Privacy Policy

01 Who this policy covers

• Our customers — the organisations that subscribe to Alvora, and their staff who log in to it.
• People whose details our customers store in Alvora — for example a customer's employees, job applicants, sales leads and contacts.
• People who contact a customer through channels connected to Alvora, such as email or WhatsApp.

For data a customer puts into Alvora, the customer decides why and how it is used, and we process it on the customer's behalf and on its instructions.

02 What data we handle

• Account details: name, work email, phone number, role and login activity of people who use Alvora.
• HR and attendance data entered by a customer: for example employee records, leave, attendance, and — where the customer turns it on — check-in photos and location at the time of check-in.
• Sales and contact data: leads, contacts, organisations, notes, tasks, and the emails and WhatsApp messages connected to them.
• Messages: emails received in a mailbox a customer connects, and WhatsApp messages sent to or from a WhatsApp Business number a customer connects, including messages that a customer's own staff forward to that number.
• Technical data: logs needed to run and secure the service, such as IP address, browser type and error records.

03 Why we use it

• To provide the service the customer has asked for: for example to record a lead, assign a follow-up task, send a reminder, or send a summary report.
• To keep the service secure, prevent misuse and fix problems.
• To meet legal obligations.

We do not sell personal data, and we do not use it for advertising.

04 WhatsApp

When a customer connects its WhatsApp Business number to Alvora, messages to and from that number pass through Meta's WhatsApp Business Platform and are stored in the customer's Alvora account so that its staff can see them alongside the related lead or contact. A customer can choose which of its staff numbers may forward messages into Alvora to create leads. Alvora sends WhatsApp messages only for the purposes the customer sets up, such as replies to a contact or business summaries to the customer's own management.

05 Use of AI

Where a customer turns it on, Alvora uses an AI service (Anthropic) to read incoming enquiries — emails, or WhatsApp messages forwarded by the customer's own staff — and decide whether they are a sales lead, and to draft the lead's details. Where switched on, it may also look up publicly available business information such as a company's website and official address. The AI's output is a suggestion stored in the customer's account; unclear cases are sent to a person for review. The AI provider processes this data only to return the result and does not use it to train its models under its commercial terms.

06 Who we share data with

We share data only with service providers we need to run Alvora, and only for that purpose:

• Hosting and infrastructure providers (servers and backups).
• Meta (WhatsApp Business Platform), when a customer connects WhatsApp.
• Email providers used to send and receive email for a customer (for example Google or Brevo).
• Anthropic, for the AI features described in section 5, when switched on.

We may also disclose data where the law requires it.

07 Where data is stored

Alvora's data is stored on servers located in [country — to be confirmed]. Some service providers listed above may process data in other countries, with safeguards required by applicable law.

08 How long we keep it

We keep data for as long as the customer's subscription is active, or as the customer's own retention settings and legal duties require. Some data has shorter limits, for example check-in location details. When a customer leaves, its data is deleted after an agreed period, unless the law requires us to keep it longer.

09 Security

We protect data with access controls by role, encrypted connections (HTTPS), encrypted storage of secrets, separation between customers' accounts, logs and backups.

10 Your rights

Depending on the law that applies to you, including India's Digital Personal Data Protection Act, 2023, you may ask to access, correct or erase your personal data, withdraw consent where consent was the basis, and raise a grievance. If your data is held by one of our customers (for example your employer, or a company you contacted), please contact that organisation first; we will help them respond. You can also write to us at the address below.

11 Contact and grievance officer

12 Changes to this policy

We may update this policy. The effective date at the top shows when it last changed. Important changes will be notified to customers.