Availo

Privacy Policy

Last updated: 2 November 2026

This Privacy Policy explains how SPACE RND LTD ("SPACE RND," "we," "us," or "our") collects, uses, stores, and shares personal data when you use Availo— our Android app, marketing site, and public callback pages (together, the "Service").

SPACE RND LTD is a private limited company registered in Kenya. We are the controller of personal data for the Service. We process personal data in line with the Kenya Data Protection Act, 2019 and, for people in the European Economic Area and the United Kingdom, the GDPR and UK GDPR. We also design the Service to meet Google Play user-data requirements.

Contact: support@onavailo.com · Postal: P.O. Box 47944, 00100 G.P.O Nairobi, Kenya.

1. Who this policy covers

  • Account holders — people who create an Availo account and use the Android app.
  • People using the app without an account — the app can hold calls on that phone from hours, focus blocks, and VIPs saved only on the device. Callers have no page until that person creates an account and claims a link.
  • Callers — people who submit a callback request through an Availo user's public or access-code-protected link, or who open a caller status page.
  • Website visitors — people who browse onavailo.app or related Availo web pages without submitting a form.

2. Data we collect

2.1 Account holders

  • Account credentials: email address, a password hash, sessions, and one-time codes. We store these in our own database. Resend delivers the email that carries a code. Resend does not hold your password.
  • Profile: username, timezone, availability window, callback page mode (public or code-required), and related preferences.
  • VIP contacts you choose to save: name and phone number (and optional photo URL if you add one). A VIP is another person. We store that name and number because you asked us to, and we do not contact them. If you pick VIPs from your device contacts, we only store the contacts you select — we do not upload your full address book.
  • Device contacts, on your phone: if you allow it, the app reads contacts stored on your device to screen calls from saved numbers and to show their names in activity. That lookup stays on your phone. The address book is not uploaded. You can turn this permission off in Android settings. A VIP you save is still the only contact name and number stored on our servers.
  • Schedules and availability: custom focus / blocking schedules and generated or managed callback time slots.
  • Push notifications: a device push token (FCM) so we can notify you about callbacks, appointments, and reminders.
  • Subscriptions: Google Play purchase tokens, product identifiers, plan, and expiry needed to verify and apply Pro entitlements.

2.2 People using the app without an account

Hours, focus blocks, and up to five VIPs stay on the phone. The screened-call list in section 2.4 stays on the phone as well. We do not receive that data until you create an account. Creating an account uploads the hours, focus blocks, and VIPs already on the phone. It does not upload the screened-call list. Signing into an existing account replaces what is stored on the phone with that account.

2.3 Callers (callback form and status pages)

  • Name, phone number, reason for the call, and preferred time slots you select.
  • Request status metadata (pending, accepted, rejected, withdrawn, expired), optional host notes shown to you, and a short-lived status link code.
  • Optional spam checks: if enabled, a reCAPTCHA token may be verified with Google. The public callback form does not send a reCAPTCHA token today.

When a host accepts a request, we create an appointment record with the caller details above so the host can manage the callback. The caller's details are given to the account holder whose link was used. That host decides whether to call back. We operate the callback service. We do not call the caller ourselves.

2.4 On-device call screening (Android)

Availo uses Android's call-screening capability to decide whether an incoming call should ring during a focus period. Incoming numbers are evaluated on your device against a local policy snapshot (schedules, VIP numbers, and active appointments). We do not upload your full call history or a live feed of every incoming number to our servers for screening.

The phone keeps a local list of screened calls for about one month. Each entry has the time, the number, a masked form of the number, whether the call was held, the reason, and whether the call was incoming or outgoing. The list is then deleted on the phone. We do not receive it.

If you text someone about a missed call, the app opens your phone's messaging app with a short note and your callback link. We do not send or store that message.

Screening requires the Android call-screening role. Notifications permission is used for blocked-call / callback alerts. Contacts permission lets Availo screen numbers already saved on your phone and show those names in activity. The address book stays on the device and is not uploaded. A VIP you choose to save is the only contact name and number stored on our servers.

2.5 Technical and usage data

  • Standard server logs (for example IP address, timestamps, request paths) needed to operate, secure, and debug the Service.
  • Device/app version information reasonably needed for support and compatibility.

We do not currently run third-party advertising SDKs or sell personal data. If we add analytics or crash reporting later, we will update this policy and Play Console disclosures before those tools go live. The marketing site does not set its own analytics or advertising cookies.

3. How we use data

  • Provide, operate, and improve call management, callback booking, and related features.
  • Authenticate accounts and protect against abuse, spam, and unauthorized access.
  • Notify hosts about callback requests, decisions, and upcoming appointments.
  • Verify Google Play purchases and manage free / Pro limits.
  • Communicate about the Service (support replies, security, and material changes).
  • Comply with law and enforce our Terms of Service.

Lawful bases under Kenyan law typically include performance of a contract (providing the Service you request), consent where you choose optional features, and legitimate interests such as security and service integrity — balanced against your rights. Bases for people in the EEA and the UK are in section 9.

4. How we share data

We share personal data only as needed to run the Service:

  • With the Availo host: caller form submissions are delivered to the account holder whose link was used so they can accept, reject, or schedule a callback.
  • Service providers, who process data on our instructions:
    • Railway hosts the API and the database.
    • Resend delivers account emails, including one-time codes.
    • Google delivers push notifications (Firebase Cloud Messaging), verifies Play purchases, and, if we turn the check on, verifies a reCAPTCHA token.
  • Legal and safety: when required by law, or to protect SPACE RND, users, or the public from fraud, abuse, or security threats.

We do not sell personal data.

5. International transfers

SPACE RND is based in Kenya. Railway, Resend, and Google may process personal data outside Kenya, including in the United States.

For people in the EEA and the UK, personal data is transferred to Kenya and to those providers. Kenya does not have an EU adequacy decision. Those transfers use the European Commission's Standard Contractual Clauses. Transfers from the UK also use the UK International Data Transfer Addendum. Using Availo is not the basis for the transfer.

6. Retention

  • Account data is kept while the account is active. Deleting the account removes the authentication record (email, password hash, sessions, and one-time codes), profile, VIP contacts, focus blocks, availability slots, callback requests, appointments, notification records, push token, and the subscription records we store for that account. Backup copies and server logs can remain for a limited operations period and then drop out. We keep a record longer only when the law requires it, such as fraud prevention or accounting, and only for that period.
  • Unconfirmed email. If your account must confirm its email and you do not, we delete it about 7 days after it was created.
  • Callback requests. A request stays pending for 7 days, then it expires. The short status link stops working 7 days after the request expires, is rejected, or is withdrawn, and 3 days after the end of a booked callback window if the host accepted it. We then clear the status code. The caller's name, phone number, reason, and times stay on the host's account until the host deletes the account. That includes rejected and withdrawn requests.
  • Appointments. A completed appointment is deleted 30 days after it was completed. A scheduled or cancelled appointment stays until the host deletes the account.
  • Access codes for privacy-mode links expire on the timer the host set (up to 30 minutes). We delete the code about one hour after it expires.
  • On-device activity is kept on the phone for about one month, then deleted there. Clearing the app's storage or uninstalling the app deletes it sooner. We do not receive that list.
  • Data saved without an account stays on the phone until you create an account (hours, focus blocks, and VIPs are then uploaded), you sign into an existing account (which replaces what is on the phone), or you clear the app's storage.
  • Subscription records are kept as needed to verify Pro and for accounting and fraud prevention. Google Play keeps its own purchase history under Google's policies.
  • Server logs (IP address, time, and request path) are kept for security and debugging, then rotated.

7. Security

We use industry-standard measures appropriate to the Service, including HTTPS/TLS in transit, access controls on production systems, and least-privilege practices for staff and processors. No method of transmission or storage is 100% secure; please use a strong unique password and keep your device updated.

8. Your rights

Subject to the Kenya Data Protection Act, the GDPR, UK GDPR, and other applicable law, you may request to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Receive a copy of the data you provided, in a portable form
  • Delete your account in the Availo app (Settings → Delete account) or follow the steps at /account-deletion
  • Object to or restrict certain processing
  • Withdraw consent where processing is consent-based

Email support@onavailo.com with the subject "Privacy request." We may need to verify your identity before acting. We respond within 30 days. You may lodge a complaint with the Office of the Data Protection Commissioner (Kenya). If you are in the EEA or the UK, you may also complain to the supervisory authority in your country. For the UK, that is the Information Commissioner's Office.

9. People in the EEA and the United Kingdom

If you are in the European Economic Area or the United Kingdom, this section applies together with the rest of this policy. SPACE RND LTD, at the Nairobi address in section 13, is the controller.

We rely on these GDPR and UK GDPR bases:

  • Contract (Article 6(1)(b)): your account, profile, hours, focus blocks, callback page, push notifications, and the callback requests and appointments we run for you.
  • Legitimate interests (Article 6(1)(f)): security, server logs, abuse prevention, and storing a VIP name and number because the account holder asked us to. We do not contact that person. You can object. The account holder can remove the VIP in the app.
  • Legal obligation (Article 6(1)(c)): records we must keep, such as accounting or fraud prevention.
  • Consent where a feature is optional, including the Android contacts permission. You can turn that permission off in system settings. We do not treat continued use of the app as consent.

A caller who sends a request has not opened an account with us. The callback form tells them the request goes to that host, and it links to this policy. We process the caller's name, phone number, reason, and times so the host can accept, reject, or book the callback, and we give those details to that host. A VIP's name and number are stored because the account holder entered them. We do not contact VIPs, and we do not use caller or VIP details for anything other than the callback service and the security of it.

Transfers of EEA and UK personal data are described in section 5. They use Standard Contractual Clauses, and the UK addendum for the UK.

SPACE RND has no office in the EEA or the UK. Send privacy requests to support@onavailo.com. An EU representative (GDPR Article 27) and a UK representative are not yet named on this page. Their contact details will be added here when they are appointed.

Call screening runs on your phone from rules you set. We do not make a solely automated decision about you that produces a legal effect or a similarly significant effect.

10. Children

Availo is not directed at anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided data, contact us and we will delete it. Under the Kenya Data Protection Act, a person under 18 is a child. In the EEA and the UK, the age at which a person can consent on their own to this kind of service is set by the country where they live and is between 13 and 16. Our Terms require you to be at least 18.

11. Android permissions summary

  • Call screening / phone-related role: hold or allow calls on the device according to your hours, focus blocks, and VIPs.
  • Notifications: alert you about blocked calls, callbacks, and reminders.
  • Contacts (optional): read contacts on the phone to hold calls from saved numbers and show their names in activity, and to let you pick a VIP. The address book is not uploaded. Only a VIP you save is stored on our servers. You can turn this off in Android settings.

12. Changes

We may update this policy. The "Last updated" date at the top will change, and for a material change we will say when it takes effect, in the app or by email when we can reach you. If you do not agree, stop using Availo and delete your account before that date. We do not treat continued use as consent for a new use of personal data that needs consent.

13. Contact

SPACE RND LTD · Availo
Email: support@onavailo.com
Registered office: Centenary House, Ring Road, Westlands, Nairobi, Kenya
Postal: P.O. Box 47944, 00100 G.P.O Nairobi, Kenya