Privacy policy

Account holders are the people who sign in: an owner, a member of staff, a contractor with a seat. They chose to create an account.

Contacts are everybody else. If you sent a business a direct message, filled in one of its forms, booked a call, or replied to a text, your details are in that business’s account. You never signed in and you may never have heard of Alvand. This policy covers you too, and the deletion page linked at the top is written for you.

From account holders:

• Name, email address, and a password stored only as a one way hash.
• Sign in sessions, and the IP address and browser reported at sign in. These are kept so an account can show where it has been used and so a stolen session can be ended.
• A record of significant actions taken inside the account, which is what makes it possible to answer who changed something and when.
• Counts of AI usage and other metered activity, for billing.

About contacts, held inside the business’s own account:

• Name, email address, phone number, and Instagram handle and profile picture where the business has them.
• Messages sent and received: Instagram direct messages and comments, text messages, and form answers.
• Bookings, including the time chosen and anything typed into the booking form.
• Notes, tags and pipeline position that the business records about the relationship.
• Payment records: amounts, status, and the reference the payment processor returns. Card numbers never reach Alvand servers.
• Files the business uploads, such as images, video and documents.

• Directly from you, when you message a business, complete a form, or book a call.
• From the business itself, which may already hold your details and import or type them in.
• From services a business connects and authorises: Meta for Instagram, Google, Twilio for text messaging, and payment and calendar providers.

When a business connects an Instagram account, Alvand receives that account’s direct messages, comments, profile information and post statistics, using an access token that the account holder granted on Meta’s own screen. That token is encrypted before it is stored, and it is used only to show the messages in that business’s inbox and to send the replies that business asks to send. It is never used to read anything belonging to a different business.

A business using Alvand can turn on an assistant that reads incoming messages and writes replies on its behalf. Where that is on, the first replies you receive may be written by software rather than typed by a person. You can ask to speak to a person at any point and the conversation is handed to one; the business can also take it over at any time, and does so automatically once somebody there answers.

Nothing is sent to you unprompted. An automated reply is sent only inside the conversation you started, only in response to a message you sent, and only within the window Meta allows after your most recent message, which is currently twenty four hours. After that window a business can reply only by hand and only within the limited categories Meta permits. Message text is sent to Anthropic to generate the reply, is not used to train models, and the conversation is stored in that one business’s account and nowhere else.

Replying STOP to a text message stops texts immediately. For Instagram, asking the business to stop messaging you, or blocking the account, ends it, and you can revoke Alvand’s access to your own Instagram account at any time in Instagram under Settings, then Website permissions.

• To deliver the thing that was asked for: send the reply, confirm the booking, take the payment, publish the post.
• To keep accounts secure and to investigate suspected misuse.
• To bill for usage and to keep accurate financial records.
• To keep the service reliable, which means error logs and performance measurements. These deliberately omit message content and form answers.

Alvand does not sell personal information, and does not use the contents of a business’s conversations to advertise to anybody.

Alvand runs on services that necessarily handle the data in order to provide their part of it. Each is used for one purpose and nothing else:

• Vercel and Supabase, which run the application and the database.
• Cloudflare R2, which stores uploaded files and backups.
• Upstash, which holds the queue of work waiting to run.
• Meta, for Instagram messaging and comments.
• Twilio, for text messages and phone numbers.
• Google, where a business connects Sheets, Drive, Docs, Gmail or Calendar.
• Anthropic, where a business turns on the AI setter or AI drafting. Message text is sent to generate a reply and is not used to train models.
• A payment processor, where a business takes payments, which handles card details directly so that Alvand never receives them.
• An email server the business configures, for booking confirmations and account email.

Beyond those, information is disclosed only where the law requires it, or as part of a sale or merger of the business, in which case this policy travels with it.

Every business’s data is isolated at the database itself, not merely in application code: each row carries the business it belongs to, and the database refuses to return rows belonging to anybody else even if the application asks wrongly. Access tokens and connected service credentials are encrypted before storage. Traffic is encrypted in transit.

No system is perfect, and saying otherwise here would be a claim rather than a protection. If a breach affects your information, you will be told.

Account data is kept while the account is open. Deleted records are held in a recoverable state for a short period so that an accidental deletion can be undone, and are then removed. Financial records are kept as long as tax and accounting law requires. Anything erased on request is erased permanently, and only a record that the erasure happened remains.

• Ask what is held about you, and get a copy.
• Have anything inaccurate corrected.
• Have your information deleted.
• Stop text messages at any time by replying STOP, which is honoured automatically and immediately.
• Disconnect a connected account at any time from the Connections screen, which revokes the token.

Alvand AI is business software and is not intended for anybody under 18. Accounts are not knowingly created for minors, and information belonging to one is deleted on discovery.

When this policy changes, the date at the top changes with it. A change that materially affects what is collected or who receives it is announced inside the product before it takes effect.

Alvand Consulting LLC, 3111 N Houston St. Email info@ramaalvand.com.