Privacy policy

Actum Technologies Inc., a Delaware corporation (“we”, “us”, or “our”), operates Alfred Pierce, the hosted AI assistant at alfredpierce.com and app.alfredpierce.com, including its connected messaging and productivity features (the “Service”). This policy explains how we handle personal information when you visit our website, use a workspace, contact us, or connect another account.

1.Responsibility and contact

Actum Technologies Inc. is the controller of personal information used to administer the Service, including account, support, security, and billing records. For content processed on an organisation’s instructions, that organisation determines the purposes of processing and we act on its behalf. Your organisation’s policies and any applicable data processing agreement also govern that use. Workspace administrators manage membership and connected accounts; use a workspace only for information you are authorised to share there.

Our business address is Actum Technologies Inc., 2093 Philadelphia Pike, Suite #8355, Claymont, DE 19703, United States.

For privacy questions, access requests, deletion, or security concerns, contact support@alfredpierce.com. If your organisation manages your workspace, you can also contact its administrator. We will help route requests concerning data controlled by that organisation.

2.Information we handle

• Account and workspace details: names, email addresses, account and workspace identifiers, membership, settings, and authentication records.
• Work you give Alfred: messages, voice recordings and transcripts where used, uploaded files, instructions, preferences, memories, routines, and the reports or other output created from them.
• Connected accounts: the information described below, granted permissions, connection identifiers, and access or refresh tokens, API keys, app-specific mail passwords, or other credentials you explicitly provide through a supported connection flow. OAuth sign-in takes place with the provider. Never send account passwords or keys in support email or ordinary chat.
• Service and support records: usage and credit totals, billing records where applicable, support correspondence, IP addresses, browser or device information, timestamps, and diagnostic or security events.

We receive information from you, authorised workspace members, the services you connect, and your use of the Service. Connected content may include information about correspondents, customers, colleagues, or other people. Only provide or connect information you have a lawful basis to use.

3.Connected services and permissions

This policy applies to all connections you use with Alfred, including OAuth apps, API-key connections, mail clients, browser sessions, and custom tools. Connections are optional. The available features and permissions shown during connection determine what Alfred can access; this list does not mean every integration is available in every workspace or that every listed permission is requested. We request permissions needed for enabled features and use them for your instructions and configured routines. Google Calendar, Drive, Docs, and Sheets are separate optional connections, each requesting its own service permissions. Its basic account grant identifies your account; it does not grant Gmail access. Gmail is a separate mail-client connection using the mailbox access you authorise, such as an app-specific password.

Data and purposes for available, authorised connections

Connection and data	Purpose
Google account profile Email and account identifier, as authorised.	Identify and display the Google account connected to your workspace.
Gmail and other mailboxes Authorised mail-client access, separate from the Workspace OAuth connection. Messages, threads, senders and recipients, subject lines, bodies, attachments, labels, and drafts within granted permissions.	Find and summarise correspondence, prepare replies, and, when authorised by your instructions or routines and permissions, send messages, manage drafts and labels, archive, or delete mail.
Google Calendar Calendars, availability, event details, and attendees.	Check availability, prepare briefings, and create or update meetings as instructed.
Google Drive, Docs, and Sheets Permitted files, metadata, document text, and spreadsheet contents.	Find, read, summarise, create, edit, or organise documents and records for your tasks. The Drive connection uses per-file access for files created by, opened with, or shared with the app. Docs and Sheets have separate document and spreadsheet permissions; these are not limited by the Drive per-file scope. Review each service’s consent screen.
monday.com Account and user identifiers, workspaces, boards, items, columns, updates, and files allowed by the connection.	Answer project questions, summarise progress, and create or update tasks and board information at your direction.
Slack and Telegram User and conversation identifiers, messages, files, and voice content made available to the integration.	Receive instructions, maintain conversational context, and deliver replies, files, and scheduled results to your chosen conversations.

Other business tools

The same purpose limits, security rules, AI disclosures, and deletion controls apply to the following categories. Examples describe connections we support or are developing; they are not a promise of availability. Only an enabled connection that you authorise supplies data. Additional data types or purposes require an updated disclosure and any necessary consent before access begins.

Customer relationship management

Contact details, company records, leads, deals, notes, activities, and account identifiers. Used to answer customer questions, prepare follow-ups, and update authorised pipeline records.

Examples: HubSpot, GoHighLevel, Pipedrive, Apollo, Zoho CRM, Close, Attio, Salesforce.

Projects and work management

Workspaces, boards, projects, tasks, assignees, due dates, comments, documents, attachments, and time or status records. Used to track work, prepare progress reports, and create or update records you request.

Examples: ClickUp, Asana, Monday.com, Airtable, Trello, Teamwork, Productive, Basecamp.

Advertising and social accounts

Account and business identifiers, authorised Pages or profiles, posts, comments, messages, creative assets, campaign settings, budgets, and performance reports. Used to prepare and publish approved content, report results, and manage campaigns at your direction. Connecting a business advertising account does not permit us to use your other connected data for advertising.

Examples: Google Ads, Meta Ads, Facebook Pages, Instagram, TikTok Ads, LinkedIn Ads, LinkedIn Company Pages, Microsoft Advertising, Buffer, X.

Reporting, analytics, and search

Selected sites, properties, businesses, locations, search queries, rankings, traffic and conversion reports, call metadata, and associated customer records where authorised. Used to monitor your business performance and prepare requested reports. This is separate from tracking visitors to the Alfred website.

Examples: Google Analytics, Google Search Console, Google Business Profile, Semrush, Ahrefs, DataForSEO, BrightLocal, CallRail, AgencyAnalytics.

Email marketing and outreach

Lists, subscriber or prospect contact details, consent and suppression status, campaigns, templates, replies, and delivery or engagement results. Used for your authorised campaigns and follow-ups. We respect opt-outs and do not use connected contact lists to market Alfred or combine unrelated provider data into advertising audiences.

Examples: Mailchimp, Klaviyo, ActiveCampaign, Instantly, Smartlead, Brevo, MailerLite, beehiiv, lemlist, Kit.

Websites, commerce, and creative work

Sites, pages, products, orders, customer and fulfilment details, designs, media, channels, and publishing or performance metadata. Used to maintain your content, prepare creative work, report on orders, and perform authorised store or publishing tasks. Only the fields needed for the task are requested.

Examples: WordPress, Webflow, Shopify, Canva, WooCommerce, Wix, Squarespace, Figma, YouTube, Pinterest.

Meetings, forms, and customer support

Meeting participants, recordings and transcripts, summaries, form definitions and responses, tickets, customer contact details, and support conversations. Used for meeting notes, follow-ups, intake, and support work. You must have the necessary participant notices and recording consent before supplying audio or video.

Examples: Fathom, Fireflies, Tally, Typeform, Granola, tl;dv, Jotform, Intercom, Freshdesk, Zendesk.

Finance, billing, documents, and time tracking

Business account identifiers, customer and supplier records, invoices, transactions, balances or reports available to the integration, time entries, and document or signature status. Used for reconciliation, reporting, document preparation, and specifically authorised account actions. This does not authorise credit scoring or unrelated lending decisions. Do not send full payment-card details or banking passwords in chat.

Examples: Stripe, QuickBooks Online, Xero, FreshBooks, Harvest, Toggl Track, Clockify, PandaDoc, PayPal.

Automation and developer tools

Selected workflows, repositories, code, issues, deployment and project records, database content, analytics events, logs, and authorised job inputs and results. Used to investigate problems, write or review code, maintain systems, and run your workflows. Custom connections can access sensitive business data, so restrict their account permissions and destinations.

Examples: Make, n8n, GitHub, Linear, Apify, Zapier, PostHog, Supabase, Vercel, Sentry.

Voice and creative AI tools

Prompts, source images or media, voice samples, phone numbers, call audio and transcripts, generated content, and task metadata within the enabled feature. Used for authorised voice, calling, transcription, image, or media tasks. You must have permission to use a person’s voice and comply with calling and recording rules; a connection does not authorise deceptive impersonation.

Examples: ElevenLabs, Vapi, Retell AI, fal, Replicate.

Additional calendars, meetings, and file storage

For available calendar, scheduling, video-meeting, and storage connections such as Calendly, Zoom, and Dropbox, we process the authorised account details, availability, bookings, attendees, files, and meeting content needed for your scheduling, filing, and follow-up tasks. Other office suites require their own enabled connection and consent; connecting Google does not connect another suite.

Credentials, browsers, and custom connections

When you authorise a browser session, the Service may retain cookies and session state so Alfred can continue your work. Pages, screenshots, downloads, and form entries needed for that task may be processed by the browser and AI services below. Website actions remain subject to that website’s terms and your authority.

API-key and custom tool connections use the credentials, destinations, and permissions you approve. Removing a key from Alfred does not revoke it at the issuing service: rotate or revoke it there as well. A custom API or Model Context Protocol (MCP) server receives the requests and content sent to it and returns task results; its operator’s own terms and privacy practices also apply. Grant only the access required and do not use a custom connection to bypass another provider’s restrictions.

Information copied between connected apps remains subject to the source provider’s restrictions. We do not transfer it merely because both apps are connected. A transfer must be part of your authorised task and permitted by the relevant provider rules.

Requested actions may send information to recipients or change records in another service. You control those actions through your instructions, routines, and granted permissions. A standing routine may run when you are offline. Disconnecting an account stops future access; it does not undo messages already sent or edits already made.

4.Google data and Limited Use

• Google data, including derived content, is used only for the appropriate, visible features you authorise.
• We do not sell it, use it for advertising, transfer it to data brokers, or use it for creditworthiness or lending decisions.
• We do not use Google data to train, develop, or improve AI or machine-learning models. Task processing by AI is described below.
• Transfers are limited to consented features, necessary security investigations, legal obligations, or a business transfer with your explicit prior consent.
• People may read Google content only with your documented permission for specific data, when necessary for security, or as required by law. Routine operations or support alone do not authorise access.

These restrictions also apply to our service providers and take precedence over broader sharing provisions in this policy.

5.How we use information and AI

We process information to run your workspace, respond to instructions, execute routines, preserve relevant context, authenticate accounts, administer credits and billing, resolve support requests, and protect service reliability and security.

To carry out a task, relevant instructions, conversation history, retrieved content (including email bodies or attachments when needed), and tool results may be transmitted to AI model providers for inference: generating a response or deciding the next step in your task. Results may be saved in conversations, files, or workspace memory and sent to a destination you request. Memory processing can include extracting facts, generating embeddings, and ranking relevant memories. Browser tasks may include page content and screenshots; search tasks may include queries and URLs. Saved context and inference are distinct from training a model.

We do not train AI models on your connected-service content. Our service-provider processing must preserve that restriction, including when a model request is routed through an intermediary. A customer-funded model connection does not remove the restrictions attached to Google, Slack, or other provider data. Before connected data is shared with an AI provider, the connection or feature disclosure must explain that processing and obtain any required consent. You can decline a connection or stop using a feature that requires this processing.

Where data protection law requires a legal basis, we rely on performance of our contract for account administration and the Service, legitimate interests for proportionate security and support, legal obligations for required records, and consent where required for optional access or processing. You may withdraw consent without affecting the lawfulness of earlier processing. We do not use your personal information to make our own solely automated decisions with legal or similarly significant effects on you.

6.Who receives information

We do not sell personal information or share it for targeted advertising. Information is shared only as needed with:

• Service providers: hosting and storage, AI processing, authentication or email delivery, and billing and support providers where used, subject to appropriate confidentiality and data protection obligations.
• Your workspace and chosen recipients: members and administrators according to workspace access, and services or people to whom you instruct Alfred to send information. Check the destination before requesting a disclosure.
• Connected platforms: the platforms listed in the connected-app categories above when you enable their integration. Their own policies govern information they process independently.
• Legal and business recipients: where necessary to comply with law, protect rights or security, or carry out a business reorganisation with appropriate protections and notice. Google data requires the explicit prior consent described above for a business transfer. Other provider-specific restrictions also take precedence over this general sharing description.

Service providers and processing destinations

The hosted Service uses the following providers for the purposes shown. Which providers receive task content depends on the feature and model route used. A connected business app acts as a recipient only when you use that connection; it is not automatically a subprocessor for every workspace.

Providers used by the website and hosted Service

Provider / domains	Information and purpose
Amazon Web Services (AWS) amazonaws.com	Hosts the application, workspace computers, databases, files, credential storage, backups, operational logs, and email infrastructure. The hosted application infrastructure is configured in Northern Virginia, United States (us-east-1).
OpenAI api.openai.com; chatgpt.com	Processes instructions, relevant conversations, files, images, and tool results for AI responses, memory extraction, and image generation. Customer-authorised Codex/ChatGPT connections may provide the main model route.
OpenRouter and its selected model hosts openrouter.ai	Routes model requests and relevant task content for fallback responses, memory processing, embeddings, reranking, and video analysis. The downstream inference host depends on the model and routing configuration; a model’s brand does not by itself identify its host. Contact us for the recipients relevant to your workspace.
Browser Use browser-use.com and its subdomains	Provides hosted browser sessions. Processes task-related page content, screenshots, actions, downloads, and authenticated session state when Alfred works on websites.
Parallel parallel.ai and its subdomains	Processes search queries, requested URLs, and returned web content to search the web and extract information for your tasks.
Stripe stripe.com and its subdomains	Processes customer and billing information, checkout, subscription, payment, and invoice records for the Service. Payment details entered into Stripe checkout are processed by Stripe. Connecting your own Stripe business account is a separate optional finance integration.
Sentry sentry.io and its subdomains	Receives application error stack information and release/environment identifiers for troubleshooting. The hosted configuration filters out message bodies, request content, user profiles, local variables, and session replay.
GitHub Pages github.io; github.com	Hosts this public website at alfredpierce.com and processes website delivery requests, including IP addresses and technical request information.
Google Fonts fonts.googleapis.com; fonts.gstatic.com	Serves this website’s typefaces and receives font request information as described below.

Optional diagnostics: if content tracing is enabled for a workspace’s environment, Langfuse (langfuse.com and its subdomains, or a separately configured instance) can receive conversation and tool content with timing information. This content processing requires disclosure and an appropriate basis before activation and remains subject to connected-provider restrictions. It is separate from Sentry’s filtered error reporting.

Your chosen AI tools: connections such as ElevenLabs, Vapi, Retell AI, fal, or Replicate receive the voice, media, text, or call information you authorise for that feature. Their domains and processing terms are shown by the provider during setup. Such a connection is optional and does not authorise sending unrelated workspace content to it.

The public website loads fonts from Google Fonts at fonts.googleapis.com and fonts.gstatic.com. This sends Google your IP address and the request metadata needed to serve the fonts. See Google Fonts privacy information. Links to app.alfredpierce.com open the Service dashboard.

You can request information about the service providers processing your workspace data at support@alfredpierce.com.

7.Storage, security, and international processing

The Service stores workspace conversations, files, preferences, routines, and connection credentials so work can continue between sessions. Safeguards include workspace access controls, encrypted credential storage, and encryption for data in transit and at rest. Access must be limited to authorised purposes; no internet service can guarantee absolute security.

The hosted application’s primary infrastructure is in the United States. Model, browser, search, monitoring, payment, and connected-app providers may process information in other countries. Your information may therefore be processed outside your country. Where applicable law restricts international transfers, we use a valid transfer mechanism, such as an adequacy decision or standard contractual clauses, and additional safeguards where needed. Contact us for information about the safeguards relevant to your data. Report suspected unauthorised access to support@alfredpierce.com; we notify affected customers and authorities as required by applicable law.

8.Retention and deletion

We retain workspace content while it is needed to provide the workspace and your saved context. Retrieved data and derived content are subject to the same access and use restrictions as their source. Provider-specific limits, including cache restrictions, take precedence over general workspace retention; connecting an account does not authorise an indefinite archive of that account.

Removing a saved OAuth or API-key connection erases its usable credential values and stored refresh token from the active credential store. Connection identifiers and audit metadata may remain for security and account administration, subject to provider deletion rules. Provider-side OAuth revocation is attempted where supported; a successful local removal does not prove remote revocation. For mail-client credentials, browser sessions, and custom connections, use the removal instructions in our data deletion guide. Previously saved results may remain until deleted or the workspace closes, subject to the shorter provider rules below. Revoking provider access alone does not request deletion of all existing workspace content.

To request deletion of a connection’s stored data or your entire workspace, email support@alfredpierce.com from the account associated with it, specifying the workspace and what you want deleted. We may verify your identity or authority without requesting your password. We aim to complete verified general workspace deletion requests within 30 days and explain any lawful exception. Routine application database and workspace-file backups are configured for seven-day retention; backups and other retained copies must also follow any shorter provider-specific deadline. Temporary file-transfer copies expire after 24 hours, and standard infrastructure logs are configured for 30 days. These automatic limits do not delete the active conversation history, workspace files, memory, or billing records; those follow their stated purpose and deletion request. Records required by law or necessary for a specific dispute may be retained only for that purpose and as long as needed.

monday.com: following deauthorisation, deactivation, uninstallation, or termination by you or monday.com, all associated end-user data and metadata, including derived copies and backups, must be permanently deleted within 10 days unless you separately give explicit written consent to longer retention. The general deletion process does not extend this deadline.

Slack: when you remove the Slack app or we discontinue it, associated Slack data must be deleted within 14 business days. We honour requests to delete Slack data and do not use it to train language models. See the Slack App Developer Policy.

YouTube API data, where the feature is enabled: user-requested deletion is completed as soon as possible and within seven calendar days. Provider revocation and cache limits apply separately.

Telegram: we delete associated user data without undue delay when you or Telegram request it, when it is no longer needed, or when the bot stops operating, subject only to applicable legal obligations or your explicit agreement where permitted. Blocking the bot stops messages to you but does not itself erase copies in Alfred; use our deletion instructions.

Other providers: provider-specific deletion, consent, cache, and use limits also apply to raw content, extracted memories, summaries, indexes, logs, backups, and downstream processor copies. We do not retain those copies to avoid a provider’s requirements. A retained invoice for your Alfred subscription is separate from customer financial data retrieved through a finance connector.

Deleting information from Alfred does not delete originals held by connected providers or copies already delivered to others. Manage those copies with the relevant provider or recipient.

9.Your controls and rights

• Review permissions before connecting an account. You may decline optional connections, change routines, or ask us to remove a connection.
• Revoke Google access in your Google Account connections. For monday.com, use your account’s app administration to uninstall or revoke the app; ask your administrator if needed. Other providers offer their own app or integration controls.
• Request access, a copy, correction, deletion, restriction, or portability of your personal information, or object to processing, by emailing support@alfredpierce.com. These rights depend on applicable law and your relationship to the workspace.
• Withdraw consent for processing that relies on it. We respond to privacy requests within one month, or the period required by applicable law, and explain any permitted extension or reason we cannot fulfil a request.
• You may complain to your local data protection authority, including the authority where you live or work in the EEA or the UK Information Commissioner’s Office. We do not penalise you for exercising applicable privacy rights.

YouTube features, where available

A feature connected through YouTube API Services may process authorised channel details, video and playlist metadata, comments, uploads, and reporting data for your requested publishing or reporting task. This feature is subject to the YouTube Terms of Service and Google Privacy Policy. You can revoke authorisation in Google Account connections and request removal of stored data using our deletion instructions. Availability requires a separately enabled feature and the appropriate consent.

10.Website technologies

The public pages do not include advertising trackers or analytics scripts and do not set application cookies or local storage. Hosting infrastructure may process request logs for delivery and security, and the Google Fonts requests described above occur when a page loads. The signed-in Service may use cookies or similar storage needed for authentication and session security. Optional tracking, if introduced, requires a separate disclosure and consent where required.

11.Age requirement

The Service is intended for adults aged 18 or older and is not directed to children. If you believe a child has provided personal information to us, contact us so we can investigate and delete it where appropriate.

12.Policy changes

We publish updates here with a revised effective date. We notify workspace administrators before material changes take effect. If we introduce a new use of connected data or request additional access, we provide an updated disclosure and obtain required consent before that processing begins. Continuing to use the Service does not replace consent where consent is required.