Privacy Policy

Effective August 30, 2026

1. Who we are

This Policy explains how 1996058 Alberta Ltd. (o/a Alomi) ("we," "us," "Alomi"), collects, uses, shares, and protects personal information in connection with the Alomi platform at alomi.ai, app.alomi.ai, and related subdomains (the "Service"). We are a controller for information about our account holders, visitors, and prospects, and a processor/service provider for the Customer Data our business customers put into their tenant.

2. Information we collect

2.1 You provide: account and profile (name, work email, password, company, role, phone); billing contact (card data is handled by Stripe — we do not store full card numbers); support communications.

2.2 Customer Data: data you and your users add — tasks, projects, financial records, HR records, warehouse/inventory, marketing content, and records imported from connected systems. This may include personal information about your staff, customers, or contacts, for which you are the controller.

2.3 From integrations: when you connect ServiceMinder, QuickBooks Online, Google, LinkedIn, or PayPal, we receive data you authorize.

2.4 Automatically: log and usage data (IP, device, browser, actions, timestamps) and cookies (Section 8).

3. How we use information

To provide, operate, secure, and improve the Service; manage accounts and tenants; process payments and subscriptions; provide support; send service and (where permitted) marketing messages; analyze and develop features; prevent fraud and abuse; and comply with law. Where GDPR applies, our bases are contract, legitimate interests, consent, and legal obligation.

4. How we share information

With service providers/subprocessors (Section 6); within your organization per your roles; with third-party integrations you enable; for legal and safety reasons; and in a business transfer (including a possible future transfer of the Alomi business to a dedicated entity). We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as defined under California law.

5. Platform administration

Authorized personnel may access tenant data on a limited basis for support, issue resolution, and security. Cross-tenant administrative access ("impersonation") is logged, time-limited, and restricted to legitimate purposes.

6. Subprocessors

We use providers including: Supabase (database, auth, hosting), Stripe (payments), Cloudflare (domain, DNS, security, CDN), Google (email and integrations you enable), ServiceMinder, Intuit QuickBooks Online, LinkedIn, PayPal, Cloudinary (media), and email/analytics/error-monitoring providers. We maintain an up-to-date list on request and give notice of material changes where required.

7. International data transfers

We are based in Canada and use providers that may process data in the U.S. and elsewhere. Where required, we rely on appropriate safeguards (such as standard contractual clauses). By using the Service you understand your information may be processed outside your country.

8. Cookies and similar technologies

We use strictly necessary cookies to run the Service and, with consent where required, analytics or preference cookies. You can control cookies in your browser; disabling some may affect functionality.

9. Data retention

We retain information as long as needed to provide the Service and for legitimate or legal purposes. On cancellation, Customer Data is available for export for a limited period, then deleted or de-identified, unless longer retention is required by law. Backups are purged on a rolling schedule.

10. Security

We use administrative, technical, and organizational safeguards including access controls, tenant isolation, encryption in transit, and row-level security. No method is 100% secure. You are responsible for safeguarding your credentials.

11. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing, to object, and to withdraw consent.

• Canada (PIPEDA and Alberta PIPA): access and correction; we are subject to Alberta's PIPA and federal PIPEDA.
• EU / UK (GDPR): the rights above, plus the right to complain to a supervisory authority.
• California (CCPA/CPRA): rights to know, delete, correct, and non-discrimination; we do not sell or share personal information as defined there.

To exercise a right, contact privacy@alomi.ai. If your request concerns data in a customer's tenant, we may refer you to that customer and assist them.

12. Children's privacy

The Service is for business use and is not directed to children; we do not knowingly collect their information.

13. Changes to this Policy

We may update this Policy and will post the new version with a new "Last updated" date and additional notice for material changes where required.

14. Contact

1996058 Alberta Ltd. (o/a "Alomi") — operator of Alomi. Privacy: privacy@alomi.ai · General: hello@alomi.ai · Legal: legal@alomi.ai · 3740 11A Street NE, Suite C201, Calgary, AB T2E 6M6, Canada. In Alberta, you may contact the Office of the Information and Privacy Commissioner of Alberta, or federally the Office of the Privacy Commissioner of Canada.