Privacy Policy

Effective Date: July 13, 2025
Last Updated: June 21, 2026

Zyna Labs LLC ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect your information when you use Avturo, including our website and our mobile applications (collectively, the "Service").

This Policy applies to all users of the Service worldwide. Additional rights and disclosures for specific regions (including the EEA, United Kingdom, and California) are set out below. For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), Zyna Labs LLC is the "data controller" of your personal data.

If you have questions or wish to exercise your rights, contact us at support@avturo.com.

1. What Information We Collect

a. Personal Information You Provide

When you create an account or interact with our Service, we may collect:

Email address
Password (stored only in encrypted/hashed form)
Car listing URLs, screenshots, images, or text you upload for analysis
Vehicle preferences (budget, type, features) submitted for recommendations
Vehicle information stored in My Garage (make, model, year, VIN, mileage, maintenance records)
Questions and prompts submitted to the AI Mechanic
Support messages or feedback

b. Information We Collect Automatically

We collect limited technical information through cookies, SDKs, and analytics, such as:

IP address and approximate location derived from it
Device type, operating system, and unique device or installation identifiers
Browser type, time zone, and language
Pages and screens visited and interaction data
Referral source (how you found Avturo)
Diagnostic, crash, and performance data

c. Email and Communication Preferences

When you subscribe to our mailing list or create an account, we collect:

Email address
Subscription source (e.g., signup, footer, post-analysis)
Communication preferences (e.g., deals, maintenance tips, recalls)
Email engagement data (opens, clicks) for improving our communications
Unsubscribe status and date

We do not knowingly collect special categories of personal data (such as health, biometric, or government-identifier data). Please do not submit such information through the Service.

2. How We Use Your Data

We use your data to:

Provide and personalize the AI-powered car analysis experience
Generate reports and recommendations based on your submissions
Provide AI Mechanic assistance for maintenance and repair questions
Store and manage your vehicles in My Garage
Send recall alerts for vehicles you have saved
Manage your account and store saved results (via Firebase)
Process payments and manage subscriptions or one-time purchases
Send transactional emails (account confirmation, password reset, purchase receipts)
With your consent where required, send marketing emails including newsletters, car tips, and featured deals
Respond to support requests
Improve the Service, troubleshoot issues, and ensure security and prevent fraud or abuse
Comply with legal obligations

3. Email Communications and Consent

We send two categories of email:

Transactional and service emails: Essential communications such as account verification, password resets, purchase receipts, important service notices, and (if you use My Garage) safety recall alerts for your saved vehicles. These are necessary to provide the Service and are sent on the basis of our contract with you. They cannot be opted out of while your account is active.
Marketing emails: Periodic newsletters with car-buying tips, featured deals, maintenance advice, and product updates. We only send marketing emails where we have a lawful basis to do so. For individuals in the EEA and UK, we send marketing emails only with your separate, opt-in consent (which is not bundled with account creation), or where otherwise permitted by applicable law (such as the "soft opt-in" for existing customers). You can withdraw consent or unsubscribe at any time.

Unsubscribe: You can opt out of marketing emails at any time by clicking the "Unsubscribe" link in any email or by emailing support@avturo.com. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

We use Resend, a third-party email service provider, to deliver emails. Your email address is shared with Resend solely for the purpose of email delivery. See their privacy policy at resend.com/legal/privacy-policy.

4. AI and Third-Party Processing

Your data may be processed by third-party services to provide our features:

AI Analysis: Your submissions (screenshots, URLs, car details, questions) may be processed by third-party AI models (e.g., Google Gemini) to generate reports, recommendations, and AI Mechanic responses.
Recall Data: We query NHTSA (National Highway Traffic Safety Administration) databases using your vehicle information to check for safety recalls.
We send only the minimum data required to deliver the feature.
We do not sell your personal data, and we do not permit our AI providers to use your submissions to train their general-purpose models. We rely on enterprise/API service tiers that contractually exclude content from model training.
These tools may be located in the United States or other jurisdictions. See "International Data Transfers" below.

5. Legal Bases for Processing (EEA / UK)

If you are located in the EEA or UK, we process your personal data under the following legal bases:

Performance of a contract: To provide the Service you requested (account, analysis, recommendations, My Garage, purchases, and related transactional emails).
Consent: For marketing emails (where required), non-essential cookies, and any optional features you opt into. You may withdraw consent at any time.
Legitimate interests: To secure and improve our platform, prevent fraud and abuse, and understand how the Service is used — balanced against your rights.
Legal obligation: To comply with applicable laws and respond to lawful requests.

6. Sharing of Your Information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law. We may share your data only with:

Firebase (Google Cloud): For secure hosting, authentication, database storage, and analytics
Generative AI services (e.g., Google Gemini): For report generation, recommendations, and AI Mechanic functionality
Resend: For email delivery services
Payment processors: Stripe (for purchases made on the web) and Apple (for in-app purchases made through the App Store). Your payment card details are handled directly by these processors and are not stored by us.
NHTSA: We query their public databases for recall information (no personal data is shared)
Authorized service providers and contractors: For development, support, and operations — under written confidentiality and data-protection obligations
Legal authorities or successors: When required by law, to protect our legal rights, or in connection with a merger, acquisition, or sale of assets

7. Data Retention

We retain your data:

As long as your account is active
Until you delete your account or request erasure
For up to 12 months after account inactivity, unless a longer period is required for legal, tax, accounting, or security reasons

Mailing list data: If you unsubscribe from emails, we retain your email address with an "unsubscribed" status to ensure we don't email you again. You can request complete deletion at any time.

My Garage data: Vehicle information is retained until you delete the vehicle or your account.

You can request deletion anytime by emailing support@avturo.com, or delete your account directly in the app under Account settings.

8. Data Security and Breach Notification

We use industry-standard security practices including:

Encrypted communication (HTTPS/TLS)
Firebase Authentication with secure password hashing
Limited internal access to user data on a need-to-know basis
Secure storage and data minimization
Regular security reviews

No method of internet transmission or electronic storage is ever fully secure, and we cannot guarantee absolute security. In the event of a personal-data breach that is likely to affect you, we will notify affected users and the relevant supervisory authorities where and as required by applicable law (including within the timeframes set by the GDPR).

9. Cookies and Tracking

We use cookies and similar technologies for:

Essential cookies: Required for authentication and basic functionality. These are always active.
Analytics cookies: To understand how users interact with our Service (via Firebase Analytics).
Preference cookies: To remember your settings and preferences.

Consent: Where required by law (including in the EEA and UK), non-essential cookies and similar technologies are only set after you give consent through our cookie banner. You can change or withdraw your choices at any time via the banner or your browser settings, and you can control cookies through your browser. Disabling certain cookies may affect Service functionality.

10. Your Privacy Rights

If you are in the EEA or UK (GDPR / UK GDPR): You have the right to:

Access a copy of your personal data
Request correction (rectification) of inaccurate data
Request deletion (erasure) of your data
Object to or restrict certain processing
Withdraw consent at any time (including email and cookie consent)
Receive your data in a portable format (data portability)
Lodge a complaint with your local Data Protection Authority (DPA)

If you are in California (CCPA, as amended by the CPRA): You have the right to:

Know what personal information we collect, use, and disclose, and why
Request access to and deletion of your personal information
Correct inaccurate personal information
Opt out of the "sale" or "sharing" of personal information (note: we do not sell or share your personal information)
Limit the use and disclosure of sensitive personal information (note: we do not use sensitive personal information for purposes that trigger this right)
Non-discrimination for exercising your rights

We honor opt-out preference signals such as the Global Privacy Control (GPC) where required by law.

CAN-SPAM Compliance: All marketing emails include a clear unsubscribe mechanism, our physical address, and accurate sender information.

To exercise any of these rights, email us at support@avturo.com. We will verify your request and respond within the timeframe required by applicable law (generally 30 days, or 45 days under the CPRA). You may use an authorized agent where permitted by law.

11. Automated Decision-Making

Avturo uses artificial intelligence to generate analyses, estimates, and recommendations. These are informational tools to assist your own decision-making. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement, within the meaning of Article 22 of the GDPR.

12. Mobile App and Tracking

Our mobile applications collect device and usage information as described above to operate and improve the Service. We use first-party analytics (Firebase Analytics) to understand how the app is used.

We do not track you across other companies' apps or websites for advertising purposes, and we do not use third-party advertising identifiers (such as Apple's IDFA) for cross-app tracking. Because we do not engage in such tracking, we do not present an App Tracking Transparency (ATT) prompt. Purchases made in the app are processed by Apple under Apple's terms and privacy policy.

13. Minors

Avturo is intended for adults and is not directed to children. We do not knowingly collect personal data from anyone under the age of 18 (or the age of majority in your jurisdiction). If you believe a minor has provided us personal data, please contact us and we will delete it.

14. International Data Transfers

Our services are hosted in the United States. If you access Avturo from outside the U.S., your data may be transferred to and processed in the U.S. and other countries, which may not offer the same level of data protection as your home jurisdiction.

Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards required by law, which may include the European Commission's Standard Contractual Clauses (and the UK Addendum), and reliance on the EU–U.S. Data Privacy Framework (and its UK Extension) where a recipient is certified. You may request a copy of the relevant safeguards by emailing us.

15. EEA / UK Representative

EEA and UK individuals may contact us directly at support@avturo.com regarding their personal data and these rights. Where we are required to designate a representative under Article 27 of the GDPR or UK GDPR, that representative's contact details will be published here upon appointment.

16. Third-Party Links

Our Service may contain links to third-party websites (e.g., vehicle listings, external resources). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

17. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, features, or our practices. If we make material changes, we will notify you via email or in-app notification and update the "Last Updated" date above. Your continued use of the Service after updates means you accept the changes.

18. Contact

Zyna Labs LLC
Los Angeles, 91364 California, USA
Email: support@avturo.com