Privacy Policy — Due
Ava Research LLC · Last updated: October 14, 2026
This policy covers Due (the "Service"), a connector that helps a small business keep track of invoices and draft follow-up messages through Muse. The defining rule of the Service: Due drafts; the owner sends. Due prepares message drafts for the owner to review — it never sends anything to anyone, ever.
What we store, and why
-
Account ID: an internal ID from your sign-in, used to keep your data separate from everyone else's. Sign-in is handled by Microsoft Entra External ID with a one-time code sent to your email — there is no password, and it asks for nothing but your email address. The Service itself never stores your email address.
-
Invoices you provide: only the fields you give — client name, amount, issue and due dates, and payment terms you state. If you don't state a due date, we record that fact instead of guessing one.
-
Clients: the client names and details you add, so invoices can be grouped per client.
-
Follow-up drafts: the draft messages Due prepares for you, and the tone setting you choose.
-
Technical logs: request type, outcome, and timing. Logs never contain invoice contents, client details, or sign-in tokens.
What we don't collect
The Service only accepts the fields above. We don't ask for or store payment card or bank account numbers, government ID numbers, precise location, photos, or health information. Due doesn't process payments at all in this version.
How the drafts work
Drafts are assembled from fixed templates using your invoice facts — there is no generative AI rewriting your words, and no third-party AI service involved at all. Every draft is shown to you for review; you edit it, and you send it yourself, outside the Service. There is no code path by which Due can send a message.
No third-party services
Due runs entirely on Ava Research's own infrastructure. There are no external data providers, no API keys, and no secrets — nothing leaves our systems to produce a draft.
Permissions Muse asks for
One permission, Due.ReadWrite: it lets Muse read and update your invoices, clients, and follow-up drafts on your behalf. That's all it can touch.
Whose data this is
The client names in your ledger are your business records. They are stored partitioned under your account, never enriched with outside data, never sold, and never used for advertising.
Who can see it
-
You, through your own account.
-
Meta's Muse, if you connect it, acting on your behalf with the permission above.
-
Service providers that host and run the Service (Microsoft Azure) and handle sign-in (Microsoft Entra External ID), bound by their own security and confidentiality commitments.
-
No one else. We don't sell, rent, or share your data with advertisers or data brokers.
Data retention
-
Invoices, clients, and drafts: kept until you delete them or your account.
-
Technical logs: 30 days.
Delete your data
Deletion is self-service — ask Muse directly, no email required. Ask Muse to delete your data, for example "Delete all my Due data." This permanently removes every invoice, every client record, every follow-up draft, and your voice setting for your account. This can't be undone.
Disconnect: remove Due from your connectors in Muse. Disconnecting stops Muse's access but doesn't delete your data — use the self-service deletion above first if you want it gone.
Children's privacy
The Service is not directed at children, and we don't knowingly collect information from anyone under 13.
Changes to this policy
If we make a material change, we'll update the date at the top of this page and, for significant changes, make a reasonable effort to notify active users.
Contact us
Ava Research LLC
privacy@avaresearchllc.com