it

• Quick Scan usage and activity records: [retention period].
• Account data, projects and scan history: for as long as your account is open. Archiving a project hides it but keeps its history.
• Deleting your account immediately deletes your account and every workspace you are the only member of, with its projects, scans, findings, connections, tokens and usage records. Workspaces you share with others stay available to their other members. Copies in backups expire within [backup retention period].
• Logs: a limited period set by our hosting provider.
• Payment records: Stripe keeps payment and invoice records, and we keep the billing records that tax and accounting law requires, for as long as it requires.
• Early-access addresses: until you unsubscribe or ask us to delete them, or the list ends.
• Support email: as long as needed to handle your request.

Your choices and rights

You can delete your account at any time on the Account page of the dashboard, revoke API tokens there, and disconnect the GitHub App from GitHub. You can ask us to access, correct or delete personal information we hold about you, to revoke an app’s access to your account, or to stop emailing you. Depending on where you live, including several U.S. states, you may have further rights under local law, and you will not be treated differently for using them. Email support@avento.run; we will respond within 45 days, or within one month if you are in the European Economic Area or the United Kingdom (see below). Because we do not track visitors across sites, there is nothing for a browser’s Do Not Track or Global Privacy Control signal to switch off.

Children

Avento is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email us and we will delete it.

Security and location

We protect information with reasonable safeguards, including encrypted connections, access controls, database rules that keep each workspace’s data separate, hashed passwords and tokens, and keeping as little as possible. No method of transmission or storage is completely secure. Avento is operated from the United States, and information is processed there.

If you are in the European Economic Area or the United Kingdom

This section applies when the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing of your personal data.

Controller. Entropy Logic LLC, Columbia, Missouri, United States, is the controller of the personal data described in this policy. Contact us at support@avento.run.

Why we may process your data (legal bases).

• Your account, workspaces, projects, scans and connected services: performance of our contract with you, to provide the account and features you ask for.
• Payments and billing records: performance of our contract with you, and our legal obligations, such as keeping tax and accounting records.
• Sign-in sessions, usage and activity records, and logs: our legitimate interests in keeping Avento and its accounts available, secure and fair for everyone, and in preventing abuse.
• Information that appears on websites and in repositories we scan: our legitimate interests, and those of the person who asked for the scan, in checking an application they are responsible for. We use it only to produce findings for that person.
• The early-access list: your consent. You can withdraw it at any time with the unsubscribe link in any email or by emailing us; this does not affect processing that happened before.
• Emails you send us: our legitimate interests in answering you.
• Legal requirements: where we must keep or disclose information to comply with the law.

Your rights. You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing (including processing based on our legitimate interests), and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Email support@avento.run to use these rights; we will respond within one month, which the law lets us extend in some cases. Quick Scan records hold only keyed hashes, so we may not be able to link a particular scan to you.

Complaints. You can lodge a complaint with your local data protection authority (in the United Kingdom, the Information Commissioner’s Office). We would appreciate the chance to address your concern first.

International transfers. Avento is operated from the United States, and our service providers (Railway, Resend, Stripe, GitHub and Kit) process data there. When we transfer personal data from the EEA or the UK, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (with the UK addendum) or a provider’s certification under the EU-U.S. Data Privacy Framework and its UK extension. Email us for more information about these safeguards.

Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Avento’s findings describe applications, not people.

Age. If you are under 16 (or under the lower age your country sets for agreeing to online services), please join the early-access list only with your parent’s or guardian’s agreement. Avento accounts are for people aged 16 and over.

Cookies. Our public pages set no cookies. The dashboard uses only essential cookies that keep you signed in, which are strictly necessary for the account you ask for and so need no consent. We use no tracking or advertising cookies.

Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant, we will give notice on the website, and email account holders, before it takes effect.

Contact

Entropy Logic LLC, Columbia, Missouri, United States. Email support@avento.run. See also our terms of service and support.