Privacy Policy

1. Scope of this policy

This policy applies to personal data we process as a controller about:

• visitors to our websites and trust center;
• users who register for, evaluate, or administer the Services;
• prospective customers and the people who contact us, request a demo, or attend our events; and
• recipients of our marketing communications.

It does not apply to: (a) Customer Data we process on behalf of a customer (governed by the relevant customer agreement and DPA); or (b) third-party websites or services we link to, which have their own privacy practices.

2. Personal data we collect

2.1 Information you give us

• Account and profile data — name, work email, employer/firm, role, and credentials used to create and manage an account.
• Demo and sales enquiries — the details you submit through our forms, including practice area and any notes you provide.
• Communications — the content of emails, support tickets, calls, and survey or testimonial responses.
• Billing data — billing contact and information needed to administer a subscription (payment card data is handled by our payment processor).

2.2 Information we collect automatically

• Usage and log data — pages viewed, features used, actions taken, timestamps, and referring pages.
• Device and connection data — IP address, browser type, operating system, and device identifiers.
• Cookies and similar technologies — see Section 11.

2.3 Information from third parties and public sources

• Service providers — security, analytics, and marketing vendors, and your single sign-on (SSO) identity provider.
• Customer administrators — where your employer provisions your access to the Services.
• Public legal sources — to build and maintain our legal corpus we ingest publicly available materials such as legislation, judgments, regulatory decisions, and public filings. Where these contain personal data, we process them on the basis of our legitimate interests in providing reliable, source-grounded legal information, subject to applicable law.

3. How we use personal data

We use personal data for the purposes below, relying on the legal bases shown (the legal-basis column is most relevant where GDPR, UK GDPR, NDPA, the Kenya DPA, or POPIA applies):

We may create aggregated or de-identified information that no longer identifies you and use it for any lawful purpose. We do not attempt to re-identify it.

4. Customer Data and AI training

Customer Data — the matter documents, prompts, instructions, and outputs processed through the platform — is processed by Alvary as a processor, only on the documented instructions of the customer that controls it, under that customer's agreement and DPA.

• No training on Customer Data. We do not use Customer Data to train, fine-tune, or improve our models or any third-party model, and we do not allow our model providers to do so, except where a customer explicitly configures and authorizes it.
• Source-grounded outputs. Findings, answers, and drafts retain links to the underlying documents and authorities. Claims that cannot be resolved to a source are marked — never silently fabricated.
• Access controls and audit. Workspace actions, exports, and client-facing steps are controlled by policy, and important actions are recorded for review.

If you are an individual whose personal data appears within Customer Data and you wish to exercise your rights, please contact the relevant Alvary customer (the controller). We will assist our customers in responding to such requests as required by the DPA and applicable law.

5. Who we share data with

We share personal data only as described here:

• Affiliates within the Alvary group, for the purposes in this policy.
• Service providers / subprocessors — cloud hosting, model providers, email, analytics, support, and security vendors that process data on our behalf under contract. Our current subprocessor list is published at alvary.ai/subprocessors.html.
• Your organization — where your account is provisioned by an employer, that organization's administrators may access account and usage information.
• Professional advisors and authorities — auditors, lawyers, regulators, and law-enforcement bodies where necessary to comply with law or protect rights.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

We do not sell personal data, and we do not “share” it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

6. International data transfers

Alvary operates across multiple regions, including the EU/EEA, the United Kingdom, the United States, and Africa. Where we transfer personal data across borders, we rely on appropriate safeguards, which may include:

• transfers to countries benefiting from an adequacy decision;
• the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) for transfers from the EEA/UK;
• mechanisms recognized under the Nigeria Data Protection Act (including NDPC adequacy determinations or approved instruments under section 41), the Kenya Data Protection Act, and South Africa's POPIA; and
• limited statutory derogations (for example, your explicit consent or the establishment or defense of legal claims).

Customer Data is currently stored and processed in the EU. Additional regions, and per-workspace region selection, are available for enterprise engagements on request — see our security page.

7. Data retention

We retain personal data for as long as needed for the purposes described in this policy, then delete or anonymize it. Retention periods depend on:

• the duration of our relationship and your account;
• legal, tax, and accounting obligations (which may require retention for several years); and
• whether retention is necessary to resolve disputes or enforce agreements.

Where data is held in backups, it is isolated and deleted on our standard backup cycle. Retention of Customer Data is controlled by the customer under its agreement and DPA.

8. How we keep data secure

We maintain technical and organizational measures appropriate to the risk, including encryption in transit (TLS 1.2+) and at rest (AES-256), role- and matter-scoped access controls, SSO/SCIM, a tamper-evident audit log, and continuous monitoring. Our certification status (including SOC 2 and ISO 27001 progress) and security architecture are described on our security page and trust center. No method of transmission or storage is completely secure, but we work continuously to protect personal data and to notify affected parties of incidents as required by law.

9. Your privacy rights

Subject to applicable law and verification of your identity, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your data (the “right to be forgotten”);
• restrict or object to certain processing, including processing based on legitimate interests;
• data portability;
• withdraw consent at any time, without affecting prior processing; and
• lodge a complaint with your supervisory or data-protection authority.

To exercise these rights, email privacy@alvary.ai. You can unsubscribe from marketing at any time using the link in our emails. We will respond within the timeframes required by applicable law.

10. Region-specific provisions

10.1 European Economic Area, United Kingdom, and Switzerland

The controller is Ruhu, Inc. d/b/a Alvary. The legal bases we rely on are set out in Section 3. You have the rights in Section 9 and may complain to your local supervisory authority. Data-protection enquiries can be sent to privacy@alvary.ai.

10.2 Nigeria (NDPA)

We process personal data in accordance with the Nigeria Data Protection Act 2023, including the cross-border transfer requirements of section 41. You may exercise the data-subject rights granted under the NDPA and contact the Nigeria Data Protection Commission.

10.3 Kenya

We process personal data in accordance with the Kenya Data Protection Act 2019, and you may contact the Office of the Data Protection Commissioner.

10.4 South Africa (POPIA)

We process personal information in accordance with the Protection of Personal Information Act, and you may contact the Information Regulator.

10.5 United States

Depending on your state of residence, you may have rights to know, access, correct, delete, and opt out of certain processing. We do not sell personal data or share it for cross-context behavioral advertising. To exercise these rights, contact privacy@alvary.ai.

11. Cookies and analytics

We use strictly necessary cookies to operate our websites and, with your consent where required, analytics and preference cookies to understand and improve them. You can manage non-essential cookies through our cookie banner and your browser settings.

12. Children's data

The Services are intended for businesses and professional users. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us personal data, contact privacy@alvary.ai and we will delete it.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised policy.

14. How to contact us

Ruhu, Inc.
d/b/a Alvary
Privacy team: privacy@alvary.ai
Security reports: security@alvary.ai
Mailing address:
1111B South Governors Ave, STE 52865
Dover, DE 19904 US
Subprocessors: alvary.ai/subprocessors.html