Privacy Policy

Effective Date: November 1, 2026

Last Updated: November 1, 2026

Avani Inc, located at 700 N Brand Blvd, Suite 830, Glendale, CA 91203 (“Avani” "Company," "we," "us," or "our") provides AVANI Software and AVANI PAY (the "Platform" or "Services"), an all-in-one business management platform for independent salons and wellness businesses, including scheduling, payments and point of sale, reporting, client relationship management (CRM), loyalty and referral programs, and automated marketing tools.

This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Platform. It applies to two groups of individuals:

• Business Users — “Business Users” are salon and wellness business owners, staff, and administrators who create accounts, manage their business, and use Avani’s tools ("you," when referring to Business Users).
• End Clients — the customers, patients, or clients of our Business Users, whose information is collected through booking, point-of-sale, loyalty, and marketing features in the AVANI software ("End Clients" or “End Users”).

Business Users have role-based access: Super Admins (who could be owners or managers) configure and run the Avani Platform to run the business. Employees such as stylists, therapists, and/or staff will have limited access to their own schedules, transactions or pay and/or performance.

End Users (who are the customers of the Business Users) never use the Avani Platform directly. The End Users are access the Avani Platform through: a) a Business Subdomain or b) a Business Embedded Overlay.

Business Subdomain – Avani Platform hosts a website or booking page where the address has a form (xxxxx.avanisoftware.com). With this subdomain, a client can create an authenticated account (e.g., sign up and sign in) and self-serve (do such activities, such as book appointments, consent to notifications, manage saved payment cards, make payments, and view loyalty points and referral codes). The business user configures its own subdomain inside Avani on a website builder where the business user can select themes, fonts, imagery, About content, SEO keywords, etc.) and then publish the subdomain. The subdomain is hosted on Avani infrastructure.

Embedded Overlay – This is utilized for businesses that already have a website and don’t use Avani’s website business tool, the Avani business overlay can be embedded on the business’s existing web site by including a guest flow. In this case, this is a guest flow where a customer books activities by providing a customer account without creating a login.

With the Business Subdomain and Embedded Overlay, any entered client information results in a CRM contact record held or associated for the business. With the Business Subdomain, an authenticated subdomain account is linked to that CRM contact record. A guest overlay booking creates or matches a CRM contact record without an account.

Avani processes the customer data of end users who are end customers of the businesses in order to provide the Avani Platform to businesses.

Authorizing Directory

Where a Business User uploads, collects, or manages End Client information through the Avani Platform, the Business User is generally the data controller of that information, and AVANI acts as a service provider/processor on their behalf, as described further in Section 8 below.

Please read this Privacy Policy carefully. By accessing or using the Avani Platform, you agree to the practices described here. If you do not agree, please do not use the Platform.

1. Information We Collect

1.1 Information from Business Users

When you create an account or use the Avani Platform, we may collect:

• Account and identity information: name, business name, email addresses, phone numbers, mailing addresses, role assignment, username, and password.
• Business information and profile: business type, business name, address, contact details, logo, operating hours, staff roster and specialties, services offered (e.g., service catalog and pricing, commission rates; customer support information; and location(s).
• Billing and payment information: billing address and limited payment details necessary to process your subscription fees (full card data is handled by our third-party payment processor, described in Section 4).
• Usage data: log data, device information, IP address, browser type, pages viewed, and actions taken within the Avani Platform.

1.2 Information About End Clients

Through features Business Users use to run their operations, the Platform may collect the following about End Client Users:

• Contact and identity information: full name, email address, phone number, and date of birth.
• Appointment and visit information: appointments, services booking history, appointment preferences, cancellations, no-shows, service notes and preferences, and staff assignments.
• Loyalty and referral information: points balances, rewards activity, referral codes, and referral activity.
• Marketing preferences and engagement: email/SMS opt-in status, campaign engagement (opens, clicks), and communication preferences.
• Payment and transaction information: saved payment cards are tokenized and are not stored within the Avani platform or servers. Instead, the saved payment cards are handled and/or stored by third-party payment processor, described in Section 4. Avani retail transaction amounts, purchase history, and payment status and also meta data such as last four digits, card type and expiration date for display and reconciliation.

1.3 Information Collected Automatically

When you or an End Client uses the Avani Platform, specific software programs, or client-facing pages, we and our service providers may automatically collect information using cookies, pixels, SDKs, and similar technologies, including device identifiers, IP address, browser and operating system information, referring URLs, and interaction data.

See also Section 9 (Cookies and Tracking Technologies) for more detail.

1.4 Information from Other Sources

We may receive information from:

• Third-party payment processors (e.g., transaction confirmations, fraud/risk signals), which for the Avani platform is Dejavoo; and
• Publicly available sources.

2. How We Use Information

Avani uses the information described above to:

• Provide, maintain, and improve the Avani Platform, including scheduling, payments, point of sale, reporting, and CRM features;
• Create and manage Business User accounts and process subscription billing for Business User;
• Process payments and transactions on behalf of Business Users through our third-party payment processor(s);
• Operate loyalty and referral programs, including tracking points, rewards, and referral activity;
• Send automated marketing communications (such as appointment reminders, promotional offers, and re-engagement campaigns) on behalf of Business Users to their End Clients, if the End-Client has consented to such marketing communications and the Business User has instructed Avani to send specific types of messages.
• Generate reports and analytics for Business Users about their operations;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Communicate with Business Users about their accounts, updates, and support requests;
• Comply with legal obligations, enforce our terms, and protect our rights and the rights of others; and
• Develop and improve new features, subject to the limitations in Section 6 regarding de-identified or aggregated data.

We do not use End Client information collected on behalf of a Business User for our own independent marketing purposes beyond operating and improving the Platform, unless we have a separate, direct relationship with that individual or are otherwise permitted by contract and law.

3. Automated Marketing Features

The Avani Platform allows Business Users to send automated marketing messages (such as email and SMS campaigns, appointment reminders, and promotional offers) to their End Clients. The Avani Platform utilizes:

SMS (via Twilio) and email (via SendGrid) for transaction purposes such as booking confirmations, reminders, receipts, account and invitation emails) and for marketing (e.g., marketing campaigns, referral invoices and review request). Phase 1 Marketing Information includes client segmentation and saved lists, one-time campaigns from templates, and scheduled recurring programs. The scheduled recurring programs may include birthday greetings, wind-back or rescues lost clients, reminders to book slow-day and last-minute fill campaigns), plus campaign performance attributions. Review data includes request requests but does not collect or store review text in Phase 1.

An End-User has the following rights with regard to marketing communications:

• Consent - End-User Clients consent to receive SMS and/or email notifications. For authenticated clients, such as business subdomain client, consent is captured during the client intake on the business subdomain. For guest bookings, consent is captured during the End User services booking workflow. Consent status will be stored with or associated with the End-User Client CRM Record.
• Opt-Out – The Avani Platform marketing SMS and email communication systems include opt-out and unsubscribe mechanisms. The Avani Platform marketing campaign commissions are logged in order to allow for audits. Currently, the Avani Platform only allows for outbound marketing messaging. and
• Ensuring the content of marketing communications complies with applicable law.

Business Users are 1) independently responsible for their marketing practices and compliance with applicable communications laws; and 2) ensuring the content of marketing communications complies with applicable law.

4. Third-Party Payment Processing

We use a third-party payment processor (the "Payment Processor(s)") to process payments and point-of-sale transactions on the Avani Platform. The Avani Platform enables you to accept payments from your End Clients using point-of-sale and online payment functionality. All payment processing is performed by one or more independent third-party payment processors (each, a “Payment Processor”) that interact with each other to create a payment processing system for the Avani Platform

The Payment Processors process payment transactions and hold tokenized cardholder data. Payments are received through AVANI Pay which is powered by the Dejavoo’s white-labeled -gateway and utilizes Dejavoo-certified terminals for in-person transactions. The Payment Processors include Dejavoo, DeNovo, Tememos, FiServ, and Maverick

Full payment card information (such as card numbers, expiration dates, and CVV codes) is collected and processed directly by our Payment Processor(s). The Avani Platform does not store full payment card information. Only tokenized or truncated data is utilized as necessary to facilitate transactions. The Payment Processor’s Gateway stores End-User Client full payment card information and this is tokenized. The Payment Processor’s Gateway is PCI DSS-compliant for these transactions.

As noted above, Avani does not itself hold, transmit, or take custody of funds. Dejavoo and Denovo provide the payment terms and the Gateway software for Business Users to physically charge and transmit payment information to Tememos and FiServ. Tenemos and FiServ authorize transactions, and settles fund between the Business User and End User Clients. Maverick provides underwriting and onboarding, risk, and compliance monitoring for Business Users and their End User Clients. Maverick also provides fraud and chargeback tools, and analytics.

Use of payment processing features is also subject to the applicable Payment Processor's own privacy policy and terms of service.

The Avani Platform may receive limited transaction metadata from the Payment Processor (such as transaction status, amount, and risk indicators) to provide reporting and reconciliation features within the Platform.

5. How We Share Information

We may share information as follows:

• With Business Users: End Client information collected through a Business User's account is made available to that Business User (and their authorized staff) to operate their business.
• Service providers: We share information with third-parties who perform services on our behalf, such as payment processing, hosting, email/SMS delivery, analytics, and customer support.
• Integrations: If a Business User connects a third-party application or integration, information may be shared with that third party as directed by the Business User. This is the responsibility of the Business User and Avani does not take responsibility of decisions or third-parties that Business User selects.
• Business transfers: In connection with a merger, acquisition, or sale of assets, information may be transferred to the acquiring party as part of that transaction.
• Legal and safety reasons: We may disclose information to comply with applicable law, respond to legal process, or protect the rights, property, or safety of Avani, our Business Users, End Client, or others.
• With consent: Avani may share information for other purposes with your consent.

We do not sell personal information for money. As described in Section 7, some sharing for advertising or analytics purposes (for example, via cookies) may be considered a "sale" or "share" under certain state privacy laws, and we provide opt-out mechanisms accordingly.

6. De-Identified and Aggregated Data

Avani may create de-identified or aggregated data from personal information (for example, aggregate booking trends or benchmarking reports). We maintain such data in a de-identified form and do not attempt to re-identify it, unless we are asked to do this and/or we are required to by law.

7. Your Privacy Rights (U.S. State Law Disclosures)

Depending on your state of residence, you may have rights under applicable U.S. state privacy laws (such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and similar laws in other states). Avani is initially selling its products and services and California consumers will have CCPA/CCRA. These rights may include the right to:

• Know/Access: Request information about the categories and specific pieces of personal information we have collected about you, and the sources, purposes, and third parties involved.
• Delete: Request deletion of personal information we have collected about you, subject to certain exceptions.
• Correct: Request correction of inaccurate personal information.
• Opt-out of sale/sharing: Opt out of the "sale" or "sharing" of personal information (including for cross-context behavioral advertising), to the extent applicable.
• Limit use of sensitive personal information: Where applicable, limit the use or disclosure of sensitive personal information to what is necessary to provide the Services.
• Non-discrimination: We will not discriminate against you for exercising these rights.
• Appeal: In certain states, you may have the right to appeal a decision regarding your request.

How to exercise your rights: You may submit a request by emailing support@avanisoftware.com or through http://www.avanisoftware.com/contact-support. We will verify your identity through a number of authentications means before processing your data request, as required by law. You may also designate an authorized agent to submit a data request on your behalf. You will need to provide proof that the authorized agent is acting under your guidance.

8. Our Role as a Service Provider

With respect to End Client personal information that Business Users collect and manage through the Platform, we act as a service provider (or similar designation under applicable state law). This means:

• We process such information only for the purposes of providing the Platform and performing services on behalf of the Business User, as instructed;
• We do not use such information for our own independent marketing purposes; and
• We do not sell such information.

Business Users are responsible for ensuring they have the appropriate legal basis, notices, and consents needed to collect and share their End Clients' personal information through the Platform.

9. Cookies and Tracking Technologies

We and our service providers use cookies, web beacons, SDKs, and similar technologies to operate the Platform, remember preferences, analyze usage, and, in some cases, support advertising. You can manage cookie preferences through your browser settings. Depending on your state of residence, you may be able to opt out of certain tracking used for cross-context behavioral advertising through [Insert cookie management tool/link, e.g., a cookie banner or preference center, if applicable].

10. Data Retention

We retain personal information for as long as necessary to provide the Platform, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of data and the purpose for which it was collected. Business Users may also configure certain retention or deletion settings within their account, subject to the Platform's capabilities. Avani will store your personal information collected from the End User and the Business Users for the life of the account plus an additional period to make sure that the End User / Business User did not make a mistake or wants to re-enroll. If a Business User leaves the Avani Platform, Avani will delete the Business User’s information and the associated End User Information described above within six months after the Business User requests removal from the Avani Platform.

11. Data Security

Avani implements administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Children's Privacy

The Avani Platform is not directed to children or young adults under 18, and we do not knowingly collect personal information from children or young adults under 18 through Business User accounts. If we become aware that we have inadvertently collected personal information from a child or young adult under 18 without appropriate consent, we will take steps to delete it. Business Users should not use the Avani Platform to knowingly collect information about children under 18 without appropriate parental consent, where applicable.

13. Third-Party Links and Integrations

The Avani Platform may contain links to, or integrations with, third-party websites, applications, or services (including the Payment Processor(s) described in Section 4). This Privacy Policy does not apply to those third parties, and we encourage you to review their privacy policies.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify Business Users (for example, by email or an in-Platform notice) and update the "Last Updated" date above. Your continued use of the Avani Platform after changes become effective constitutes acceptance of the revised policy.

15. Contact Us

If you have questions or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Avani, Inc.

700 N BRAND BLVD.

STE 830

GLENDALE, CA 91203

support@avanisoftware.com