Privacy policy

This policy says what personal data Alice Labs (labs.alice.tech) processes, why, for how long, and who we share it with. Alice Labs is an experimental beta (see our terms): what it does changes often, and we update this policy when it does.

1. Who we are

Alice AI ApS, a Danish company with CVR 44597144, is the data controller for the personal data described here (“we”, “us”). You can reach us at support@alice.tech.

A beta warning. Alice Labs is built quickly and changes often. We may reset or delete data while we build it. Please don't upload sensitive personal information, such as health data, ID numbers, or other people's personal details.

2. What we process, and why

2.1. Your account

When you sign in with Google, we get your name, email address and profile picture from Google. When you ask for access, we also keep what you tell us you'd study (if you write it), whether we may contact you, and whether you've been let in. We use this to give you access to the Service, to tell you when you've been let in, and, if you said we may, to contact you for feedback.

Legal basis: article 6(1)(b) of the GDPR, as it's needed to provide the Service to you; and article 6(1)(a), your consent, for contacting you for feedback, which you can withdraw at any time.

2.2. What you study

We store what you put in and what the Service makes from it: your courses, the files you upload (PDFs, images, documents) and the text and pictures read from them, summaries, knowledge blocks, practice questions and your answers, what you've learned, your chats with Alice, and files you attach to them.

Legal basis: article 6(1)(b) of the GDPR.

2.3. AI processing

To read your files, write summaries and practice, and answer you, we send your material and messages to AI models: OpenAI's models, hosted for us by Microsoft Azure. Microsoft doesn't use them to train models. It may keep them for up to 30 days to detect abuse.

Normally, this happens in Microsoft's data centre in Sweden, in the EU. When that region has an outage, we may send it to Microsoft's region in the United States (East US 2) until it's back. Images Alice draws for you are made by a model Microsoft doesn't offer in the EU, so their prompts may be processed outside the EU.

When you talk to Alice, your voice goes straight from your browser to Azure to be written out as text; we keep the text, not the recording. When Alice reads an answer aloud, its text goes to Azure to be spoken.

2.4. How you use the Service

We use PostHog (hosted in the EU) to learn how the Service is used and to find what's broken. It records pages you open, what you click, how fast things load, errors, your browser and device, and your IP address, linked to your account. It also makes session recordings, which replay your use of the Service like a video: what's shown on the page, including your files, your chats and Alice's answers, and where you move, click and scroll. We watch these recordings to see where the Service is confusing or broken. We also record what Alice was asked and answered, and how long it took, to find and fix bad answers.

Legal basis: article 6(1)(f) of the GDPR: our legitimate interest in running, fixing and improving the Service, which in a beta is the point of it.

2.5. Emails we send

We send emails about your access (for example, that you've been let in) through Resend. Legal basis: article 6(1)(b) of the GDPR.

2.6. When you contact us

When you email us, we process your message and your contact details to answer you. Legal basis: article 6(1)(f) of the GDPR, our legitimate interest in answering you.

2.7. When we look at your account to help

To help you or keep your account safe, our team may look at your account, in two cases:

• When you ask for help. If you report a problem, we may look into your account to find and fix it. We confirm it's you by the email address on your account.
• To protect you or the Service. Without you asking, when it's needed to deal with a security concern, such as suspected unauthorised access, or to fix a technical problem affecting your account.

In both cases, we do only what's needed, and we don't use your files or chats for anything else. Legal basis: article 6(1)(f) of the GDPR: our legitimate interest in supporting you and keeping the Service secure. You can object at any time (section 7).

3. Cookies and storage in your browser

We use no advertising cookies. We store:

• Sign-in cookies, to keep you signed in. Necessary for the Service.
• Your language, if you picked one, and how your panels are folded, as cookies, so the page is drawn right from the start.
• Your screen preferences (such as zoom, which files are ticked, reading aloud), in your browser's local storage. They stay on your device.
• PostHog's identifier, in a cookie and local storage, to tie your visits together for the analytics in section 2.4.

4. How long we keep it

We keep your account and what you study for as long as you have an account. You can delete a course, or your whole account, from the app at any time: deleting your account deletes your account, courses, files and chats. Some copies can stay in backups and logs for a short time after, until they're overwritten.

Because Alice Labs is a beta, we may delete data sooner: when we reset it while building, or when we end Alice Labs. We'll try to tell you first when we can, but we can't promise to.

Analytics are kept for as long as we need them to understand how the Service is used; session recordings are deleted after 30 days. Emails with our support are deleted 5 years after the end of the financial year your last question was answered in.

5. Who we share it with

We don't sell your data. We share it only with the companies that run parts of the Service for us (processors), under a data processing agreement with each:

• Convex: our database and backend.
• Vercel: hosts the website.
• Microsoft Azure: AI models, reading files, speech, and file storage (section 2.3).
• PostHog: analytics, session recordings, error tracking and records of Alice's answers (section 2.4).
• Resend: sending emails.
• Google: signing in.

We may also share data when the law requires it, and, if Alice AI ApS is merged, bought or reorganised, as part of that.

5.1. Outside the EU

Some of these companies are based in, or process data in, the United States. We transfer data there on the basis of the EU Commission's adequacy decision for the EU-U.S. Data Privacy Framework, or the EU Commission's standard contractual clauses (decision of 4 June 2021). Email us for more about these transfers.

6. How we keep it safe

We take reasonable technical and organisational measures to protect your data: we encrypt it where appropriate, limit who on our team can reach it, and keep backups. No system is perfectly secure, and Alice Labs is a beta, so please don't upload anything you couldn't bear to lose or have seen.

7. Your rights

You have the right to:

1. access the personal data we hold about you, and get a copy of it;
2. have it corrected if it's wrong;
3. have it erased;
4. restrict how we process it;
5. receive it in a structured, machine-readable format;
6. object to processing based on our legitimate interests;
7. withdraw your consent at any time, where processing is based on it.

To use any of them, email support@alice.tech from the email address on your account.

8. Complaints

You can complain to the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk. We'd like the chance to sort it out first, so please write to us too.

9. Contact

Alice AI ApS, Højbro Plads 10, 1200 København K, Denmark. CVR 44597144. support@alice.tech