Privacy Policy

• We collect what we need to run Alkovey, and we use it for that.
• We don’t sell personal information. We don’t use advertising cookies, analytics trackers or session recording.
• Information about your clients belongs to you. We only handle it to provide the service to you.
• Our data is stored in the United States (see section 6).
• You can export or delete your information yourself in Settings → Your data, or email hello@alkovey.com.

About you, as an Alkovey user:

• Account details: name, email address, password (stored only as a secure hash), job title and profile photo if you add them.
• Workspace details: business name, address, logo, tax numbers and settings you enter.
• Billing details: your plan and payment history. Stripe holds your card details. We never see your full card number.
• Security information: two-factor settings, sign-in codes (stored only in scrambled form, and they expire after 10 minutes), and IP addresses, used to limit repeated attempts and spot misuse.
• Messages you send us, for example support emails.

On our website, alkovey.com: if you join the launch list or use the contact form, we collect your name, email and anything you write in the message. If you send a feature idea, we also collect any optional details you add (phone, studio name, the kind of work you do) and the idea itself. With each form we keep the date it was sent and the wording you agreed to, as a record of your consent.

Content you put into Alkovey: clients and contacts, proposals, invoices, bookings, projects, files, comments, team chat and similar. This often includes personal information about your clients (names, emails, phone numbers, addresses).

From your clients, when they use your links: when a client views or responds to a proposal, invoice, approval, booking or upload link, we record what they submit (for example a signature name, comment, pinned note, booking details or uploaded file), when they did it and, for some actions, their IP address.

• To provide Alkovey: run your account and workspaces, show documents to your clients, and send the emails you ask us to send.
• To bill for subscriptions and send receipts and billing notices.
• To keep accounts secure: two-factor sign-in, rate limits and fraud prevention.
• To send service emails, such as sign-in links, security alerts, receipts and a weekly summary if you turn it on.
• To send the launch announcement and other news, only if you joined the launch list or otherwise said yes. Every one of those emails has an unsubscribe link, and we stop within 10 business days of you using it.
• To answer support requests and fix problems.
• To meet legal duties, such as keeping tax and billing records.

We won’t use your information for a new purpose without telling you and, where needed, asking for your consent.

When you add information about your clients, you decide what’s collected and why. We handle it on your behalf, only to provide Alkovey to you. We don’t contact your clients for our own purposes, and we don’t use their information for anything else. If one of your clients asks us about their information, we’ll refer them to you and help you respond.

We share information only with service providers who help us run Alkovey, and only what each one needs:

Each provider is bound by a contract to protect the information and use it only to provide its service to us. We may also share information if the law requires it (for example a valid court order), or as part of a sale or merger of the business, in which case this policy would continue to apply.

Our database and files are stored in the United States (Supabase, in the US East region), and the providers above collect, store or process information there for us. While it’s there, it’s protected by our contracts with those providers, but it may be accessible to courts, law enforcement and national security authorities in those countries under their laws.

You can ask for our written policies and practices about service providers outside Canada, or ask any question about how they collect, use, disclose or store your information, by contacting our privacy officer, Hristo Janeski, at hello@alkovey.com.

• We keep your account and workspace information while your account is open.
• When you delete your account in Settings → Your data, we delete its data right away, including the workspaces you own. Accounts closed by email request, or closed by us, are deleted within 30 days. Copies in backups are removed within 90 days.
• We keep billing and tax records for as long as the law requires (generally 6 years in Canada).
• Sign-in codes expire after 10 minutes and are cleared regularly. Security logs are kept for 12 months.
• Launch list emails are kept until you unsubscribe, or until 12 months after Alkovey opens, whichever is first.
• Feature ideas are kept for 2 years after the promotion ends, so we can show who sent an idea first. Contact form messages are kept for 2 years.

• All connections use encryption (HTTPS).
• Each workspace’s data is separated, and database rules check access on every request.
• Two-factor sign-in is available for every account. Passwords and sign-in codes are never stored as plain text.
• Sensitive items, such as the password vault and AI keys, are stored encrypted. AI keys are never shown to workspace members.
• Only people who need it to run the service can access production data.

If a breach creates a real risk of significant harm, we’ll report it without unreasonable delay to the Office of the Information and Privacy Commissioner of Alberta, as PIPA requires, and to the Office of the Privacy Commissioner of Canada where PIPEDA applies, and we’ll tell the people affected. We keep a record of every breach for at least 24 months. Where the breach involves your clients’ information, we’ll tell you promptly so you can meet your own obligations.

We only use cookies that Alkovey needs to work: to keep you (or your clients, in the client portal) signed in, remember your workspace and confirm two-factor sign-in. Your browser also stores a few display preferences, such as light or dark mode. We don’t use advertising or analytics cookies, and we don’t record your screen, clicks or keystrokes. Our fonts are served from our own servers, so pages and documents don’t send your IP address to Google or other font services.

On alkovey.com, Cloudflare sets one cookie (_cfuvid) that helps block automated traffic. It’s needed for the site to work safely and isn’t used to track you.

Do Not Track: because we don’t track you across other websites or use tracking cookies, the app works the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.

• Access: download a copy of your information any time from Settings → Your data (workspace owners get the whole workspace), or ask us what we hold about you.
• Correction: fix anything that’s wrong. Most of it you can change yourself in your profile and settings.
• Deletion: delete your account any time from Settings → Your data. Some things, like billing records, we must keep by law.
• Withdrawing consent: you can take back your consent at any time, for example by unsubscribing or leaving the launch list. We’ll tell you if that means we can’t keep providing part of the service.
• Complaints: tell us first and we’ll try to fix it. You can also contact the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca, or the Office of the Privacy Commissioner of Canada at priv.gc.ca.

You can also email hello@alkovey.com for any of these. We’ll reply within 30 days, and may need to confirm your identity first.

Alkovey is for businesses and isn’t meant for anyone under 18. Everyone confirms they’re 18 or older when they create an account. We don’t knowingly collect information from children. If we learn an account belongs to someone under 18, we close it and delete its information.

If we make an important change, we’ll email account holders before it takes effect and update the date at the top.

Privacy questions go to our privacy officer:
Hristo Janeski
BL3SSED Inc., operating as Alkovey
hello@alkovey.com