Privacy Policy

Introduction

ASRR B.V. ("ASRR", "we", "us", or "our") operates the Alpha application. This Privacy Policy explains how we collect, use, and protect your information when you use our app.

Information We Collect

We collect the following types of information:

• Account information: name, email address, and credentials provided during sign-in.
• Business data: orders, invoices, estimates, client records, and product information you create or manage within the app.
• Device information: device model, operating system version, and app version for diagnostics and compatibility.
• Location data: only when you explicitly grant permission, for logistics route optimization. Location is never collected without your consent.
• Camera access: only when you explicitly grant permission, for scanning QR codes and barcodes. Images are processed on-device and are not stored or transmitted.

How We Use Your Information

• To provide and maintain the Alpha app and its features.
• To sync your business data across devices using your organization's account.
• To send push notifications about orders, tasks, and system updates (with your permission).
• To improve app performance and fix issues.

Data Storage and Security

Your data is stored securely on servers within the European Union. We use encryption in transit (TLS) and at rest to protect your information. Offline data is stored locally on your device in an encrypted database and synced when connectivity is available.

Data Sharing

We do not sell your personal data. Your business data is only accessible to members of your organization. We do not share your information with third parties except:

• When required by law or legal process.
• With infrastructure providers (hosting, cloud services) who process data on our behalf under strict contractual obligations.
• With Meta Platforms, Inc., but only to deliver a reply that a user of the app has explicitly sent to an Instagram or Facebook conversation. See the section below.
• With Zoom Communications, Inc., but only to schedule, move, or cancel a meeting for an appointment in the Zoom account of the team member who connected it. See the Zoom section below.
• With Google, to send email or manage calendar appointments when you connect the corresponding integration. Email recipients and meeting invitees receive the content you choose to send or include in an invitation. See the Google section below.

Google Account, Gmail, and Calendar Data

Connecting Google is optional. You choose which account to connect and authorize the requested permissions on Google's consent screen. Gmail sending, the shared Gmail communication hub, and Google Calendar are separate connections in Alpha; connecting one does not require connecting the others.

• Account information: we use the connected account's email address and identifier to associate it with your Alpha user and organization and display which account is connected.
• Gmail sending: we submit the recipients, subject, message content, and any attachments of email you choose to send, or confirmations and notifications you configure, to Gmail. This connection uses send-only access and does not read your inbox, messages, or contacts.
• Shared Gmail communication hub: when your organization separately connects a Gmail mailbox to the hub, Alpha requests read-only mail access in addition to sending. It retrieves and stores message and thread identifiers, sender and recipient addresses, subjects, plain-text message content, and timestamps to display conversations, assign them to colleagues, associate them with customer records, and send replies. The hub does not import attachments or the original HTML layout and does not modify Gmail labels or delete Gmail messages. Its read access is separate from the send-only Gmail connection described above.
• Google Calendar: we retrieve available calendars and their access roles so you can select a writable booking calendar and calendars used to check availability. Alpha reads and synchronizes events from the primary connected calendar, including event identifiers, titles, descriptions, times, and locations. Other calendars selected only for availability are queried for busy time intervals; their event titles and descriptions are not imported. Alpha can create, update, and cancel appointments in the selected calendar, send invitations, and create Google Meet links when you request that meeting provider.
• Authorization credentials: we store OAuth access and refresh tokens on the backend to perform the authorized sending and calendar synchronization, including when you are offline. These credentials are not displayed in Alpha's connection settings.

We use Google data to provide these connected features. Calendar and business records in Alpha are accessible within your organization according to Alpha's access permissions. Hosting providers process stored data on our behalf as described above. Gmail messages are delivered to the recipients you select; calendar invitations and updates are shared with the attendees included in the event.

If your organization enables the hub's reply assistant, conversation text and the relevant customer-record context are sent to Anthropic through its commercial API to generate an answer draft. Drafts can be requested by a colleague or generated automatically for incoming messages when automatic drafting is enabled for that channel. A colleague reviews and approves a draft before it is sent. The assistant can be disabled in the channel settings. We do not use these messages or drafts to train general-purpose AI models.

We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. Alpha complies with the Google API Services User Data Policy, including the Limited Use requirements, for data received from Google APIs.

You can disconnect a Gmail connection or Google Calendar in Alpha's connection settings. Disconnecting removes the stored connection credentials and stops future sending or synchronization through that connection. You can also revoke Alpha's permission in your Google Account settings. Previously sent messages remain in Gmail, and existing Google Calendar events remain in Google. Records already stored in Alpha follow the retention policy below; disconnecting does not delete those business records. To request deletion of data held by Alpha, see Data Deletion Request.

Instagram and Facebook Data

An organization using Alpha can choose to connect its own Instagram professional account or Facebook Page, so that leads and messages from those channels reach its staff inside the app. This connection is off by default and is made by an administrator of that organization, who grants the permissions through Meta's own consent screen and can revoke them at any time.

Where such a connection is active, we receive the following from Meta on that organization's behalf:

• Lead form submissions: the name, email address, phone number, and other answers a person submitted to a lead form shown on Instagram or Facebook, together with the identifiers of the ad, form, and Page involved.
• Direct messages: the content and attachments of messages sent to the connected account, the timestamp, and the sender's Instagram username, Instagram-scoped user ID, profile name, and profile picture.
• Connected account details: the identifiers, names, and access tokens of the Instagram account or Facebook Page that was connected.

We use this data for one purpose only: to show those leads and messages to the connected organization's staff so they can respond. Specifically, we do not use Meta platform data for advertising or profiling, we do not sell or license it, we do not use it to train machine learning models, and we never combine or share it across organizations; each organization can see only the data from the accounts it connected itself.

Data flows back to Meta only when a member of staff sends a reply; that message content is transmitted to Meta in order to deliver it to the recipient.

Access tokens are stored encrypted at rest and are never shown to users of the app. Messages and lead records are retained while the integration is connected and the record remains active. Disconnecting the integration deletes the stored tokens and stops all further collection immediately. To have the stored data itself deleted, see Data Deletion Request.

Zoom Data

A team member can choose to connect their own Zoom account from their Alpha profile, so that online appointments assigned to them are held as meetings in that account. This connection is off by default, is made by the team member themselves through Zoom's own consent screen, and can be removed at any time, either in Alpha or by removing the app in Zoom.

Where such a connection is active, we store:

• Connected account details: the Zoom user ID and the email address of the connected Zoom account, so the team member can see which account is linked.
• Access tokens: the OAuth access and refresh tokens Zoom issues for the connection.
• Meeting details: for each appointment, the ID, join link, and host start link of the meeting we scheduled.

To schedule a meeting we send Zoom the appointment's title (which can include the visitor's name), start time, duration, and time zone, and as the meeting agenda any message the visitor left when booking. We use Zoom only to create, update, and delete the meetings for appointments booked in Alpha. We do not read the connected account's other meetings, recordings, contacts, or chat, we do not use Zoom data for advertising or to train machine learning models, and we never share it across organizations.

Tokens are stored encrypted at rest and are never shown to users of the app. The join link is sent only to the visitor who booked the appointment; the host start link is shown inside Alpha only. Disconnecting in Alpha revokes the tokens at Zoom and deletes them together with the stored account details. Removing the app in Zoom has the same effect: Zoom notifies us, and we delete the stored connection. Meetings that were already scheduled remain in the Zoom account. To have other stored data deleted, see Data Deletion Request.

Your Rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data; see Data Deletion Request.
• Withdraw consent for location tracking or notifications at any time.
• Export your data in a portable format.

Data Retention

We retain your data for as long as your organization's account is active. When an account is closed, we delete associated data within 90 days, unless retention is required by law.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email.

Contact

If you have questions about this Privacy Policy or want to exercise your rights, contact us at:

privacy@asrr.nl

ASRR B.V.
The Netherlands