Privacy notice

1. Who is responsible for your information

AVO Oro Verde S.A.P.I. de C.V., Andrés Bello 10, Polanco IV Sección, 11560 Ciudad de México, México, is responsible for the Avo investor relationship and decides the purposes for which your information is processed.

Asymmetrica Investments AG, in Switzerland, operates the technical and data platform for Avo App on behalf of AVO Oro Verde. It processes information on our instructions and does not offer the investment.

For any question about this notice, or to exercise your rights, write to info@sustainable-avo.com.

2. What this notice covers

It covers the public website at sustainable-avo.com and Avo App, which is available as a web application at app.sustainable-avo.com and as an application for iOS.

Anyone may read this website from anywhere. Investment access through Avo App is currently available in Mexico only. Reading this website does not mean you can invest, and a payout bank account held in another supported country does not make investment access available outside Mexico.

3. Information we collect

On this website we collect only what you choose to send us, such as your name, email, and message when you contact us or request a briefing.

In Avo App we collect the following, as applicable to you:

• Account and contact information: first and last name, email address, an optional phone number, country, an optional profile image, and an account identifier.
• Investor declaration: full name, date of birth, residential address, source of funds and related details, an eligibility indicator, your privacy consent, and a signature image.
• Identity verification: government identification, proof of address, and, where you supply them, proof of eligibility and evidence of source of funds. We also record the verification session and its status, the document type and issuing country, and the result flags for liveness and face match.
• Financial and account records: investment requests, deposits, payments, and, where applicable, loan records; transfer proof documentation; the payout account holder, IBAN, SWIFT or BIC, bank country, and bank and currency information; and your account statements and documents.
• Support and security: your support messages, notifications, sign-in and security logs, and compliance and audit logs.

4. Identity verification

Identity verification is carried out through Didit, using a hosted verification flow. We receive the outcome of that check, together with the document type, the issuing country, and the liveness and face-match result flags.

To prevent one person from opening duplicate accounts, we derive a one-way fingerprint from your identity document. The document number used to derive it exists only transiently in server memory during the check and is not stored. Only the derived fingerprint is kept, and it cannot be read back as the original number.

5. Financial and investment information

When you use Avo App to request an investment, to report a transfer, or to give us the account your payments should go to, we process the records described above so that we can identify the request, match a bank transfer to it, keep your account records, and meet the compliance obligations that apply to us.

Funding happens by bank transfer. Avo App does not take card payment and does not sell digital goods or subscriptions, so no payment card details are collected in the application.

6. How we use information

We use your information to:

• open and administer your account, and let you sign in;
• carry out identity verification and the compliance checks that apply to us;
• record and administer investment requests, transfers, payments, and account documents;
• produce your statements and other account records;
• reply to you, provide support, and send service notifications about your account;
• detect and prevent fraud, duplicate accounts, and misuse, and keep the security and audit records that protect your account; and
• meet our legal, regulatory, accounting, and record-keeping obligations, and to establish, exercise, or defend legal claims.

7. Service providers acting on our behalf

We do not sell your personal information. We share it only with the providers that operate parts of the service for us, and only so far as they need it:

• Asymmetrica Investments AG, Switzerland, which operates the technical and data platform on our behalf.
• Supabase, which provides authentication, database, file storage, and server functions. The data region established from our infrastructure is Ireland (AWS eu-west-1).
• Didit, which provides identity and document verification through a hosted flow. Its processing region is not established from our current records.
• Resend, which delivers transactional email such as sign-in and account messages. Its processing region is not established from our current records.
• Google and Apple, only if you choose to sign in with a Google or Apple account. In that case the sign-in provider confirms your identity to us.

Parts of the application also call public reference services, for example to display currency information. We may share information with professional advisers, auditors, or authorities where the law requires it.

8. International processing

AVO Oro Verde is established in Mexico. The technical platform is operated from Switzerland, and the database, file storage, and server functions run in Ireland. Some of our other providers may process information outside Mexico.

Where information is processed outside Mexico, we require our providers to process it only on our instructions and only for the purposes described here.

9. Security

Information is transmitted over encrypted connections (TLS) and is encrypted at rest by the infrastructure we use. Uploaded documents are held in private storage, and access to records is restricted at the row level so an account can reach only its own data.

On iOS, your session is held in the device Keychain, and you can turn on a biometric lock for the application.

No system can be free of risk, and we do not claim any certification for the application. If you believe your account has been accessed without your permission, write to info@sustainable-avo.com.

10. Retention and account deletion

Personal data and records are retained only for as long as necessary for the applicable legal, contractual, compliance, tax, fraud-prevention, security, or dispute-resolution purpose. When retention is no longer required, the data is deleted, anonymized, or otherwise suppressed as applicable.

You can start Delete Account from inside Avo App while signed in. When you do, your sign-in and account access are permanently disabled, your authentication account is closed, your profile image is deleted, convenience notifications are removed, and account-specific state stored on your device is cleared.

Identity, verification, financial, transaction, security, and compliance records may remain, with access blocked, where we are required to keep them. They are suppressed once that requirement ends.

11. Your rights

You may ask us for access to your personal information, for its rectification when it is inaccurate or incomplete, for its cancellation or deletion where that applies, and you may oppose its use for a particular purpose. You may also ask us for information about how we handle it, and you may withdraw a consent you have given, without affecting what was done before you withdrew it.

Avo App also has an Export My Data function, which gives you a copy of your account information from inside the application.

To make a request, write to info@sustainable-avo.com from the email address on your account, or contact us at the postal address above. We may need to confirm your identity before we act, so that we do not disclose your information to someone else. If you are not satisfied with our answer, you may raise the matter with the competent authority in your jurisdiction.

12. Tracking, analytics, and advertising

We do not run advertising, and we do not track you across other apps or websites.

This website loads no analytics and contacts no third-party host: the video is hosted by us and the typeface is your device's own. The only storage it uses is what it needs to work, such as remembering that you have seen the data notice. If we ever introduce privacy-respecting analytics, we will update this notice and ask for your consent first, off by default until you opt in.

The iOS application contains no advertising software, no advertising identifier, no cross-app tracking, no third-party analytics software, and no crash-reporting software. It does not collect your location, your contacts, or health information, and it does not use in-app purchases.

13. Investor access is for adults

Investment access through Avo App is for people who are at least 18 years old. The application checks the date of birth you give and enforces that requirement on our servers as well.

The application is not directed to children, and we do not knowingly collect information from them. If you believe a child has given us information, write to info@sustainable-avo.com and we will remove it.

14. Changes to this notice

If we change how we handle personal information, we will update this page and change the date at the top. Where a change is significant, we will tell account holders through the application or by email.

15. How to contact us

AVO Oro Verde S.A.P.I. de C.V., Andrés Bello 10, Polanco IV Sección, 11560 Ciudad de México, México.

Email info@sustainable-avo.com. Phone (Switzerland) (+41) 76 218 63 15.