Skip to main content

Legal

Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains how Alfred (“Alfred”, “we”, “us”) collects, uses, shares, and protects information when you use our website, dashboard, APIs, and related services (the “Service”). By using the Service, you agree to the practices described here.

1. Roles

  • Customer data. When you operate a business on Alfred, you are the controller of your customer data and we are the processor. Our handling of that data is governed by our Data Processing Addendum (DPA). Alfred is not currently a HIPAA business associate and does not sign BAAs, so please do not upload protected health information (PHI).
  • Account data. For your own account information (your name, email, billing details), we are the controller and this Privacy Policy applies.

2. Information we collect

  • Account information you provide on signup (name, email, clinic name, role, password hash).
  • Billing information handled by Stripe; we receive only the last four digits, brand, and expiration of payment methods.
  • Customer data you upload or sync (customer contacts, appointments, message history). Please do not include PHI.
  • Connected platform data. If your account connected an advertising or messaging platform before we retired those connections (for example Facebook Lead Ads, Messenger, or Instagram), we hold the leads and messages it delivered — the contact details and form answers your own ad or form collected — and use them solely to populate your contact list and run your follow-ups. New connections are no longer offered. You can disconnect an existing one and request deletion at any time (see § 8).
  • Usage data: pages viewed, features clicked, follow-up activations, AI request counts.
  • Device and log data: IP address, browser type, OS, referrer, timestamps. Used for security, debugging, and abuse prevention.
  • Portal visit data. When someone opens a business’s Alfred portal, we record the kind of device, the language the browser is set to, the page that sent them, and an approximate location (country, region and city) that our hosting provider derives from the connection. We do not store the visitor’s IP address with this data. The business sees it only as totals on its Analytics screen.
  • Cookies and similar technologies as described in § 7 below.

3. How we use information

  • Provide, maintain, and improve the Service.
  • Authenticate users and enforce access controls.
  • Send transactional messages (account, billing, security, service updates).
  • Detect, investigate, and prevent fraud, abuse, and security incidents.
  • Comply with legal obligations and respond to lawful requests.
  • Aggregate and de-identify data to produce benchmarks and product analytics. De-identified data does not include PHI.

We do not sell personal information. We do not use your customer data or PHI to train AI models.

4. How we share information

  • Subprocessors. We share data with the subprocessors we use (Supabase, Vercel, Resend, Anthropic, Sentry, Stripe). Each is bound by contract to use data only as we direct.
  • At your direction. We share data with third-party integrations you connect (e.g., your EHR webhook, your booking provider).
  • Legal compliance. We may disclose information when required by law, subpoena, or to protect rights, safety, and property.
  • Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred subject to this Policy.

5. Retention

We retain account and customer data for the duration of your subscription plus a 90-day grace period for export. After that, we delete or de-identify it within 30 days, except where law requires longer retention. Audit logs of approvals and access are kept for the life of your account.

6. Security

We use industry-standard administrative, physical, and technical safeguards including TLS 1.2+ in transit, AES-256 at rest, role-based access, MFA, and encrypted backups. No system is perfectly secure; we cannot guarantee absolute security but commit to prompt notification in the event of a breach.

7. Cookies

We use first-party cookies for authentication and session management, and limited analytics cookies (PostHog) to understand product usage. We do not use third-party advertising cookies. You can clear cookies in your browser at any time; doing so will sign you out.

8. Your rights

Depending on your location, you may have the following rights:

  • Access the personal information we hold about you.
  • Correct inaccurate information.
  • Delete your information, subject to legal retention obligations.
  • Port your data in a structured, machine-readable format.
  • Object to or restrict certain processing.
  • Withdraw consent where processing relies on consent.

California residents (CCPA/CPRA) have additional rights including the right to know, the right to delete, the right to correct, and the right to limit use of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising.

EU/UK residents (GDPR/UK GDPR) may lodge a complaint with their supervisory authority. Our lawful bases for processing are contract performance, legitimate interests, and where applicable, consent.

To exercise any right, email hello@alfred-intelligence.com. We respond within 30 days.

Facebook & Instagram (Meta) data deletion

When a business connects its Facebook Page or Instagram account to Alfred, we store the connection (an access token, the Page/Instagram identifiers) and any leads and messages captured from that Page’s Facebook Lead Ads, Messenger, and Instagram conversations, on that business’s behalf. To delete that data you can:

  • Disconnect the integration in Alfred under Settings → Integrations. This immediately revokes Alfred’s access to your Page and removes the stored connection and access tokens.
  • Request deletion of captured leads/messages by emailing hello@alfred-intelligence.com from, or identifying, the connected account or Page. We delete the associated data within 30 days, except where law requires longer retention.
  • You can also remove Alfred from your Facebook account at any time under Settings & Privacy → Settings → Business Integrations, which revokes our access to your Page.

9. International transfers

We process data in the United States. Where data is transferred from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses and equivalent mechanisms.

10. Children

The Service is intended for business operators (18+). We do not knowingly collect personal information from children under 13. Pediatric data is not intended to be uploaded; see the note on PHI above.

11. Changes to this policy

We may update this Policy from time to time. Material changes will be announced in the dashboard and by email at least 14 days before they take effect.

12. Contact

Alfred
Email: hello@alfred-intelligence.com