Data Retention & Protection Policy

Last updated: March 13, 2026

1. Data We Store

User accounts (email, name, profile image) are retained until account deletion. Sessions expire after 7 days. Meetings and participant data persist until deleted by the organizer. OAuth tokens for Google, Microsoft, and Zoom are stored until the integration is disconnected. Calendar event details are never stored — they are queried in real time and discarded.

2. Data Deletion

When you delete your account, all associated data is permanently removed: your user profile, all meetings and participant records, all calendar and integration connections (tokens are revoked), all booking configurations, and all session data. Deletion is cascading and immediate.

3. Data Protection Measures

All data is transmitted over HTTPS/TLS with HSTS enforced. Session cookies are HTTP-only and secure. OAuth tokens are stored server-side only and never sent to the browser. All database queries use parameterized statements via Drizzle ORM, preventing SQL injection. OAuth flows use cryptographically random state parameters to prevent CSRF. We enforce Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, and Strict-Transport-Security headers. Calendar integrations request only the minimum scopes needed.

4. Third-Party Data Processing

Data transmitted to Auth0, Google, Microsoft, Zoom, and Resend is processed according to each provider's data protection policies. We transmit only the minimum data required for each operation.

5. Data Access

Access to production data is restricted to authorized personnel. Users may request a data export by contacting hello@getavaili.com.

6. Incident Response

In the event of a data breach, we will notify affected users within 72 hours of discovery via their registered email address.