Privacy Policy

Last updated: September 22, 2026

1. Who we are

Alba ("Alba", "we", "us") is a software service, based in Ontario, Canada, that helps businesses organize, prioritize and answer their WhatsApp messages with artificial intelligence. It is available at heyalba.app.

This policy explains what personal information we collect, why, who we share it with and what rights you have. It applies to our website, the Alba dashboard (heyalba.app/app) and the WhatsApp connection we provide.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for users in Brazil, the Lei Geral de Proteção de Dados (LGPD). Our privacy contact is reachable through our contact form (choose "Privacy and my data").

2. Two kinds of data, two roles

• Your account data (you, the business owner or staff member who signs up). For this data, Alba decides how it is used and is responsible for it.
• Your customers' data (the people who send WhatsApp messages to your business). Here Alba acts as a service provider working on your behalf and only following your instructions. Your business remains responsible for having a valid reason to process those messages and for telling your customers how you handle their information.

3. What we collect

Account and profile

• Name, business name, email address, phone number and your preferred language.
• Your password, stored only as a secure one way hash. If you sign in with Google, we receive your name, email address and Google account ID, and nothing else from your Google account.
• Your settings: plan, enabled features, priority rules (S to D), business hours, time zone and integration address.

WhatsApp data (once you connect your number)

• Your WhatsApp Business account ID and phone number ID, and the access token that Meta issues so Alba can work with your number.
• Messages exchanged with your customers: text, voice messages, sender name and phone number, date and time, and messages you send from your phone app (so Alba knows a chat was answered).
• What Alba produces from those messages: priority tier, urgency, topic, summary, labels, suggested replies, voice message transcripts, appointments and notes you add.

Billing

• Your plan, currency, subscription status and the Stripe customer and subscription IDs. Card or Pix details go directly to Stripe and are never stored on our servers.

Technical data

• IP address and basic request logs, kept for security and to block abuse (for example, repeated failed logins).
• Cookies, described in section 8.

Messages you send us

• What you write in our contact or integration forms, so we can answer you.

4. How we use it

• To create and secure your account and let you sign in.
• To provide Alba: receive your WhatsApp messages, rank them by priority, summarize them, transcribe voice messages, suggest replies, send the replies you approve, manage appointments and show your numbers.
• To send data to your own system, only when you turn on the integration feature and give us the address.
• To charge your subscription and unlock or suspend access according to your payment status.
• To answer your questions, give support and tell you about important changes to the service.
• To keep Alba safe, prevent fraud and meet legal obligations.

We do not sell personal information, we do not use it for advertising and we do not build profiles of your customers for any purpose other than serving your business.

5. Artificial intelligence

Alba uses a large language model provided by Anthropic (Claude) to read incoming messages and produce the priority, summary and suggested reply. Only the content needed for that task is sent, and only when a message arrives or you ask for an action. Voice messages are transcribed on our own server.

We do not use your data or your customers' data to train AI models, and our AI provider processes it under commercial terms that do not allow training on it. AI output can be wrong, so Alba shows it to you as a suggestion. On plans where automatic replies are available, Alba only replies about the topics you allow.

6. Who we share it with

We share personal information only with the service providers below, only as needed to run Alba, and under contracts that require them to protect it:

We may also disclose information if required by law or a valid legal request, or to protect the rights and safety of our users or of Alba. If Alba is ever sold or merged, your information would move to the new owner under this same policy, and we would tell you first.

7. International transfers

Because of the providers above, your information may be stored or processed outside your country, including in the European Union and the United States. Those countries may have different privacy laws, and authorities there may be able to access the information under their own laws. We choose providers with strong security and privacy commitments to keep your information protected wherever it is processed.

8. Cookies and local storage

• alba_s: keeps you signed in to the dashboard (30 days).
• alba_g: protects the Sign in with Google step (10 minutes).
• Local storage: remembers your language and currency choice.

We do not use advertising or tracking cookies and we do not use third party analytics.

9. How long we keep it

• Account, settings and conversation data: while your account is open. After you close your account or ask us to delete it, we delete it within 30 days.
• Billing records: as long as tax and accounting laws require (in Canada, generally 6 years). Stripe keeps its own records under its policy.
• Security logs: up to 12 months.

10. Security

All traffic is encrypted with HTTPS. Passwords are stored as salted hashes, sessions use secure cookies, each business account is kept separate from the others, and WhatsApp and Stripe notifications are verified by digital signature before we accept them. No system is perfectly secure, but if a breach ever puts your information at real risk, we will tell you and the authorities as the law requires.

11. Your rights

You can ask to access, correct, export or delete your personal information, withdraw consent, or ask how it is used. Users in Brazil also have the rights in article 18 of the LGPD, including confirmation of processing, anonymization, portability and information about sharing. Send your request through our contact form. We answer within 30 days and may ask you to confirm your identity.

If you are a customer of a business that uses Alba, please contact that business first, since it decides how your messages are handled. We will help it answer your request.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Brazil, to the ANPD (gov.br/anpd).

12. How to delete your data

1. Open our contact form and choose "Privacy and my data".
2. Write "Delete my data" and use the email address of your Alba account.
3. We confirm the request by email and delete your account, WhatsApp connection data, conversations and settings within 30 days. We only keep what the law requires us to keep, such as billing records.

You can also disconnect Alba from your WhatsApp Business account at any time in Meta Business Settings. For users who signed in with Google, you can remove Alba's access at myaccount.google.com/permissions.

13. Google user data

When you choose Sign in with Google, Alba only requests your basic profile (name, email address and account ID) to create and identify your account. Alba's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not share Google user data with third parties except as needed to run Alba, and we never use it for advertising.

14. Children

Alba is a service for businesses and is not meant for anyone under 18. We do not knowingly collect information from children.

15. Changes to this policy

If we change this policy in a meaningful way, we will update the date above and tell account holders by email or in the dashboard before the change takes effect.

16. Contact

Questions or requests about privacy: use our contact form and choose "Privacy and my data". Alba, Ontario, Canada.