Privacy Policy

When you register an account, we collect: full name, email address, password (stored as a salted bcrypt hash — never in plain text), company name, phone number (optional), profile photo (optional), timezone, and country.

Data you create or import while using the platform, including: CRM contact records, invoice and quote data, contract documents, financial records (journal entries, expenses, chart of accounts), project and task records, calendar events, meeting recordings (stored in your workspace only), and team member information.

When you connect Gmail, AlphaClone requests the following Google OAuth scopes:

• gmail.readonly — to display your inbox within the platform
• gmail.send — to send emails on your behalf from within the platform
• gmail.compose — to draft and compose emails
• gmail.modify — to label and manage emails (e.g., mark as read)

What we do NOT do with Gmail data:

• We do not store your email content on AlphaClone servers
• We do not use Gmail data for advertising or marketing purposes
• We do not share Gmail data with third parties outside of processing your request
• We do not allow humans to read your email content unless you explicitly request support access
• We do not use Gmail data to train AI models

Gmail data is retrieved in real time via Google's API and displayed only to the authenticated user. You can revoke AlphaClone's Gmail access at any time from your Google Account Permissions page.

When you authorize LinkedIn OAuth integration, AlphaClone requests access to requested product scopes including: openid, profile, email, r_basicprofile, r_profile_basicinfo, w_member_social, w_organization_social, r_organization_social, r_organization_admin, rw_organization_admin, r_ads, rw_ads, r_ads_reporting, r_events, rw_events, r_1st_connections_size, and r_verify.

LinkedIn Lead Gen Forms & Lead Data Processing:

• When prospects submit a LinkedIn Lead Gen Form connected to your account, form responses (such as full name, email address, company name, job title, and phone number) are securely received via real-time webhooks or API sync.
• Lead data is mapped directly into your AlphaClone CRM leads table to enable automated follow-ups and lead management.
• We do not sell, share, or monetize LinkedIn lead data with any unauthorized third parties.
• You retain full control to modify, export, or delete lead records at any time within your workspace.

When you connect Calendly via OAuth, AlphaClone retrieves event types, scheduled meetings, invitee names, email addresses, and event details solely to sync booking availability and auto-ingest meeting invitees into your CRM leads and calendar. OAuth access tokens are stored using AES-256 encryption at rest.

When you connect Microsoft 365, AlphaClone may process mailbox metadata, selected email content, calendar events, meeting details, task lists, user profile information, and OAuth tokens solely to provide inbox sync, email sending, calendar scheduling, task sync, CRM matching, and user-requested automation. Microsoft data is scoped to your connected account and workspace, and access can be revoked from your Microsoft account or AlphaClone integration settings.

When you connect Meta products, AlphaClone may process Facebook Page details, Instagram business profile data, post content, media assets, comments, direct business messages, Lead Ads form responses, WhatsApp Business message metadata, delivery status, phone numbers, and consent/opt-out signals. This data is used only for publishing, inbox sync, lead capture, CRM updates, and user-requested customer communication workflows.

AI prompts, tool calls, execution logs, approvals, task plans, and agent run metadata may be stored in your workspace for auditability, recovery, debugging, and user-visible history. External actions such as sending messages, publishing posts, billing changes, or sensitive data access are governed by platform policy, user permissions, and approval controls where applicable. We do not use your workspace data to train third-party foundation models unless you separately agree in writing.

We automatically collect technical data when you use the platform: IP address, browser type and version, operating system, device type, pages visited, features used, session duration, and error logs. This data is used for platform security, debugging, and improving the user experience.

Payment processing is handled entirely by Stripe, Inc. AlphaClone never stores, processes, or has access to your credit card details. What we retain is limited to: Stripe Customer ID, subscription plan details, billing address, and payment history (invoice amounts and dates). See Stripe's Privacy Policy for how they handle payment data.

The AI Growth Agent uses publicly available business directory data to identify prospective leads. We do not scrape private data or use data obtained through unauthorized means. Outreach conversations managed by the AI agent are stored in your workspace and are not accessible to other users or AlphaClone staff without your consent.

AlphaClone's MCP server enforces strict technical controls: all data is scoped to your tenant workspace only, DELETE and DDL operations are blocked, and credentials/secrets are never transmitted. MCP access tokens are user-generated and can be revoked at any time from Settings → Integrations → MCP.