Privacy Policy

01Introduction

We respect your privacy. This Privacy Policy (“Policy”) explains what personal data Pavask collects when you use our websites and services, why we collect it, how we use and share it, and what rights you have.

The Services are operated by Pavask Technology LLC, a company registered in the Republic of Armenia at 2 Nar-Dos Street, Yerevan, Armenia (“Pavask”, “we”, “us”, “our”). Pavask decides why and how your personal data is processed. It is the data controller under the EU and UK General Data Protection Regulation (“GDPR”), and the processor of personal data under the Law of the Republic of Armenia “On Protection of Personal Data” (the “Armenian Law”).

This Policy covers pavask.com and all web applications, SaaS services and progressive web apps (“PWA”) that Pavask operates. Some products have their own privacy notice that adds product-specific details. If a product notice and this Policy differ, the product notice applies to that product.

This Policy forms part of, and should be read together with, our Terms of Use.

We process personal data under the Armenian Law. Where you use the Services from the European Economic Area (“EEA”), the United Kingdom or the United States, we also comply with the privacy laws that apply there. Sections 14 and 15 contain additional information for those users.

02Definitions

• Services means our websites, web applications, SaaS services and PWAs, and any related features or support we provide.
• Personal Data means any information that relates to you as an identified or identifiable person.
• Account means the account you create to use a Service.
• User Content means messages, images, voice recordings and other content you send through the Services.
• Service Provider means a third party that processes Personal Data on our behalf or helps us provide the Services (see Annex A).
• Tracking Technologies means cookies, pixels, local storage, SDKs and similar technologies described in Section 6.
• User means any person who visits or uses the Services.

03Data we collect and why

The data we collect depends on which Services you use and how you interact with them.

Information you provide

Information from third parties

Information collected automatically

We do not ask for special categories of Personal Data, such as health, religious beliefs or biometric data. Please do not include such data in User Content.

We may anonymise or aggregate Personal Data so that it can no longer identify you. Anonymised data is not Personal Data, and we may use it for statistics and research.

04Legal bases

Under the Armenian Law we process Personal Data on the following grounds:

• Agreement. When you create an Account or buy a subscription, you enter into an agreement with us on our Terms of Use and the applicable product terms. We process the Personal Data you provide only to perform that agreement. The Armenian Law treats this as processing with your consent.
• Consent. We ask for your consent to analytics, advertising measurement and push notifications. You can withdraw it at any time (see Section 13). Withdrawal does not affect processing carried out before it.
• Publicly available data. We process public social media profile data that the account owner has made publicly available.
• Legal obligation. We process data where a law requires us to, for example to keep accounting records or to respond to lawful requests from public authorities.

If you do not provide data marked as required, we may not be able to provide the related Service. The legal bases under the GDPR are listed in Section 14.

05How we use your data

• To provide the Services: run your Account, deliver features, process your subscription and provide customer support.
• To communicate with you: send one-time login codes, service messages, receipts, and changes to our terms and policies. With your consent, we may also send product news and offers. You can unsubscribe at any time.
• To improve the Services: analyse how the Services are used, test new features, fix errors and plan new products.
• To measure advertising: with your consent, we find out which campaigns bring Users to the Services and whether those Users sign up or subscribe. We also use this to show our ads to people likely to be interested in them.
• To keep the Services safe: prevent fraud, abuse and security incidents, and enforce our terms.
• To comply with the law: meet accounting, tax and other legal obligations, and establish, exercise or defend legal claims.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

06Cookies and tracking technologies

Cookies are small text files stored in your browser. We and our Service Providers also use similar technologies, such as pixels, local storage and IndexedDB. Some are needed to run the Services. Others help us understand usage and measure advertising.

Server-side conversion events

Besides the pixels in your browser, our servers may send conversion events, such as a completed sign-up or purchase, directly to Meta and TikTok. These events can include:

• your email address in hashed (irreversibly encoded) form;
• your IP address and browser user agent;
• click and cookie identifiers;
• the event name, time and value.

Meta and TikTok use this data to match the events to their users and report campaign results to us. We send these events only on the same basis as the pixels.

Your choices

Where the law requires it, we ask for your consent before we use analytics or advertising technologies. You can change your choices in the Services’ cookie settings where they are available. You can also block or delete cookies in your browser settings, or contact us at support@pavask.com. If you block strictly necessary cookies, parts of the Services may not work. More information about how Meta and TikTok use data is available in their policies (see Annex A).

07Push notifications

Some of our Services can be installed as progressive web apps. They may send push notifications, such as reminders, account updates and other important service messages. We send them only if you allow notifications in your browser or on your device. When you do, your browser gives us a push subscription token. We store it and use it to deliver notifications, for example through Firebase Cloud Messaging.

You can turn notifications off at any time in your browser, device or app settings. We then stop using the token, and we delete it together with your Account.

08Sharing your data

We do not sell your Personal Data for money. We share it only in the following cases:

• Service Providers. Companies that host our infrastructure, process payments, provide analytics, deliver notifications, measure advertising or supply public social media data (see Annex A). They may use Personal Data only to provide their services, or as described in their own privacy policies where they act as independent controllers. This applies, for example, to Polar as merchant of record, and to Meta and TikTok for their advertising products.
• Legal requirements. We disclose data where the law, a court or a competent authority requires it, or where it is necessary to prevent crime or fraud.
• Protection of rights. We disclose data where it is necessary to enforce our terms or to protect the rights, property or safety of Pavask, our Users or others.
• Business transfers. If we reorganise, merge or sell all or part of our business, Personal Data may be transferred to the successor. This Policy, or a policy at least as protective, will continue to apply.
• With your consent. We share data in any other case where you have agreed to it.

We may share anonymised or aggregated information that does not identify you.

09International transfers

We store Account data on Amazon Web Services servers in the European Union (Frankfurt, Germany). Some Service Providers, including Meta, TikTok, Polar, Stripe, Google and ScrapeCreators, may process data in the United States or other countries.

We transfer Personal Data abroad in line with Article 27 of the Armenian Law. We transfer it to countries recognised as providing adequate protection, or where the transfer is necessary for the purposes of processing, or with your consent. For Users in the EEA and the UK, transfers outside those regions rely on an adequacy decision (such as the EU–U.S. Data Privacy Framework, where the recipient is certified) or on the European Commission’s Standard Contractual Clauses.

10Data retention

We keep Personal Data only as long as we need it for the purposes described in this Policy:

• Account data and User Content: while your Account is active. When you delete your Account, we delete this data within 30 days.
• Backups: deleted data may remain in encrypted backups for up to 90 days, after which it is overwritten.
• Dispute and fraud records: your email address and payment or subscription identifiers are kept for 1 year after you delete your Account. We use them only to handle refunds, chargebacks, disputes and fraud prevention.
• Accounting records: transaction records are kept for 5 years, or longer if the law requires. Polar, as merchant of record, keeps its own records under its policy.
• Analytics and advertising data: kept for no longer than 26 months, or until you withdraw consent.
• Support communications: kept for up to 1 year after your request is resolved.

When the retention period ends, we delete or anonymise the data.

11Security

We protect Personal Data with technical and organisational measures, including:

• encryption in transit (HTTPS);
• access controls and the principle of least privilege;
• secure infrastructure;
• regular review of our practices.

Only employees and contractors who need data for their work can access it, and they are bound by confidentiality obligations.

No method of transmission or storage is completely secure. If a breach affects your Personal Data, we will notify you and the competent authorities as the law requires.

12Age requirements

The Services are intended for people aged 16 and over. We do not knowingly collect Personal Data from anyone under 16. If we learn that we have, we will delete it and close the related Account.

If you believe a child under 16 has given us Personal Data, please contact us at support@pavask.com.

13Your rights

Depending on where you live, you have some or all of the following rights:

• Access. Find out whether we process your Personal Data and receive a copy of it, together with information about the purposes, legal grounds, sources, recipients and retention periods.
• Rectification. Have incomplete, inaccurate or outdated data corrected.
• Deletion. Have your data deleted, subject to legal retention obligations.
• Restriction. Have processing blocked or restricted.
• Withdrawal of consent. Withdraw consent at any time, for analytics, advertising or push notifications.
• Objection. Object to processing, including processing for marketing.
• Portability. Receive the data you provided in a structured, machine-readable format.
• Complaint. Complain to a data protection authority (see below).

How to exercise your rights

You can delete your Account at any time in its settings. For any other request, email support@pavask.com from the address linked to your Account. We may ask for more information to confirm your identity.

Requests are free of charge. We follow the time limits of the Armenian Law:

• We answer access requests within 5 working days.
• We correct or delete inaccurate or unlawfully processed data within 3 working days.
• After you withdraw consent, we stop the related processing within 10 working days.

If we refuse a request, we will explain why in writing.

Supervisory authority

In Armenia you can complain to the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia or go to court. Users in other countries can also contact their local data protection authority.

14Additional information for users in the EEA and the UK

If you use the Services from the EEA or the United Kingdom, the GDPR or the UK GDPR applies to our processing of your Personal Data. We rely on the following legal bases:

• Contract (Art. 6(1)(b)): to provide the Services, manage your Account and subscription, and provide support.
• Consent (Art. 6(1)(a)): for analytics, advertising measurement, pixels and server-side conversion events, push notifications and marketing emails.
• Legal obligation (Art. 6(1)(c)): for accounting, tax and responses to lawful requests.
• Legitimate interests (Art. 6(1)(f)): for security, fraud prevention, fixing errors, providing Services based on public social media data, and defending legal claims. You can object to this processing at any time.

You have the rights described in Section 13, including the right to data portability and the right to object. You can complain to the data protection authority in the country where you live or work, or where an alleged infringement took place. A list of EU authorities is available on the European Data Protection Board website. In the UK, contact the Information Commissioner’s Office.

15Additional information for users in the United States

This section applies to residents of California and of other US states with consumer privacy laws. It supplements the rest of this Policy.

Categories of Personal Information

In the last 12 months we have collected the following categories of personal information:

• Identifiers: name, email address, social media usernames, IP address, cookie and device identifiers.
• Commercial information: subscriptions purchased and transaction history.
• Internet or other electronic network activity: usage data and interactions with our Services and ads.
• Approximate geolocation: derived from your IP address.
• Audio and visual information: images and voice recordings you send as User Content.
• Inferences: preferences drawn from your use of the Services.

We collect this information from you, from your device, from Service Providers and from public sources, for the purposes described in Section 5. We disclose it to the categories of recipients described in Section 8.

Sale and sharing

We do not sell personal information for money. Using advertising pixels and server-side conversion events with Meta and TikTok may count as “sharing” for cross-context behavioural advertising, or as a “sale”, under some state laws. You can opt out by declining advertising cookies where a choice is offered, or by emailing support@pavask.com with the subject “Do Not Sell or Share”. We do not knowingly sell or share the personal information of consumers under 16.

Your rights

Depending on your state, you have the following rights:

• to know what personal information we collect, use and disclose, and to access it;
• to delete it;
• to correct it;
• to opt out of its sale or sharing and of targeted advertising;
• not to be discriminated against for exercising these rights.

You can send a request yourself or through an authorised agent, and we will verify it before acting. If we decline a request, you may appeal by replying to our decision.

16Third-party sites

The Services may contain links to websites and services operated by others, including social networks and payment pages. This Policy does not apply to them. Please read their privacy policies.

17Changes to this Policy

We may update this Policy from time to time. The effective date at the top shows when it was last changed. If the changes are material, we will notify you in the Services or by email before they take effect. Where the law requires, we will ask for your consent again.

18Contact us

AAnnex A. Service providers

These are the main third parties that process Personal Data in connection with the Services. Their privacy policies are linked below.