Skip to content
Talk to usGet started

Catalog · Legal

Privacy Policy

All legal documents

Last updated October 14, 2026 Download PDF

1. About This Policy

This Privacy Policy explains what personal data AlgoCreed Co L.L.C-FZ (“AlgoCreed”, “we”, “us” or “our”), a company established in Meydan Free Zone, Dubai, United Arab Emirates, processes in connection with Avyna Catalog (the “Service”), why, where it is hosted, how long it is kept, who else sees it, and the rights available to the person it concerns. “Organization” means the customer entity that subscribes to the Service; “you” means the person reading this Policy, whether that is the Organization's administrator or another individual whose personal data the Service processes.

AlgoCreed is established outside the European Economic Area. Because the Service is offered to organizations and individuals in the European Union, the General Data Protection Regulation (EU) 2016/679 (“GDPR”) applies to this processing under its Article 3(2)(a), whether AlgoCreed is acting as controller or as processor for the data concerned.

This Policy is provided for your information. Reading and acknowledging it does not itself create a contract between you and AlgoCreed. The contracts that govern the Service are the Terms of Service, accepted by the Organization, and, for the tenant data described in Section 2, the Data Processing Agreement between AlgoCreed and the Organization.

2. What We Read From Your Microsoft Tenant, and Why

To provide the Service, AlgoCreed asks the Organization's administrator to grant it access to the Organization's own Microsoft tenant, through Microsoft Graph. Each permission requested is limited to what that part of the Service needs:

  • Sign in and read your profile — to open your own session when you sign in.
  • Read all users' full profiles — so approvers, owners and recipients can be selected inside the Service.
  • Read and write all group memberships — to add an approved user to the Intune groups that grant them access to an application.
  • Read all devices — to show which machines an application is deployed to.
  • Read Microsoft Intune applications — the source of what the Service publishes to users.
  • Read Microsoft Intune devices — to report install state per device.

From these reads, we hold, for each user in the Organization's tenant: name, email address, phone numbers, job title and office location; the employee ID, user principal name, and the Microsoft Entra ID and Intune identifiers used to keep our records in sync with your tenant. For anyone who signs in to the Service, we also record the IP address and browser identifier of that sign-in; the value is replaced on each new sign-in and cleared automatically once 180 days pass without one.

For this data, AlgoCreed acts as a processor, on the Organization's instructions.

3. Other Personal Data We Hold

Separately from the tenant data above, AlgoCreed holds the name, email address and role of the administrator who completes onboarding on the Organization's behalf, and of any billing contact the Organization designates, together with the billing and invoicing details Stripe processes on our behalf. For this data, AlgoCreed acts as a controller in its own right.

4. Lawful Basis

The Organization's tenant data is processed under our contract with the Organization, per Article 28 of the GDPR, strictly on the Organization's instructions; it is the Organization's responsibility, as controller of that data, to have a lawful basis for disclosing it to us. Our own controller-side data — the onboarding administrator's and billing contacts' details — is processed under Article 6(1)(b) of the GDPR, to perform the contract we have with the Organization, and, where relevant, under Article 6(1)(f), our legitimate interest in keeping the Service secure and correctly billed.

5. Where Your Data Is Hosted

Personal data processed through the Service is hosted by Microsoft Azure in its Sweden Central region (swedencentral), within the European Union.

6. How Long We Keep It

We keep personal data processed through the Service for as long as the Organization's subscription is active. Once it ends, and for the data described throughout this Policy, we apply the following retention periods:

  • Tenant data described in Section 2: deleted within 90 days of the Organization's subscription being cancelled; the Organization's billing contact is reminded 14 days before that deletion.
  • The sign-in IP address and browser identifier described in Section 2: cleared automatically after 180 days without a further sign-in, while the subscription remains active.
  • Audit records of who did what and when: 7 years.
  • Sales enquiries, marketing contact submissions and abandoned onboarding attempts: 3 years.
  • Refresh tokens, deleted user accounts and Stripe webhook events: 90 days.
  • Activity logs: 1 year.
  • Accounting records, including invoices and billing information: 7 years, as required by law.

7. Who Else Processes It

Four organizations process personal data on our behalf:

  • Microsoft Azure — hosts the Service and its data, in Sweden Central.
  • Microsoft Graph — reads your Organization's tenant as described in Section 2, under the access your administrator granted.
  • Stripe — processes payment, invoicing and tax for the subscription.
  • Mailjet — delivers the transactional emails the Service sends.

We do not use this data for advertising or marketing: every message the Service sends is transactional — related to a demand, an approval, billing or your account.

8. International Transfers

AlgoCreed is established outside the European Economic Area, in Dubai, United Arab Emirates. Disclosing the Organization's tenant data to AlgoCreed as processor is therefore a transfer of personal data outside the EEA. That transfer rests on the Standard Contractual Clauses adopted by the European Commission under Article 46 of the GDPR, set out in the Data Processing Agreement between AlgoCreed and the Organization.

9. Your Rights

Under the GDPR you may request access to the personal data we hold about you, its rectification, its erasure, restriction of its processing, and its portability, and you may object to processing based on legitimate interest. Write to hello@avyna.io. We respond within one month; where a request is complex we may extend that by up to two further months and will tell you why.

If you consider that your data has been handled improperly, you may lodge a complaint with the supervisory authority of the European Union member state where you live or work.

10. Changes to This Policy

This Policy may be updated to reflect changes to the Service or to the law. The version presented in the Service is the version that applies.