Privacy Policy

Who we are

Alvara is a personal finance assistant that lets you record and understand your spending by chatting with it in plain language, by text, voice note, or a photo of a receipt, and by reviewing your finances in a web dashboard. The Service is currently operated by its founder, an individual based in Dubai, United Arab Emirates (the "Operator"), who is the data controller for the purposes of this Policy.

We expect to transfer operation of the Service to a company registered in the United Arab Emirates. If we do, that entity will become the Operator and data controller and will assume this Policy, and we will update the details on this page. For any privacy question or request, contact us at contact@alvara.ae.

Information we collect

We only collect what we need to run the Service for you:

• Account information. Your email address, an encrypted password, and your plan. Authentication is handled by our provider (Supabase Auth); we never store your password in plain text.
• Financial information you provide. The transactions, amounts, categories, accounts, budgets, vehicle and fuel logs, and investment entries you choose to record. Sharing balances is optional, and the Service works without them. This data exists because you entered it, and it is yours.
• Messaging identifiers and content. When you connect a WhatsApp or Telegram account, we process your WhatsApp or Telegram user identifier and the messages, voice notes, and images you send to the assistant so we can log and answer questions about your finances.
• Voice and images. Voice notes are transcribed to text and receipt or statement photos are read to extract the transaction details. We use these only to fulfil the request you made.
• Security and technical data. Sign-in events and a coarse device or browser description (from your User-Agent), used to send you new sign-in alerts and power optional two-factor authentication.

How we use your information

• To provide the Service: record, categorize, and display your finances.
• To understand your messages, transcribe voice notes, read receipts, and answer your finance questions.
• To generate the analytics, budgets, and insights you ask for.
• To operate, maintain, secure, debug, and improve the Service.
• To keep your account secure, including two-factor authentication, new sign-in alerts, and abuse prevention.
• To communicate with you about the Service (for example password resets, invites, and the reports you opt into).
• To comply with our legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use your personal financial data for advertising.

Legal bases for processing

Where data-protection law (including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data) requires a legal basis, we rely on one or more of the following: your consent (which you may withdraw at any time); the performance of our contract with you to provide the Service; our legitimate interests in operating, securing, and improving the Service in a way that does not override your rights; and compliance with a legal obligation.

Artificial intelligence

We use trusted third-party artificial-intelligence providers (currently Anthropic and OpenAI) to interpret your messages, transcribe voice notes, read receipts, and generate insights. These providers process your content only to perform those tasks on our behalf, under terms that prohibit using it to train their models. We do not use your personal financial information to train public or general-purpose AI models.

Aggregated and de-identified information

We may create aggregated, anonymized, or de-identified information from data in the Service, meaning information that does not identify you and cannot reasonably be used to identify you, whether on its own or combined with other information we hold. Such information is no longer personal data. We may use, retain, and disclose aggregated or de-identified information for any lawful purpose, including to operate and improve the Service and to produce statistics, research, and market or industry insights, including for commercial purposes. We will not attempt to re-identify de-identified information, and we will never sell or share information that identifies you personally.

How we share information

We share data only with the service providers that make Alvara work, each acting on our behalf and bound to protect your data:

• Anthropic (Claude) — to interpret your messages and generate finance insights.
• OpenAI — to transcribe voice notes to text.
• Supabase — database hosting and authentication.
• Meta Platforms (WhatsApp Business Platform) — to deliver and receive your WhatsApp messages.
• Telegram — to deliver and receive your Telegram messages.
• Resend — to send transactional email such as password resets and alerts.
• Railway — application and server hosting.
• PostHog for privacy-friendly, EU-hosted product analytics that help us understand how the Service is used.

We may also share information: with your consent or at your direction; as aggregated or de-identified information as described above; in connection with a merger, acquisition, financing, reorganization, or transfer of all or part of the business (including a transfer to the company that takes over operation of the Service), where the recipient agrees to honour this Policy; and if required by law, or to protect the rights, safety, and security of Alvara and its users.

Cookies and local storage

We use your browser's local and session storage to keep you signed in and to remember your preferences. These are essential to the Service. We do not use third-party advertising cookies or sell data gathered through cookies.

Analytics

We use PostHog, a first-party, EU-hosted product analytics tool, to understand how visitors use our public website and app so we can improve them. It records page views, clicks, and basic device information. We do not sell this data and we do not use it for advertising. Session recordings, where enabled, are limited to our public marketing pages and never capture your financial data inside the app.

Data retention

We keep your account and financial data for as long as your account is active so the Service can show you your history. Voice notes and images are processed to extract the relevant details and are not retained as media beyond what is needed to complete your request. You can delete individual transactions at any time, and you can ask us to delete your account and associated data (see "Your rights" below). We may retain limited information where we are required to by law or to resolve disputes and enforce our agreements.

Security

We protect your data with encryption in transit and at rest, hashed credentials, access controls so each user can only reach their own data, and optional two-factor authentication. No method of transmission or storage is perfectly secure, but we work to safeguard your information and to notify you and any competent authority of significant security incidents where required by law.

Your rights and choices

You are in control of your data. Subject to applicable law, you can exercise the following rights:

• Access and review your data in the dashboard at any time.
• Correct or delete individual transactions and entries.
• Disconnect a linked WhatsApp or Telegram account.
• Withdraw consent, or object to or ask us to restrict certain processing.
• Request a copy of your data in a portable format.
• Request deletion of your account and all associated data by emailing contact@alvara.ae from the email on your account. We will delete your data within 30 days, except where we are required to retain it by law.

You also have the right to lodge a complaint with the competent UAE data protection authority if you believe we have not handled your data properly.

Children's privacy

Alvara is not directed to children. The Service is intended for users aged 18 and over, and we do not knowingly collect data from anyone under that age. If we learn that we have collected data from a child, we will delete it.

International data transfers

Alvara is operated from the United Arab Emirates and relies on service providers that may process data in other countries. Where your data is transferred internationally, we take steps to ensure it remains protected in line with this policy and applicable law.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above, and significant changes will be communicated through the Service. Your continued use of the Service after an update means you accept the revised Policy.

Contact us

For any privacy question or request, email contact@alvara.ae.