Privacy policy

AlpacaRelay LLC
New Hampshire, United States
Email: support@alpacarelay.com

We operate the Service from the United States and serve users globally.

2.1 Information You Provide
We collect information you provide directly, including:
• Account information (e.g., name, email address)
• Subscription and billing contact information (including transactional information)
• Inputs you submit to generate content (e.g., prompts, instructions, drafts)
• Service usage information
• Communications with us (e.g., support emails)
• Information generated in connection with providing the Service, such as usage metrics, analytics, and system-derived insights

2.2 AI Inputs and Outputs
Inputs you submit and Outputs generated by the Service may include personal data, depending on the nature of the information you provide and how you use the Service.

2.3 Payment Information
Payments are processed by third-party payment processors such as Stripe. We do not store credit card numbers or full payment details.

2.4 Automatically Collected Information
We may automatically collect:
• IP address
• Device and browser information
• Account access information
• Usage data (features used, pages accessed)
• Log and diagnostic data
• Cookies and similar tracking technologies, which may include: (i) session and functional cookies that support account login and core Service functionality; (ii) analytics cookies that help us understand how visitors interact with our website (e.g., Google Analytics); and (iii) advertising and conversion tracking tags from third-party platforms, including Google Ads, LinkedIn, Meta, Microsoft Advertising, and Reddit, which allow us to measure the effectiveness of our advertising campaigns and may enable those platforms to show our advertisements to you on other sites and services. You may disable cookies through your browser settings or opt out of interest-based advertising through the Digital Advertising Alliance or the Network Advertising Initiative by visiting their respective websites.

2.5 Connected Account Data
When you use a Connected Account to send emails, we automatically generate and retain send audit log data, including hashed recipient addresses, hashed subject lines, provider-returned message IDs, requesting IP addresses, send timestamps, and campaign identifiers.

We use information to:
• Provide, operate, and maintain the Service
• Create and manage user accounts
• Process subscriptions and payments
• Generate AI-based Outputs
• Improve, train, and enhance our models and services, except where prohibited by applicable data source restrictions
• Communicate with users regarding the Service
• Provide customer support
• Detect fraud, abuse, or security issues
• Comply with legal obligations

4.1 Model Improvement
We may use Inputs and Outputs to improve, train, fine-tune, and enhance our models and services. Notwithstanding the foregoing, data obtained via Google API connections is excluded from model training and improvement activities. See the Google User Data section of this Privacy Policy for details.

4.2 Anonymization and Aggregation
Where feasible, we use Inputs and Outputs in anonymized or aggregated form, including for analytics, benchmarking, and product improvement except where prohibited by applicable data source restrictions.

4.3 Marketing Use
We may use anonymized or sanitized Outputs for marketing and promotional purposes. We do not use identifiable personal data for marketing without consent.

AlpacaRelay requests the gmail.send scope, which permits sending email on your behalf. AlpacaRelay does not read, store, modify, or access any other content of your Gmail mailbox, including incoming messages, drafts, labels, or contacts.

How we use it. We use this access solely to dispatch emails that you or an authorized member of your account have explicitly composed and queued through the AlpacaRelay interface.

How we store it. OAuth refresh tokens associated with your Gmail connection are stored in an encrypted vault managed by Nango, a third-party OAuth infrastructure provider (AES-256 at rest). Tokens are never logged, exported, or accessible outside of the authenticated send process.

How we share it. AlpacaRelay does not transfer Google user data to any third party, AI/ML training pipeline, advertising network, or analytics provider. For further detail on subprocessors with access to your data, see our Data Processing Addendum.

Deletion. Upon disconnection or account deletion, your OAuth refresh token and any associated metadata are permanently deleted within 90 days.

Limited Use. AlpacaRelay’s use of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We may share information with:
• Service providers for Gmail account connections: OAuth token vault and authenticated API proxy (Nango)
• Payment processors (e.g., Stripe)
• Other service providers (e.g., hosting, analytics, customer support)
• Professional advisors (legal, accounting)
• Authorities where required by law
• Successors in the event of a merger, acquisition, or asset sale

We do not sell personal information.

We do share certain information — such as cookie identifiers and browsing activity on our marketing website — with third-party advertising platforms (including Google, LinkedIn, Meta, Microsoft, and Reddit) for cross-context behavioral advertising purposes. California residents have the right to opt out of this sharing; see California Privacy Rights below for details.

We may process and store information in the United States and other jurisdictions. Where required, we rely on appropriate safeguards for international data transfers in accordance with applicable law.

We retain information only as long as reasonably necessary to:
• Provide and operate the Service
• Comply with legal and regulatory obligations
• Resolve disputes
• Enforce our agreements

Retention periods vary depending on the nature of the information and the purpose for which it is processed. We do not intentionally retain cardholder data.

Send audit logs generated through Connected Account email sends are retained for a minimum of 12 months. Audit log entries contain hashed recipient addresses and hashed subject lines — plaintext recipient or email content is not retained in the audit log.

We implement reasonable administrative, technical, and organizational safeguards designed to protect information. However, no system is completely secure, and we cannot guarantee absolute security.

10.1 General Rights. Depending on your location, you may have certain rights to:
• Access your personal data
• Correct inaccurate data
• Request deletion
• Object to or restrict processing

Requests may be submitted to support@alpacarelay.com. We will use commercially reasonable procedures to review and respond to requests in accordance with applicable law. We may need to verify your identity before processing a request.

10.2 Connected Account Disconnection
If you have connected a Gmail account, you may disconnect it at any time from Settings → Connected Apps. Upon disconnection, AlpacaRelay will revoke your OAuth token at the provider’s endpoint and delete it from Nango’s vault. All associated tokens and metadata will be permanently deleted within 90 days of disconnection or account deletion.

10.3 California Privacy Rights (CCPA / CPRA)
If you are a California resident, California law provides you with the following additional rights:

Right to Know. You may request disclosure of the categories of personal information we collect, the sources of that information, the purposes for which we use it, and the categories of third parties with whom we share it. You may also request the specific pieces of personal information we have collected about you.

Right to Delete. You may request deletion of personal information we have collected about you, subject to certain exceptions (e.g., information we are required to retain by law).

Right to Correct. You may request correction of inaccurate personal information we hold about you.

Right to Opt Out of Sale or Sharing. We share certain cookie and browsing data with third-party advertising platforms for cross-context behavioral advertising purposes. You have the right to opt out of this sharing. To opt out, submit a request to support@alpacarelay.com. You may also opt out of interest-based advertising directly through the Digital Advertising Alliance or the Network Advertising Initiative by visiting their respective websites, or by disabling cookies through your browser settings.

Right to Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights.

To submit a California privacy rights request, contact us at support@alpacarelay.com. We will use commercially reasonable procedures to verify your identity and respond in accordance with applicable timeframes under California law.

The Service is not intended for individuals under 18, and we do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. Updated policies will be posted on our website with a revised “Last Updated” date. Continued use of the Service after the effective date of any change constitutes acceptance of the updated Policy.

Questions about this Privacy Policy may be directed to support@alpacarelay.com.

AlpacaRelay LLC
1 Hattie Ln, Wolfeboro, NH 03894
Email: support@alpacarelay.com