Workspace terms and privacy

Version: workspace-cloud-v1 · October 25, 2026

Skool Copilot is provided by Amirthan Puvaneswaran trading as Avino Labs, Finnish Business ID 3383759-5. Privacy and support: copilot@avinolabs.com. Address: Vapaa-ajanmaa 3 A 20, 33540 Tampere, Finland.

These terms supplement your account agreement. For this workspace service they replace earlier statements that CRM content stays only on your device and that Plan syncing is optional. Other account, capture and scheduling controls still apply.

Your workspace

Copilot automatically stores your workspace with your account and keeps a working copy in your browser. It sends changed records while you are signed in and connected; it retrieves saved records when needed. Changes made without a connection wait on the device. Closing or clearing the browser before a change reaches the service can lose that change.

Saved information includes member and contact details, community relationships, notes, tags, pipeline stages, saved posts, authored drafts, schedule and automation definitions and history, events, activity and financial observations, planning records, selected preferences, and finished media you import or create. Unfinished recordings, account passwords, login tokens, installation secrets and Skool session cookies are excluded from this workspace service. Separate authorized scheduling services retain their own previously disclosed credentials and controls. Retrieving a workspace does not authorize sending messages or replaying schedules.

Protection and providers

The workspace uses Supabase database and private object storage in our Paris project. Requests use HTTPS and account and installation checks. Content is access-controlled and uses the provider's infrastructure protections; it is not end-to-end encrypted. Authorized service operators and providers can access content when necessary to operate, secure or support the service. Device access remains your responsibility.

Supabase acts as our infrastructure subprocessor. See its data processing terms and subprocessors. Selecting an EU project does not mean every support or service operation is restricted to the EU; applicable transfer safeguards must cover such operations.

Retention and your choices

Current records remain until you delete them or your account. Deleted records leave content-free synchronization markers. Copies of request results used to prevent duplicate writes expire after 30 days. Unreferenced media becomes eligible for cleanup after 24 hours. Account deletion blocks new workspace access and queues storage removal, including a delayed sweep after outstanding upload permissions expire. Failed cleanup is retried. Provider recovery copies follow the provider's retention controls and are not an ordinary workspace history.

Account settings provide a bounded JSON data download. It includes workspace records and media descriptions, not media files; large exports and complete media returns are available by contacting the address above. You may request access, correction, restriction, deletion or return, including after your subscription ends. Uninstalling the extension alone does not delete your account. You can complain to Finland's Data Protection Ombudsman or your competent supervisory authority.

Processing on a community operator's behalf

For member data you supply for your community work, you determine the purpose and lawful basis as controller (or represent that controller); Avino Labs acts as processor for storing, retrieving, updating and deleting it. Account administration and security remain our own controller activities. Accepting these terms does not supply a lawful basis for another person's data. Give appropriate privacy information to your members, honor their rights, and submit only data you are entitled to process. This service is not designed for special-category or criminal-offence data.

The processing lasts for the service and the deletion period above. Data subjects are your community members, contacts and people included in your saved content; data categories are listed under “Your workspace.” Your account actions and these terms are documented instructions. Further lawful instructions can be sent to our privacy contact.

We will process that data only on documented instructions unless applicable law requires otherwise; inform you of such a requirement where permitted; limit access to authorized people under confidentiality duties; maintain appropriate security; inform you without undue delay of a personal-data breach; and assist with rights requests, security obligations, impact assessments and regulator consultations taking account of the processing and information available to us.

You authorize Supabase and its disclosed infrastructure subprocessors for this service. We will bind subprocessors to equivalent data-protection duties and remain responsible for their processing. We will notify you of intended additions or replacements so you can raise a reasoned objection before the change. Contact us if an objection cannot be resolved so the affected processing can stop.

On termination, you may instruct return or deletion of the personal data and deletion of remaining copies, unless law requires retention. We will make compliance information available and allow and contribute to proportionate audits, including inspections by you or your mandated auditor. We will tell you if an instruction appears to infringe applicable data-protection law. These processing terms prevail over conflicting service terms for this processing.