Privacy Policy

Account information. When you create an account, we collect your email address and a hashed password. If you sign in via Google or Microsoft OAuth, we receive your name, email address, and profile picture from that provider.

Business profile data. You provide information about your business, including business name, website, and goals. This is used to personalise the Service to your context.

Integration data. When you connect third-party platforms (Google Analytics, HubSpot, Slack, etc.), we receive access tokens and the data those platforms provide (such as traffic metrics, CRM records, ad performance, email stats, and calendar events). We access only the scopes you authorise.

Usage data. We automatically collect information about how you interact with the Service, including pages visited, features used, and actions taken. This may include your IP address, browser type, device type, and timestamps.

Communications. If you contact us for support or send feedback, we retain those communications to assist you and improve the Service.

We use the information we collect to:

• Provide, operate, and improve the Service
• Detect signals and anomalies in your connected data sources
• Generate and deliver daily briefs and alerts
• Execute autonomous actions on your behalf where you have configured them
• Send transactional emails (account verification, password reset, plan notifications)
• Respond to your support requests
• Monitor for security incidents and prevent fraud
• Comply with legal obligations

We do not sell your data. We do not use your business data to train AI models that are shared with other customers or third parties.

The Service integrates with third-party platforms at your direction. When you connect an integration:

• OAuth access tokens are stored encrypted using AES-256 at the application layer
• We access only the data scopes you explicitly authorise
• You can revoke any integration at any time from the Integrations settings or directly from the third-party platform
• Revoking access stops all future data collection from that platform

Your use of connected platforms is subject to those platforms' own privacy policies. We are not responsible for data practices of third-party services.

We do not sell, rent, or trade your personal information. We may share information only in the following circumstances:

Service providers. We work with trusted third-party providers to operate the Service, including cloud infrastructure, email delivery, and payment processing. These providers are contractually bound to protect your data and may only use it to perform services on our behalf.

AI processing. We use Anthropic's Claude API to generate briefs, analyse signals, and suggest actions. Data sent to the AI for processing is subject to Anthropic's data processing terms. We do not use Anthropic's zero-retention API, which means data may be used to improve their models unless you have a specific enterprise agreement.

Legal requirements. We may disclose your information if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect our rights or the safety of others.

Business transfers. If AndaLabX is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you before your data is transferred and subject to a different privacy policy.

We implement industry-standard security measures to protect your data, including:

• AES-256 encryption for all stored OAuth tokens and API credentials
• Encrypted connections (TLS) for all data in transit
• Bcrypt hashing for all user passwords
• Role-based access controls within the Service
• Regular security reviews of dependencies and infrastructure

No method of transmission over the internet or electronic storage is 100% secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

We retain your data for as long as your account is active or as needed to provide the Service. If you cancel your account:

• Your data is retained for 30 days, during which you can request an export
• After 30 days, your account and all associated data are permanently deleted
• Some aggregated, anonymised data may be retained for analytics purposes
• We may retain certain data longer if required by law or to resolve disputes

Depending on where you are located, you may have the following rights regarding your personal data:

Access. You have the right to request a copy of the personal data we hold about you.

Correction. You can update your account information directly within the Service or by contacting us.

Deletion. You can request deletion of your account and personal data. We will fulfil this request within 30 days, subject to legal retention requirements.

Portability. You can request an export of your data in a machine-readable format.

Objection / restriction. You may object to certain processing activities or request that we restrict processing of your data in certain circumstances.

To exercise any of these rights, contact us at hello@andalabx.com. We will respond within 30 days.

We use a single session cookie to keep you signed in to the Service. We do not use third-party advertising cookies or cross-site tracking cookies. We may use anonymised analytics to understand how the Service is used in aggregate. You can disable cookies in your browser settings, though this may affect the functionality of the Service.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us and we will promptly delete it.

Your data may be processed and stored in data centres outside your country of residence, including in the United States. By using the Service, you consent to the transfer of your information to countries that may have different data protection laws than your country. We ensure appropriate safeguards are in place for any such transfers.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice within the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the revised policy.

For privacy-related questions, requests, or complaints, please contact our privacy team at: hello@andalabx.com