Privacy Policy

This Privacy Policy explains how Madd Technologies LLC ("Madd Technologies", "we", "us", or "our") collects, uses, shares, and protects personal information in ALISA (formerly ARIA), our AI assistant: the ALISA mobile app, the ALISA web app at https://www.ariaassistant.ai, ALISA phone numbers, and the services behind them. It also explains the choices and rights you have.

It covers ALISA users and the people ALISA interacts with for them, such as callers, the people ALISA calls, and the senders of email a user authorizes (see section 9). The AI and Call Recording Disclosure gives more detail about AI and calls.

1. Summary

  • ALISA summarizes and drafts only the email you authorize through that inbox's saved Gmail or Zoho Mail label or Outlook category, or a watch rule that applies that same marker, and sends email only after you approve it. Your marker may still be named ARIA, or may be ALISA or a custom name. There are two limited sent-mail exceptions for Gmail and Outlook. When you ask ALISA to find your email signature, it reads that inbox's last 10 sent emails only to find it. And for a conversation still waiting on you, ALISA checks whether you already replied from your own mail, seeing only that a reply exists and when. Neither exception uses AI. For Zoho Mail, ALISA reads the signature saved in your Zoho Mail settings instead, reads no sent email for that purpose, and does not run the reply check. Zoho's answers to ALISA's searches also include subjects and previews of other messages, which ALISA discards on arrival (section 7.3).
  • ALISA answers calls to your ALISA number and tells every caller they are speaking with an AI assistant and that the call may be recorded and transcribed. Recording playback expires after 30 days, when recordings are scheduled for deletion (section 10).
  • AI features run only after you agree to share data with our AI provider, OpenAI. OpenAI does not use ALISA's data to train its models, and neither do we.
  • On the Standard and Pro plans, ALISA can show the weather and the drive time with traffic, using Google Maps, for events with a location and for places you ask about, and can find places near you. It is on unless you turn it off in Settings. It uses your device's location only when you ask it to and allow it, never in the background. After you share it in chat, the app sends it with your chat messages for 10 minutes, unless you stop it sooner.
  • We do not sell your personal information, share it for cross-context behavioral advertising, or show ads.
  • You can delete your account, and the data stored with it, in the app at any time.
  • ALISA is only for people aged 18 or older.

2. Who is responsible

Madd Technologies LLC is responsible for the personal information described in this policy. You can contact our Privacy Lead at legal@maddtechnologies.com or through https://www.maddtechnologies.com/contact/?category=legal (see section 19).

3. Information we collect

3.1 Account and profile

  • Your name, email address, username, and password (stored by our authentication provider in hashed form), or the identifier and email address from Sign in with Apple, Google, or Microsoft.
  • Your profile photo, if you add one. Profile photos are stored in a storage location that anyone with the photo's link can open.
  • Your settings, such as your greeting, how your name is pronounced, writing and summary style, voice, working hours, time zone, call rules, important callers and transfer number, notification preferences, and accessibility preferences.

3.2 Email you authorize

When you connect Gmail, Outlook or Zoho Mail, ALISA uses the exact Gmail or Zoho Mail label or Outlook category saved for that inbox to authorize messages. It may be named ARIA, ALISA, or a custom name; its spelling does not expand access. ALISA keeps your existing marker when you reconnect and does not rename or replace it because the product name changes. A watch rule you create authorizes a matching message only after ALISA applies that same marker and your email provider confirms it. For each inbox you choose whether the other messages in that exact conversation are authorized, or only the marked message. Processing waits when ALISA cannot confirm the provider's authorization evidence. The two Gmail/Outlook sent-mail exceptions below and the discarded Zoho search results in section 7.3 do not widen the messages authorized for summaries or drafts.

  • Stored: for each authorized message, the sender, the subject and a short preview (each up to 500 characters), dates, and the provider's message and conversation identifiers.
  • Fetched when needed and not stored: the full content of authorized messages, which ALISA retrieves from your provider to show you the conversation, summarize it, or draft a reply.
  • Drafts: the drafts ALISA writes and your edits, and a short record of the message being answered.
  • Attachments you add to a reply, until the reply is sent.
  • Watch rules you create, such as a sender or domain to watch.
  • Zoho Mail connection details: if you connect a Zoho Mail inbox, ALISA stores its encrypted access and refresh tokens, the code of the Zoho data center that holds your account, and your Zoho account ID (section 7.3). Zoho is a connected inbox provider only; you cannot sign in to ALISA with Zoho.
  • Your email signature: each inbox can have one signature, which ALISA adds under the replies and new emails it sends from that inbox unless you leave it off an email. You can write it in Settings, or tap "Find my signature". For a Zoho Mail inbox, ALISA then reads the signature saved in your Zoho Mail settings and no sent email. For a Gmail or Outlook inbox, ALISA then reads that inbox's 10 most recent sent emails to find the signature you sign them with, using only the ones sent from that inbox's own address. This is the only time ALISA reads the content of email you haven't authorized, apart from the Zoho Mail search results that ALISA discards on arrival (section 7.3). It runs only when you tap it, uses no AI, and keeps nothing else from those emails: it shows you what it found and saves nothing until you choose one.

ALISA stores the signature you save, with its text, formatting, links and any images in it (such as a logo).

  • Replies you send from your own mail: for each conversation in your Inbox from the last 30 days that is still waiting on you, ALISA asks Gmail or Outlook (not Zoho Mail) every few minutes whether that inbox sent a message in the conversation after the newest message you authorized, and when. It sees only that a sent message exists and its time, never its subject, recipients or content, and uses no AI. When you have replied, ALISA moves the conversation out of Pending and closes the reply it had prepared. Only the time of your reply is stored, with the conversation.

3.3 Calendar

Your list of calendars, event details (such as titles, times, locations, attendees, and descriptions), free/busy availability, and the events ALISA creates or changes at your request.

3.4 Calls

  • Calls to your ALISA number: the caller's phone number, call times and duration, what the caller and ALISA say (as a transcript), the call summary, any message taken, and, when call recording is on, the call audio (see the AI and Call Recording Disclosure).
  • Delegated calls: the recipient and phone number you approve, the purpose and instructions you approve, your approval, the recipient's consent or refusal, any request not to be called again, the transcript, recording (only with the recipient's consent), and result. To check that a call is allowed, ALISA looks up the type of phone line with our telephony provider and may search the web for a business's public listing to confirm its number.
  • Calls you start from chat: when you tap to set up a call that ALISA suggests in chat, or to call a place it found for you, ALISA sends up to the last 12 messages of that conversation to OpenAI to fill in the call form: who to call, what to ask, booking details, and when to call. The filled-in form is not saved unless you go on to create the call, and ALISA never takes a phone number from it. It finds a contact's number in your contacts, and looks up a business's number with the same search it uses when you type the business yourself, which can include the area you're in.
  • Your ALISA number, and the postal code of your billing address, which ALISA uses to choose a local area code for your number.

3.5 Contacts ALISA builds

ALISA builds contact entries from your calls and authorized email, not from your phone's address book or your Google or Microsoft contacts. An entry can include a name, phone number, email address, company, job title, website, and role, and AI-generated notes, such as a relationship summary, topics discussed, and the tone of recent conversations. When the sender of an authorized email gives their own job title, company, phone number or website, usually in their signature, ALISA adds it to that sender's existing entry where the entry is blank or was filled from an earlier signature. It never replaces a detail you entered or changed, and the entry shows which details came from a signature. You can edit, merge, rebuild, or delete contacts.

3.6 Chat, voice input, and feedback

Your messages to ALISA's chat and its answers; voice input you dictate in the chat, which is sent to OpenAI to be turned into text; the ratings and comments you give on ALISA's answers and drafts; and feedback you send during your trial.

3.7 Purchases and billing

  • App Store purchases: Apple processes payment. We receive transaction and subscription status from Apple, not your payment details.
  • Web purchases: Stripe processes payment and collects your payment card and billing address. We receive your plan, subscription and payment status, and billing address from Stripe, not your card number.
  • Your plan, trial status, usage counters (such as drafts and call minutes), and add-ons.

3.8 Agreement and consent records

  • Legal agreements: when you agree to the Terms of Use, Acceptable Use Policy, and Subscription Terms and confirm that you have read this policy and the AI and Call Recording Disclosure, we record the versions, a fingerprint (hash) of each document, your confirmation that you are 18 or older, when you agreed, the platform and app version, and the IP address and user agent (browser or device software) of the request. We keep this record to show which terms apply to your account.
  • Other consents: your AI data-sharing consent (with its version), your acceptance of the Delegated Calls disclosure (with its version), and when you acknowledged ALISA's email-scope and chat-privacy explanations.
  • Notices we sent you about changes to these documents, and on which channel.

3.9 Device, usage, and diagnostics

  • App version, platform, and time zone.
  • Your push notification token and a random identifier the app creates for your device (not a hardware identifier).
  • When you open the app, which ALISA uses to schedule your daily brief for when you usually start your day.
  • Diagnostic and performance events, such as errors, slow requests, and crashes. Our diagnostic event handling replaces your account identifier with a code and applies filters designed to remove email addresses, phone numbers, and web addresses before sending events to our monitoring provider. These filters do not guarantee that every identifying detail is removed; some server logs may still contain your account identifier.
  • Your IP address, which our servers use briefly to protect ALISA from abuse (rate limiting) and record with legal agreements.

3.10 Device permissions

The mobile app asks for these permissions only when you use the related feature. You can turn them off in your device settings.

  • Notifications: to alert you about calls, drafts, briefs, and account notices.
  • Microphone: for voice input in ALISA's chat.
  • Camera and photos: to take or choose a profile photo or an email attachment. ALISA uses only the photos you pick.
  • Face ID, Touch ID, or fingerprint: to unlock the app or sign in. The check happens on your device; ALISA never receives biometric data.
  • Location, while you use the app: only when you choose to share your current location, for real-world info, places near you, or putting "here" in an event (section 3.11). ALISA never asks for location access in the background. On Android you can choose to share only your approximate location.

The web app asks your browser for your location only in the same cases. ALISA does not ask for access to your phone's contacts.

3.11 Real-world info

Real-world info is part of the Standard and Pro plans. When it is on (Settings, Real-world info), ALISA looks up the place, the weather, and the drive time with traffic for calendar events that have a physical location, and for places you ask about in chat, such as a city you name, your home or work, or where you are. It also finds places near you when you ask in chat, such as "coffee near me". It uses the result for the Agenda, a leave-by notification, the event's details, and answers in chat.

  • Home and work addresses you choose to type and save, and the identifier Google Maps gives the place it finds for each. Their map coordinates are kept for a limited time (section 10).
  • Home and work saved from your device's location, with "Use current location" in Settings or by accepting ALISA's offer in chat: the coordinates, rounded to about 10 meters and stored encrypted, and the readable name your device gives the place, if any. Typing an address replaces them.
  • Places you ask about in chat: the place name ALISA takes from your message, and the day or time you ask about.
  • Your current location, only when you ask: if you ask ALISA something that needs a place, such as the weather, a drive, places near you, or an event "here", and ALISA has no place to use, it offers to use your current location. Only if you accept, and allow location access, does the app read your location. It reads it once and sends it with that question. For the next 10 minutes from when it was read, the app also sends it with your other chat messages, so a follow-up question doesn't ask again. While it does, the chat shows "Using your location" with a Stop button. Stop, declining ALISA's offer, signing out, or the end of the 10 minutes ends it. ALISA's servers ignore a location more than 10 minutes old, round it to about 100 meters, use it only for an answer that needs a place, and do not keep it, except where you ask ALISA to write it into an event (below). To show a readable name, the mobile app asks your phone's own location service to turn the location into an address (on iPhone, Apple's; on Android, the device's geocoding service, usually provided by Google); ALISA does not use a separate geocoding service. The web app shows "Current location" instead. That readable name, not the coordinates, can appear in ALISA's answer and in its offer to save the location as home or work, which are kept with the chat.
  • Your device's region (such as US), taken from its language settings, to choose units such as Fahrenheit or Celsius.
  • Places near you: when you ask for places near you, ALISA sends Google Maps the kind of place you asked for and the area to search around: a place you name, your home or work, or your current location. Google Maps returns up to 5 places, with each one's name, address, whether it is open now, phone number, and a map link. ALISA shows them in the chat. Its AI provider receives them to write the answer, but not any map coordinates. Only your search text and the places' Google Maps identifiers are kept with the chat. ALISA's answer, which can name a place, is kept with the chat like any other answer. If you choose to call one of the places, ALISA reads that place's name and address from Google Maps again to find its number (section 3.4).
  • "Here" in an event or an email: if you ask ALISA to add an event "here" or "where I am", it writes your current location's readable name as the event's location. On the web, where there is no readable name, it writes the coordinates rounded to about 100 meters. That location is saved in your calendar like any other event location. If you ask ALISA to tell someone you are on your way, it uses the drive time from your current location for the arrival time in the email draft, which is sent only after you approve it.
  • Looked-up results: the place's identifier and coordinates, and the forecast, kept for a limited time (section 10). The place's address and the drive time are looked up fresh each time and not cached. A forecast for your device's location, whether shared or saved as home or work, is not cached, and neither are the results of a search for places near you. A forecast or drive time ALISA writes into your Agenda or a leave-by notification is kept as long as that Agenda or notification.

A drive starts from your current location when you shared it, from your saved home or work, or from the place of your previous event.

4. How we use information, and our legal bases

We use personal information for the purposes below. If you are in the European Economic Area (EEA), the United Kingdom, or another place that requires a legal basis, the basis we rely on is shown for each.

  • To provide ALISA and the features you use: your account, connected email and calendar, drafts and sending approved replies, calls and delegated calls (including filling in a call you start from chat), contacts, briefs, chat, and notifications. Basis: performance of our contract with you.
  • To show real-world info for your events and the places you ask about (weather, drive times with traffic, and when to leave), to find places near you, and to fill in "here" in events and on-my-way emails, through Google Maps Platform, as described in section 3.11, including your device's location when you ask ALISA to use it. Basis: performance of our contract with you. ALISA reads your device's location only at your request and with the permission you give, which you can withdraw in your device or browser settings. You can turn real-world info off in Settings.
  • To run AI features through OpenAI. Basis: performance of our contract, and your consent to AI data sharing, which you can withdraw at any time.
  • To process information about the people you communicate with (callers, call recipients, email senders, calendar attendees) on your behalf. Basis: our and your legitimate interests in providing the assistant you asked for, and consent where the law requires it, such as for call recording.
  • To manage purchases, subscriptions, trials, and usage limits, and to keep tax and accounting records. Basis: performance of our contract, and legal obligations.
  • To record your agreement to our terms and to send notices of changes to them. Basis: legitimate interests in showing which terms apply and in keeping you informed, and legal obligations.
  • To keep ALISA secure, prevent fraud and abuse, honor requests not to be called, and enforce our terms. Basis: legitimate interests, and legal obligations.
  • To diagnose problems and maintain and improve the features you use. Basis: legitimate interests in a reliable service. We do not use your content to train AI models.
  • To provide support and respond to your requests. Basis: performance of our contract, and legitimate interests.
  • To comply with law and respond to lawful requests. Basis: legal obligations.

We do not use your information for advertising, and we do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

5. Email, calendar, and sending

ALISA sends a reply or a new email only after you review and approve that exact message, and changes your calendar only when you ask for or approve the change. The inbox's signature, which you see under the message before you approve it, is sent with it unless you leave it off. Content from email and calendars is used only to provide the features you see in ALISA.

6. AI processing and our AI provider

AI features run only after you give ALISA's separate AI data-sharing consent. You can withdraw it at any time in Settings; AI features then stop until you give it again.

ALISA sends the minimum relevant prompts and context to OpenAI's API only after the user grants ALISA's separate AI data-sharing consent and invokes an AI feature. OpenAI processes that content to return the requested text, audio, transcription, or other ALISA result. Depending on the feature, that content can include your prompts and chat messages, authorized email, drafts, calendar details, call audio and transcripts, contact details, the places Google Maps finds for you, and your assistant settings, including the text of your email signatures when you ask ALISA about your settings in chat.

OpenAI states that data submitted through its business and API offerings is not used to train or improve its generalized models unless the customer explicitly opts in. Madd Technologies does not opt in ALISA customer content to generalized or foundational model training. API requests and responses, including supported text and voice interactions, are logged for operation, security, and troubleshooting. Authorized Madd Technologies personnel may access those records for those purposes, subject to the stricter Google Workspace human-access limits in section 7.1. OpenAI may retain API content for logging, abuse monitoring, or as required to provide the selected API feature, subject to OpenAI's published policies, the account configuration, and legal requirements. ALISA does not claim that OpenAI provides Zero Data Retention for this account.

7. Google, Microsoft and Zoho data

7.1 Google API Services User Data Policy and Limited Use

ALISA's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

ALISA uses Google Workspace data only to provide or improve user-facing ALISA features that are prominent in ALISA's interface. ALISA does not use, transfer, or sell Google Workspace data for advertising, credit-worthiness, lending, surveillance, or to train, develop, or improve generalized or foundational AI or machine-learning models.

ALISA requests Google access only for the connected-account features the user chooses:

  • Gmail (gmail.modify): read messages authorized by that inbox's saved Gmail label or an explicit saved watch rule after provider-confirmed marking, create a label only for an unconfigured inbox and preserve an existing saved label, display the authorized conversation, generate a draft after separate AI consent, and send only the exact reply the user reviews and approves. When the user taps "Find my signature" for that inbox, ALISA also reads its 10 most recent sent messages, without AI, only to find the signature the user signs them with, and keeps only the signature the user chooses to save. For an authorized conversation still waiting on the user, ALISA also checks whether the user already replied from Gmail, reading only the labels and times of that conversation's messages, without AI.
  • Google Calendar (calendar.events, calendar.calendarlist.readonly, calendar.events.freebusy): list the user's calendars, display relevant event details, query free/busy availability, and create, edit, reschedule, or delete an event only through a user-initiated or user-approved action.
  • Sign-in (openid, email, profile): identify the connected Google account.

When real-world info is on, ALISA sends the location text of a Google Calendar event to Google Maps Platform to find that place and show its weather and drive time in ALISA. ALISA sends nothing else from the event, and you can turn the feature off in Settings.

ALISA may send only the Google Workspace content needed for a user-requested AI feature to OpenAI after the user grants ALISA's separate AI data-sharing consent. OpenAI acts as ALISA's data processor for that requested feature; Madd Technologies does not permit OpenAI to use ALISA customer content for generalized or foundational model training.

Human access to Google Workspace data is limited to the cases allowed by the Google API Services User Data Policy, such as with the user's affirmative agreement for a specific item, for security or abuse investigation, to comply with law, or when the data is aggregated and anonymized for internal operations.

7.2 Microsoft

When you connect Outlook, ALISA asks Microsoft for permission to read your profile (User.Read), read and update mail (Mail.Read, Mail.ReadWrite) to find messages with that inbox's saved Outlook category and apply that same category and, when you tap "Find my signature", to read your 10 most recent sent emails only to find your signature and, for a conversation you authorized, to check whether you already replied, reading only the send times of that conversation's messages in Sent Items, send the replies you approve (Mail.Send), read mailbox settings such as your time zone (MailboxSettings.ReadWrite), and read and update your calendar (Calendars.Read, Calendars.ReadWrite), with offline access so ALISA can work when the app is closed. ALISA applies the same rules to Microsoft data as to Google data in section 7.1: it is used only for the ALISA features you use, never for advertising or model training.

7.3 Zoho Mail

Zoho Mail is a connected inbox provider only. You cannot sign in to ALISA with Zoho, and connecting a Zoho Mail inbox never creates an ALISA account. When you connect Zoho Mail, ALISA asks Zoho for permission to read your Zoho Mail account details (ZohoMail.accounts.READ), list your folders (ZohoMail.folders.READ), read and update messages (ZohoMail.messages.ALL) to find messages with the ALISA label, mark them read, and send the replies you approve, and manage labels (ZohoMail.tags.ALL) to find or create the ALISA label and apply it. ALISA stores the encrypted access and refresh tokens, the code of the Zoho data center that holds your account (so ALISA talks to the right Zoho server), and your Zoho account ID.

  • Only labelled messages are processed. A Zoho Mail message is authorized only when Zoho's own list of messages with the ALISA label shows it. ALISA keeps the identifier of that label, so renaming the label in Zoho changes nothing, and if the label is deleted ALISA stops reading that inbox and asks you to reconnect.
  • Watch rules. A message that matches a watch rule is authorized only after ALISA applies the ALISA label and Zoho confirms it in that list.
  • Whole conversations. If you choose whole-conversation scope for the inbox, ALISA labels every message in the conversation and reads each one only after Zoho confirms its label.
  • Signatures. "Find my signature" reads the signature saved in your Zoho Mail settings. It reads no email, sent or otherwise.
  • No reply check. ALISA does not check whether you replied from Zoho Mail.
  • Replies. Replies you approve are sent through Zoho Mail and are saved in your Zoho Mail Sent folder. ALISA puts its ALISA label on its own reply so the conversation stays together.
  • Search results are transport only. When ALISA searches Zoho to find messages that match a watch rule, and when it looks up a conversation's messages, Zoho's answers include each result's subject and a short preview, including for messages you have not authorized. ALISA keeps only message identifiers from those answers and discards everything else as soon as it arrives. It does not log, store, queue or send it to an AI model.

ALISA applies the same rules to Zoho data as to Google data in section 7.1: it is used only for the ALISA features you use, never for advertising or model training.

7.4 Removing access

You can disconnect an inbox or calendar in ALISA's Settings. You can also remove ALISA's access in your Google Account (Security, Third-party apps with account access), your Microsoft account (Apps and services) or your Zoho account (the settings for connected apps). Disconnecting stops ALISA from using that connection. Stored tokens and cached data are removed as described in section 10; some orphaned calendar data is removed by a later cleanup. For a Zoho Mail inbox, ALISA also attempts to revoke the grant at Zoho; this provider request may fail independently of removing the connection in ALISA. Removing access in your Google, Microsoft or Zoho account revokes the provider permission itself.

8. Who we share information with

8.1 Providers and connected services

We share information with the provider categories and named services below to run ALISA. Some process information on our behalf; others also handle information for their own purposes under their terms and privacy policies, for example when you use their accounts or payment services. Google Maps Platform processes the location and search information described below under its own privacy terms. The role and permitted use depend on the service and applicable contract. You can request information about the recipients of your personal information through the contact details in section 19.

  • Account authentication, database, and file-storage providers: hold your account and the data ALISA stores, including profile photos and email attachments, authenticate sign-in, and send account verification and password-reset emails.
  • Application hosting and web-delivery providers: process the information needed to operate ALISA's servers, background services, and web app, including service content, web requests, IP addresses, and session cookies.
  • Background processing and abuse-prevention providers: handle pending job details, short-lived IP-address records for rate limiting, and temporary real-world info lookups (section 10).
  • OpenAI: AI features, real-time speech on calls, transcription, text-to-speech, and web search to confirm a business's public listing for a delegated call (see section 6).
  • Telnyx: ALISA phone numbers, call routing, call audio, call recordings, and phone line type lookups.
  • Google: Sign in with Google; Gmail and Google Calendar when you connect them; and notifications of new Gmail messages.
  • Google Maps Platform: place search, routes, traffic, and weather for real-world info (section 3.11). It receives an event's location text, the place names you ask about in chat, the kinds of places you search for near you, the home and work addresses you save, and map coordinates, including your device's location when you share it or save it as home or work. ALISA does not send your account name, email address, or the event's title, attendees, or description with these lookups. Google handles the submitted search and location data under the Google Privacy Policy and its Maps Platform terms.
  • Microsoft: sign-in with Microsoft, and Outlook mail and calendar when you connect them.
  • Zoho Corporation: Zoho Mail, when you connect a Zoho Mail inbox, through the Zoho server for the data center that holds your account. Not a sign-in method.
  • Apple: Sign in with Apple, App Store purchases and subscription status, and the Apple Push Notification service for iPhone and iPad notifications.
  • Stripe: web payments, billing, billing address, and tax calculation.
  • Push-notification delivery providers: send notifications through Apple's and Google's push services. Receive your push token and the notification's content.
  • Diagnostic and performance monitoring providers: receive the events described in section 3.9 to help us identify errors and performance problems.
  • Transactional email delivery providers: receive your email address, the legal notice being sent, and delivery-tracking information to send notices and avoid duplicates.

8.2 Other sharing

  • The people you communicate with: replies you approve go to their recipients; ALISA speaks with callers and the people you ask it to call, and may share with them what you have told it to say.
  • Transfers you accept: if you accept a live transfer of an important caller, ALISA calls the transfer number you saved and connects the caller.
  • Legal and safety: when we believe in good faith that the law requires it, or to protect the rights, safety, or property of our users, the public, or Madd Technologies, including to investigate fraud or abuse.
  • Business transfers: as part of a merger, acquisition, financing, reorganization, or sale of assets, subject to this policy. Google Workspace data remains subject to Google's Limited Use requirements, including explicit prior user consent for a transfer as part of a merger, acquisition, or sale of assets; this clause does not authorize other transfers of that data.
  • With your direction or consent.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

9. Information about people who are not ALISA users

ALISA processes information about people its users communicate with, on the user's behalf:

  • Callers: their phone number, what they say (transcribed in real time from the moment ALISA answers), the summary and any message, and, when recording is on, the audio after ALISA's notice. Callers hear that they are speaking with an AI assistant and that the call may be recorded and transcribed.
  • People ALISA calls for a user: their name and number as the user provided them, the call's purpose, what they say, their consent or refusal, and any request not to be called again. They hear that ALISA is an AI assistant before the call continues, and recording starts only with their consent.
  • Email senders and recipients: their names, email addresses, and the content of authorized messages.
  • Calendar attendees: their names and email addresses in events on the user's calendar.
  • Contact entries: what ALISA derives from calls and email, as described in section 3.5.

This information is used only to provide ALISA to the user, keep ALISA safe, and honor requests. It is kept and deleted with the user's data (section 10). If you are one of these people, you can ask us to access or delete information about you through https://www.maddtechnologies.com/contact/?category=legal or https://www.maddtechnologies.com/data-removal. It helps to include your phone number or email address and the approximate date. We may need to tell the ALISA user about your request, and we will keep a record of a request not to be called again so we can honor it.

10. How long we keep information

We keep personal information only as long as needed for the purposes in this policy. The following retention schedules apply. Where deletion runs through a scheduled cleanup or requires a provider response, completion depends on that process; a retention deadline does not mean every copy disappears at that exact moment. The provider, backup, and legal-record exceptions below also apply.

  • Call recordings: playback expires 30 days after a recording is made, when ALISA schedules deletion of the audio with Telnyx. Permanently deleting the call or deleting the account schedules deletion sooner. Provider deletion is retried if it fails; completion can occur after playback has stopped. A limited cleanup record without a link to your account is retained to complete that deletion.
  • Deleted calls: hidden at once, with permanent deletion of the call, transcript, and summary scheduled 30 days after you delete it.
  • Disconnected calendars: deletion of stored calendar events and access tokens is scheduled 30 days after the calendar account is disconnected.
  • Disconnected inboxes: that inbox's stored messages, drafts, signature, and access tokens are deleted when you disconnect it.
  • Sent emails read to find your signature: not stored. Only the signature you choose to save is kept, until you remove it, disconnect the inbox, or delete your account.
  • Replies you send from your own mail: only the time of your reply is kept, with the conversation, and it is deleted with the conversation.
  • Email attachments you add: deleted from storage after the reply is sent.
  • Records of sent replies: delivery receipts are deleted after 90 days.
  • Chat processing records: temporary records of chat requests are deleted 24 hours after the request completes.
  • Web sign-in cookies: the access cookie lasts up to about one hour and the refresh cookie up to 30 days.
  • Rate-limit records keyed by IP address: about one minute.
  • Real-world info lookups: a place's identifier and its coordinates for up to 30 days (a place that couldn't be found, 1 day), including those of the home and work addresses you save, and forecasts for 1 hour. These are stored under a fingerprint of the place, not your account. Forecasts for your device's location and drive times are not cached.
  • Your current location, when you share it: not stored by ALISA's servers, which use it only for the answers you asked for. The app holds it only in memory, never in your device's storage, sends it with your chat messages for up to 10 minutes after it was read, and doesn't use it after that. It is dropped when you tap Stop, decline, or sign out. Where you ask ALISA to write it into an event ("here"), the event keeps that location like any other. Searches for places near you are not cached; only the search text and the places' identifiers are kept, with the chat. A count of your lookups for the day, which caps them, is kept for 2 days, and when to check an event's drive next, until about an hour after the event starts.
  • Background jobs: most are removed from the job queue between 24 hours and 14 days after they finish.

Other information is kept until you delete it or delete your account. This includes your account and settings (including the home and work addresses or device locations you save, until you change or clear them), email subjects and previews, drafts, chat history, contacts, briefs, notifications, calls you have not deleted, your agreement and consent records, and delegated-call records. Deleting a delegated call hides it, but its approval, attempts, and any request not to be called again stay with your account until you delete the account.

Our current database recovery plan provides daily backups on a rolling seven-day schedule. Our current monitoring plan retains diagnostic events for three days. These periods apply to those recovery backups and that diagnostic store; they do not set the retention period for every provider's security, account, payment or legal records. Backup rotation and provider cleanup can finish after the scheduled period, and database backups do not include copies of uploaded files.

When account deletion completes in the app, we delete your account and its linked records from ALISA's active database. Before completion, ALISA closes Stripe billing, releases your ALISA phone number, and removes stored email attachments. If a required step fails, the app reports an error; deletion has not completed and you may need to retry or contact support. Profile-photo removal and Sign in with Apple revocation are attempted but may fail independently; if Apple revocation is unavailable, remove ALISA's access in your Apple account settings. Contact support if a profile-photo link remains accessible after deletion. Deletion is not a promise that all copies at every provider disappear immediately. After deletion:

  • some security and audit records are kept with the link to your account removed;
  • deleted data may remain in our providers' backups and logs for a limited time until they expire;
  • Apple, Stripe, and our other providers keep the records they are required to keep under their own policies, for example for tax and payment records;
  • ALISA does not revoke its access at Google, Microsoft or Zoho for you, but it can no longer use it because the tokens are deleted. You can remove ALISA's access in your Google, Microsoft or Zoho account (section 7.4).

11. Your choices and rights

11.1 In the app

  • Disconnect email and calendar accounts, and change which messages ALISA may read.
  • Change or remove an inbox's email signature, and leave it off any email.
  • Withdraw AI data-sharing consent.
  • Delete calls, chat conversations, and contacts.
  • Change notification and call settings, and device permissions.
  • Turn real-world info off, clear your home and work (whether typed or saved from your device), stop chat from using your current location with Stop, and turn off ALISA's location access in your device or browser settings.
  • Delete your account in Settings.

11.2 Your privacy rights

Depending on where you live, you may have the right to:

  • know what personal information we have about you and get a copy of it, including in a portable format;
  • correct inaccurate information;
  • delete your information;
  • object to or restrict certain processing, including processing based on legitimate interests;
  • withdraw consent at any time, without affecting processing before you withdrew it;
  • opt out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects (we do not do these);
  • not be discriminated against for exercising your rights.

11.3 How to make a request

  • Delete your account: in the app's Settings, or through https://www.maddtechnologies.com/data-removal.
  • Any other request (access, a copy of your data, correction, objection, or questions): email legal@maddtechnologies.com or use https://www.maddtechnologies.com/contact/?category=legal. ALISA does not yet offer a data download in the app; use either contact channel to request a copy under the rights described above.
  • Verification: we will ask you to confirm your identity, usually by confirming control of the email address on your account. We do not need to verify identity for a request to stop being called.
  • Authorized agents: where the law allows, someone you authorize may make a request for you. We may ask for proof of their authority and verify your identity with you.
  • Timing: we respond within the deadline required by the law that applies to your request. Where an applicable US state law sets a 45-day response period, that period applies, with an additional 45 days only where that law permits. Where Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) applies, we respond to an access request within 30 calendar days, with an extension only on the grounds and with the notice that law permits. Where EEA or UK data-protection law applies, the usual response period is one month, with an extension of up to two further months where permitted. We provide any extension notice and reasons required by that law.
  • Appeals: if we decline your request, you can appeal by replying to our decision, emailing legal@maddtechnologies.com, or using https://www.maddtechnologies.com/contact/?category=legal with the subject "Privacy appeal". We will respond within the time the law requires, usually 45 to 60 days, and if we deny the appeal, tell you how to contact your state attorney general.
  • Complaints: in Canada, you can raise a concern with our Privacy Lead using section 19 and complain to the Office of the Privacy Commissioner of Canada or the provincial privacy regulator that has jurisdiction, including Quebec's Commission d'acces a l'information. In the EEA or UK, you can also complain to your local data protection supervisory authority, such as the UK Information Commissioner's Office.

We will not deny you service, charge you a different price, or give you a different quality of service because you exercised your rights.

12. Additional information for US state residents

This section applies to residents of California and other US states with comprehensive privacy laws. In the past 12 months we collected these categories of personal information, from you, from your devices, from the accounts you connect (Google, Microsoft, Zoho, Apple), from payment providers (Apple, Stripe), and from the people who call you or whom ALISA calls or emails for you:

  • Identifiers: name, email address, username, phone numbers, account and device identifiers, IP address, and the home and work addresses you save.
  • Geolocation data: your device's location when you share it, and a home or work location you save from your device.
  • Customer records: billing address and purchase records.
  • Commercial information: plans, subscriptions, and usage.
  • Internet or other electronic network activity: app usage, diagnostics, and interactions with ALISA.
  • Audio and electronic information: call audio, voice input, and transcripts.
  • Professional or employment-related information: the companies and job titles of your contacts, from your calls and authorized email.
  • Inferences: the time you usually start your day (for your brief), your preferred writing style, and AI-generated notes about your contacts.
  • Sensitive personal information: your account login credentials, the contents of the email, calls, and messages you authorize ALISA to process, and your precise geolocation when you choose to share it or save it.

We collect and use these categories for the purposes in section 4, keep them as described in section 10, and disclose each of them for the purposes described to the providers in section 8.1 and the other recipients in section 8.2. As section 8.1 explains, not every provider acts only on our behalf.

  • We do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the past 12 months. We do not knowingly collect personal information of anyone under 18.
  • We use sensitive personal information only to provide ALISA as you request it, to keep it secure, and for the other purposes the law permits. We do not use it to infer characteristics about you. Because of this, we do not offer a separate right to limit its use.
  • Because we do not sell or share personal information, there is nothing to opt out of, and we do not change how we process information in response to a Global Privacy Control signal. If we ever begin selling or sharing, we will honor Global Privacy Control as an opt-out.
  • We do not offer financial incentives for personal information. The 7-day sign-up trial is not tied to providing personal information beyond your account.
  • Where we keep de-identified information, we will not try to re-identify it.

13. International transfers

Madd Technologies is based in the United States. ALISA's principal database and application servers are in the United States. Information from people in Canada is therefore transferred to the United States. Our network, AI, communications, payment and connected-account providers may also process information in other countries where they and their subprocessors operate. A server's location does not limit all support access or onward processing to that country.

Our database, application hosting, network delivery, queue, AI, calling, diagnostics and transactional-email arrangements include processing terms covering the information those providers process on our behalf. Those terms address permitted purposes, confidentiality, security, subprocessors and assistance with privacy rights. Providers that also act for their own purposes, including payment and connected-account providers, have the roles and policies described in section 8.1.

For transfers subject to EEA, UK or Swiss transfer rules, the applicable processing terms provide for the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and Swiss adaptations, or an applicable adequacy decision, depending on the provider, data and destination. Contact us for the mechanism and safeguards applicable to a particular transfer.

Information processed in another country is subject to that country's laws and may be accessible to its courts, law-enforcement or national-security authorities. Contractual safeguards do not prevent access required by law. For information about the countries, recipients and safeguards applicable to your information, or a copy of the applicable safeguards, contact our Privacy Lead through the company contacts in section 19 or https://www.maddtechnologies.com/contact/?category=legal. Copies may be redacted to protect confidential information and other people's information without withholding the protection relevant to your request.

14. Children

ALISA is only for adults. You must be 18 or older to use it, and ALISA is not directed to children. We do not knowingly collect personal information from children under 13, or from anyone under 18, as users. If we learn that an ALISA account belongs to someone under 18, we will close it and delete its data. If you believe a child is using ALISA, tell us through https://www.maddtechnologies.com/contact/?category=legal.

15. Security

We use technical and organizational safeguards designed to protect personal information, including encryption in transit, encryption of email and calendar access tokens and of home and work locations saved from your device at rest, access controls that limit each account to its own data, short-lived signed links for call-recording playback, and restricted access for our personnel. No service is completely secure. Keep your password safe, and tell us through https://www.maddtechnologies.com/contact/ if you believe your account has been compromised. If a breach affects your personal information, we will notify you and the authorities as the law requires.

16. Cookies and similar technologies

The ALISA web app uses only what it needs to work:

  • Sign-in cookies: an access cookie and a refresh cookie keep you signed in. They are strictly necessary, cannot be read by page scripts, and last up to about one hour and 30 days, respectively.
  • Browser storage: your theme and reduced-motion preference, and temporary state such as whether your profile is set up, your daily review progress, and a pending purchase you are returning from.

The web app does not use analytics, advertising, or tracking cookies, and has no third-party analytics or advertising scripts. When you pay on the web, Stripe's checkout pages use Stripe's own cookies, under Stripe's privacy policy. The mobile app stores your sign-in session and app-lock settings in your device's secure storage.

17. Push notifications

If you allow notifications, ALISA stores your device's push token and a random device identifier so it can send you alerts about calls, drafts, briefs, and account notices, including notices about changes to these documents. You can choose whether call alerts show the caller's name on your lock screen. You can turn notifications off in your device settings at any time.

18. Changes to this policy

We may update this policy. If a change is material, for example because we start collecting a new kind of information or using it in a new way, we will tell you at least 30 days before it takes effect, in the app (with a notification and a banner), by push notification if you allow notifications, and by email, and ALISA will ask you to confirm that you have read the new version. Other changes take effect when we publish them with a new version date and an in-app notice. The "Last updated" date at the top of this page shows the current version.

19. Contact

Madd Technologies LLC is responsible for ALISA. Address privacy questions, access or deletion requests, complaints, or appeals to our Privacy Lead: email legal@maddtechnologies.com, call +1 (512) 545-1107, or use https://www.maddtechnologies.com/contact/?category=legal. To delete your data, you can also delete your account in the app or use https://www.maddtechnologies.com/data-removal. General account, technical, and billing support remains available at support@maddtechnologies.com. Privacy requests received through support will be routed to the Privacy Lead and retain their original receipt date.

Mailing address: Madd Technologies LLC, 2970 Williams Dr #1006, Georgetown, TX 78628, United States.