Last updated: November 12, 2026
This policy explains what personal data OpenAVC LLC collects, why we collect it, and how we handle it. If you have questions, email info@openavc.com or write to us at the address at the bottom of this page.
OpenAVC LLC is a North Carolina limited liability company. We make OpenAVC, an open-source AV control platform, and operate OpenAVC Cloud, a hosted service for managing OpenAVC installations.
This policy applies to:
OpenAVC software running on your own hardware sends nothing to us on its own. It sends us data only when you pair it with OpenAVC Cloud, or when someone presses Send to OpenAVC on a problem report or a device audit, described below. Apart from the QR scanner in the Android panel app, also described below, the open-source software itself collects nothing.
The OpenAVC Panel app talks only to the OpenAVC system it is paired with, on your own network, and sends nothing to us. The Android version reads pairing QR codes with Google's ML Kit, which sends Google diagnostic and usage information: the tablet's model and Android version, the app's name and version, an identifier for that installation of the app, and how the scanner ran (settings, timings and error codes). Google describes this in its ML Kit data disclosure. The iOS version sends nothing.
openavc.com and docs.openavc.com do not use analytics, advertising trackers, or third-party cookies. The only form on these sites is the newsletter signup described under Email below. Our hosting providers keep short-lived server logs (IP address, user agent, request path) for abuse prevention and reliability.
academy.openavc.com is our training site. It runs on Moodle on a server we operate. Creating an account takes your first and last name, your email address, and a username and password you choose. As you work through a course the site records your progress, your quiz and assignment results, and any certificate you earn.
The staff who run the training can see that record. Other learners cannot. The site sets a session cookie so you stay signed in, and uses no analytics or advertising trackers. Email from the Academy is limited to running the courses, such as confirming your account or resetting your password. An Academy account is separate from a cloud account, and neither one creates the other.
When you create or use a cloud account, we collect:
We use this data to authenticate you, run your account, send transactional email, and provide customer support. Authentication tokens are stored in your browser's localStorage for the duration of your session.
Payments are processed by Stripe. Card numbers and other payment credentials go directly to Stripe and never reach our servers. We store the Stripe customer ID, your plan, subscription status, and invoice metadata so we can manage your subscription and show your billing history. See Stripe's privacy policy.
When you pair an OpenAVC system to your cloud account, it sends us data so we can show it to you in the portal, send alerts, keep backups, and provide support:
The project file is also read from the system when someone in your account captures a template from it or uses the AI assistant, and during a support session you grant (described below).
On OpenAVC 0.40.0 and later, the passwords and other logins for your devices stay on the system, and the project copies it sends us hold a placeholder in place of each one. A system on an earlier version includes them in the copies it sends until it is updated. One exception on 0.40.0: a stream key, password or PIN typed into a macro step or a button's action is saved in the project, so the copies include it. Every project copy we store is encrypted, and older copies are deleted on the schedule below.
Most of this is operational data about AV equipment, not personal data about people. We treat it as your confidential business data and don't share it outside OpenAVC LLC except as described in this policy.
When someone in your account opens a system remotely from the portal, we record who opened it, when, for how long, and how much data passed through. Each system's page shows its recent sessions.
OpenAVC staff reach one of your systems only during a support session that someone in your account grants from the portal, for one named system and support request, for one, four, or twenty-four hours. You can end it at any time. Every action staff take during it is recorded and shown in your portal. Our staff's sign-ins, the changes they make, and each time they open your account's data in our own tools are recorded in our staff audit log.
The OpenAVC Programmer offers Report a problem on a device's page, and Send to OpenAVC at the end of a device audit. Pressing Send sends that one report to us, whether or not the system is paired. Nothing is sent on a schedule, when an error happens, or without that press. Download keeps the report on your own computer instead.
A problem report holds:
A device audit holds the same kinds of information about the one device being tested, plus what that device announced on the network, and the name, company, email address, and notes you enter, all optional. Either kind leaves out the device's serial number when you tick Leave the serial number out of the report. Neither holds anything about your other devices, the rest of your project, or OpenAVC's own settings.
Only OpenAVC staff read reports, to fix drivers and answer support questions. A system paired to a cloud account signs its report, so we can see which system and account sent it. We keep the IP address a report came from for 30 days, to prevent abuse. A report is kept for twelve months and then deleted. To have one deleted sooner, email support@openavc.com with its reference, such as R-7K3QXM.
OpenAVC Cloud includes an optional AI assistant powered by Anthropic's Claude API. When you use it, your messages and the project context needed to answer them (devices and their addresses, macros, UI pages, scripts, variables, plugin state) are sent to Anthropic for processing, along with whatever is read from or done on your system while answering, such as device states and recent log lines. On OpenAVC 0.40.0 and later, the device logins saved on the system are never read or sent. Anthropic does not use this to train its models, and deletes it within 30 days unless it must keep it longer to enforce its usage policy or to comply with the law. See Anthropic's privacy policy.
We store each conversation so you can come back to it: your messages, the assistant's replies, and what was read from and changed on your system to answer them. Anything typed into a conversation, a password included, is stored with it. A conversation is kept until someone deletes it from the AI Assistant's conversation list in the Programmer, or the account is deleted. We also record the tokens and cost of each request, for billing and usage limits. The assistant is opt-in. If you don't use it, no project data is sent to Anthropic.
Transactional email (verification, password reset, team invitations, alert notifications, support replies) is sent through Postmark. If no system has been paired 48 hours after you create a cloud account, we send one email about getting started. Alerts you send to a webhook go to the address you enter, with the alert's details. We don't send marketing email without separate consent. See Postmark's privacy policy.
Our newsletter is separate and runs on Kit. Subscribing takes your email address and nothing else, and it always requires you to confirm from a link we email you, so you are never added by someone entering your address. We use it for release notes and occasional project news. Creating an OpenAVC Cloud account offers you the newsletter on the signup form, and you can clear that box; either way nothing is sent until you confirm from the link. Every message has an unsubscribe link, and unsubscribing removes your address from the list. See Kit's privacy policy.
We rely on the following third parties to operate the service:
Your account, its people, and its settings are kept while the account is open, except as listed here.
You can export your data, and close or delete your account, yourself from the portal. You can also request access to your personal data, correction of inaccurate data, deletion of your account, or an export of your data by emailing info@openavc.com. We don't sell personal data and we don't share it for cross-context behavioral advertising.
If you are in the European Union, the United Kingdom, or California, you have additional rights under the GDPR, UK GDPR, or CCPA. The same email address handles those requests.
Passwords are stored as bcrypt hashes. Traffic between your browser, paired OpenAVC instances, and our servers is encrypted with TLS. Paired instances authenticate using HMAC signatures with a per-instance key established during pairing. Project copies and webhook signing secrets are stored encrypted. No system is perfectly secure, but we work to follow current best practices.
How OpenAVC Cloud is hosted and secured, in more detail: OpenAVC Cloud Security and Data Handling and AI Assistant: What Is Sent and Kept.
OpenAVC is a professional AV product and is not directed at children under 16. We don't knowingly collect personal data from children.
If we change this policy in a way that affects how we handle your personal data, we'll update the "Last updated" date and email account holders for material changes.
Email: info@openavc.com
Mail: OpenAVC LLC, PO Box 1055, Lillington, NC 27546, USA