Last updated: 14 October 2026 (Discovery Chat)
Legal notice and privacy
Who publishes this site, who hosts it, and what we do with the data you share with us.
Legal notice
- Publisher
- Guillermo Blanco, individual
55 rue François Truffaut, 75012 Paris, France
Phone: +33 6 26 03 30 13
Email: contact@avapmo.com - Publication director
- Guillermo Blanco
- Trade name
- AVApmo. Company registration is in progress; this notice will be updated once it is complete.
- Host
- OVH SAS, 2 rue Kellermann, 59100 Roubaix, France · +33 9 72 10 10 07 · ovhcloud.com
Intellectual property. The texts, visuals and screenshots on this site belong to their author unless stated otherwise. The Agentic Development Protocol (ADP) specification is published separately under an open licence (documentation CC BY 4.0, code MIT) on GitHub. Third-party names and products mentioned belong to their owners.
External links. This site links to other sites (Cal.com, GitHub, avapmo.com…). They have their own terms and privacy policies.
Privacy policy
The data controller is Guillermo Blanco (details above). For any question or request about your data: privacy@avapmo.com.
What we collect, why, and for how long
| When | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| "Executive briefing" and "Protocol updates" forms (method page) | Email address | Send the briefing and protocol updates. Consent, confirmed by double opt-in (GDPR art. 6.1.a). | Until you unsubscribe (link in every email), or 3 years without activity. |
| Booking a call (Cal.com) | Name, email, time slot, answers to the booking questions | Prepare and hold the call. Steps taken at your request before a contract (art. 6.1.b). | 3 years after the last contact, unless you become a client. |
| Emails to contact@ or privacy@ | Your message and contact details | Reply to you. Legitimate interest (art. 6.1.f) or pre-contract steps. | 3 years after the last contact. |
| Visiting the site | Server logs (IP address, page, date) | Security and operation of the site. Legal obligation and legitimate interest. | Kept by the host, at most 1 year. |
Service providers
We do not sell your data or share it for advertising. It only goes to the providers we need:
- OVH SAS (France): website hosting and our mailbox.
- WhatsApp: If you write to us on WhatsApp, Meta processes that conversation under its own terms; we use it only to answer you.
- Buttondown (United States): sending the briefing and protocol-update emails.
- Cal.com (United States): call booking.
- Google Cloud (data in the European Union: database in Belgium, AI on the EU endpoint): hosting, database, AI model. Google Cloud's data processing terms apply.
- Lettermint B.V. (Netherlands; email processed and stored in the EU under its DPA): sending the codes, cards and confirmations. Lettermint keeps the emails it sends, with their content, for 28 days and delivery events for up to 90 days; we can't change these periods.
Buttondown and Cal.com process data in the United States. These transfers rely on the safeguards those providers offer (such as the European Commission's standard contractual clauses); their privacy policies give the details.
ADP Discovery Chat (adp.avapmo.com/start/)
The Discovery Chat is an AI assistant that suggests AI tools for your business. Here is what it does with your data. The short version: your description, your follow-up answers and any document text are deleted when your session ends. Your card (short summaries and your readiness answers) is kept 30 days so you can request an offer from its email, and 12 months if you do request one.
What we collect, why, and for how long
| What | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Confirming your email | Email address, a 6-digit code (stored only as a keyed hash, HMAC) | Check that the address is yours before anything else. At your request (GDPR art. 6.1.b). | The code is valid 10 minutes; its record is deleted within 24 hours. |
| Your session | Your description of your need, your answers to the follow-up questions | Prepare your recommendation card. At your request (art. 6.1.b). | Deleted when your session ends: after 30 minutes without activity or 2 hours after you started, and at the latest about 1 hour after that. |
| An optional document | The text your browser extracts from it. The file itself never leaves your device; the extracted text is sent to our server and to Google's AI service. | Same. | Deleted as soon as your card is ready, and in any case when your session ends. Never emailed. |
| Your readiness answers | Your answers to the five readiness questions and your score, with your email, language, the version of this notice you accepted and your newsletter choice | Score your readiness and build your card. At your request (art. 6.1.b). | 24 hours if you don't reach a card; otherwise kept with your card (next row). |
| Your card | Short summaries of your need and answers, the tools and steps suggested, plus the readiness data above | Show and email your card; let you request an offer from the email for 30 days. At your request (art. 6.1.b). | 30 days, whether or not you request anything. |
| A request (training, workshop, build, guidance or a call) | Your card and, if you ask during your session, your description and follow-up answers in your own words. A recap is emailed to our mailbox. | Prepare our proposal or call. Steps before a contract, at your request (art. 6.1.b). | 12 months after your last request, in the chat system and in our mailbox. A Cal.com booking follows the contact rule above (3 years after the last contact). Longer only if you become a client. |
| Newsletter (only if you tick the separate box) | Email address | Send the newsletter. Consent (art. 6.1.a). | Until you unsubscribe. |
| Abuse limits | A keyed hash (HMAC) of your IP address, a hash of your email address, counters | Stop automated abuse and keep the service available. Legitimate interest (art. 6.1.f). | Up to 48 hours. Daily totals (counts only, no identifiers): 13 months. |
| Email sending log | For each email we send: its type and a session reference, never its content | Know what was sent and retry failures. Legitimate interest (art. 6.1.f). | 30 days. |
| Do-not-send list | A keyed hash (HMAC) of an address that bounced or reported our email as spam | Never email that address again; protect our sending domain. Legitimate interest (art. 6.1.f). | Bounce: 12 months. Spam report: 3 years. |
If the AI fails during your session, we email to our own mailbox your description (up to 1,000 characters, never your document), your email, language and readiness score, so we can answer you by hand. The email's content is removed from our sending queue once sent. The copy in your session is deleted when the session ends; the copy in our mailbox is deleted within 12 months.
The AI. Your description, your follow-up answers and any text extracted from your document are sent to our server and to Google's Gemini model on Vertex AI, processed in the European Union. Google does not use them to train its models. Request logging is off on our side. Google may keep prompts that its automated abuse checks flag, including document text, for up to 90 days, in the EU. The card is a suggestion generated by AI and may be wrong; it has no legal or similar effect on you, and a person (us) is available on a free call.
Deleting your data. Your card email and our request confirmations contain a deletion link (the code emails don't; for those, reply to the email or write to privacy@avapmo.com). You confirm with a fresh code. The link then deletes at once, from our live systems: your card and requests, any session still open, emails still waiting to be sent, your verification codes, and a do-not-send entry from a bounce. Old internal versions expire within 1 hour. What remains:
- the abuse counters (a hash of your address, deleted within 48 hours);
- the sending log (no content, 30 days);
- the do-not-send entry if you reported our email as spam: it records your objection and holds no readable address;
- copies held by Lettermint until its periods end (we can ask it to delete earlier);
- copies outside our system (our mailbox, a Cal.com booking), which we delete by hand when you ask;
- emails already delivered to your inbox.
Browser storage. The chat stores a session token in your browser tab (sessionStorage, not a cookie), cleared when you close the tab. No other cookie than the language cookie described below.
Wherever you are
We offer the chat to visitors in many countries. We apply the same protections to everyone, based on the European GDPR, one of the strictest data-protection laws.
- Where your data is processed: in the European Union (France, Belgium, the Netherlands) and, if you book a call, in the United States (Cal.com). Newsletter emails: United States (Buttondown).
- Your rights: the rights under “Your rights” apply to you wherever you live. We reply within one month, or sooner if your local law requires it. You can also complain to the data-protection authority of your country.
Cookies and analytics
This site uses no analytics or advertising trackers. The homepage opens automatically in your browser's language (English, French or Spanish). If you choose a language with the EN | FR | ES switcher, that choice is remembered in a single functional cookie, adp_lang, kept for 1 year and used for nothing else. A preference cookie you trigger yourself needs no consent, which is why you see no cookie banner. Fonts are hosted on our own server, so your browser contacts no third-party service when displaying our pages.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format; you can also withdraw your consent at any time. Write to privacy@avapmo.com: we reply within one month, or sooner if your local law requires it. If you believe your rights are not respected, you can complain to the French data protection authority, the CNIL (cnil.fr), or to the data-protection authority of your country.
The French version of this page is the legally binding one: version française.