Privacy policy

Version 1.0 · Last updated: 6 November 2026

This policy explains in general terms how the company that operates Alvara AI (the "Company") collects, uses, shares and protects personal data through its marketing site and application (the "Platform"). For the detailed information required by KVKK Article 10, see the KVKK privacy notice; for browser storage, the Cookie policy; for the business details of people held on the Platform, the Notice on professional data compiled from public sources.

1. Who this policy covers

If you received a message from an Alvara AI customer and have a request about your data, please contact the company that sent it first. We forward any such requests that reach us to the relevant customer.

2. What data we collect

2.1. Data you give us

• Identity and contact: name, business email address, workspace and team membership.
• Account: authentication details, roles and permissions.
• Billing: company name, tax details, invoice address, plan and payment records. Your card details are processed by the payment institution, not by the Company.
• What you provide for analysis: website address, public content read from it, the buyer profile derived from it, search criteria, campaign and list settings.
• Communications: support and early access correspondence.

2.2. Data created automatically

• Technical: IP address, browser details, request and error logs.
• Usage: feature usage and entitlement usage records.
• Security: sign-in attempts and access logs.

2.3. Data from third parties

• From the payment institution: the outcome of a payment and limited information about the payment method, where payments are offered.
• From data providers and public sources: company details and the business and professional details of people who work at those companies.

2.4. Data we do not collect

The Platform is not designed to process special categories of personal data, such as health, religion, political opinion, trade union membership, biometric or genetic data. Users are prohibited from uploading such data by the Acceptable use policy.

3. Our purposes

• Creating your account and providing the service,
• performing our contractual obligations, invoicing and collection,
• providing support and answering your requests,
• keeping the Platform secure and preventing misuse and unauthorised access,
• analysing and improving the service,
• meeting legal obligations and protecting our rights in legal disputes.

The Company does not contact anyone on its own on a customer's behalf; the service produces email drafts. We do not send you marketing messages without first obtaining the consent that commercial electronic message rules require.

4. Who we share data with

We do not sell your personal data. We share it only as far as needed with these groups of recipients:

Company and people details obtained through searches on the Platform are stored in the central database together with their source and date, and may be made available to more than one customer. Our customers' search criteria, uploaded lists and the lead lists they create are not shown to other customers.

5. Transfers abroad

Some of our providers operate servers outside Türkiye:

• Hostinger: application server. Germany.
• Supabase: database and authentication. European Union.
• Backblaze: encrypted backups. European Union.
• Cloudflare: DNS, proxy, Turnstile verification and email routing (incoming early access and contact emails). United States.
• DeepSeek: language model service. China.
• Vercel: hosting of the marketing site and web application. Servers outside Türkiye.
• Treg and the data providers behind it: company and people data, verification. Servers outside Türkiye.
• Grafana and Sentry: monitoring and error tracking, with sensitive fields masked. Servers outside Türkiye.
• Brevo: email delivery service (sending infrastructure and event notifications). Servers outside Türkiye.

Only the data a given task needs is sent to the language model; account passwords and access keys are never sent. Where sending features are offered, the subject and body of recipients' replies are also sent to the language model to classify the reply. Calls to the data provider gateway are labelled with pseudonymous identifiers instead of customer and workspace details; the query inputs themselves (such as a company, a person's name or an email address to be verified) are passed to the provider to carry out the task. Every transfer abroad, including transfers to servers in the European Union, is assessed under KVKK Article 9 and the related regulation.

6. Retention

Personal data is kept for as long as its purpose requires and as long as the law prescribes; on request, or to the extent the law allows, it is deleted, destroyed or anonymised, subject to retention obligations under the law. The main periods are:

• Account and contract data: for the duration of the contract and for the period required by law.
• Invoices and accounting records: for the period required by tax and commercial law.
• Addresses on the suppression list: kept without a time limit so that they are never contacted again.
• Export files: deleted after 7 days.
• Raw event notifications (webhooks): kept for 30 days.
• Backups: personal data that has been deleted can remain in encrypted backups for up to 37 days more; backups are then deleted automatically.
• Business details of people compiled from public sources: deleted at the person's request and prevented from being added again.

7. How we protect your data

To prevent unlawful processing of and access to data, we apply technical and organisational measures: encryption in transit (TLS), role-based access, separation of customer data by account, access logging, encrypted storage of keys and credentials, masking of sensitive fields in logs, and other appropriate organisational measures. No method of transfer or storage can be guaranteed to be completely secure; in the event of a data breach we make the notifications the law requires.

8. Your rights

Under KVKK Article 11 you may learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, know the third parties it is transferred to, request correction, deletion or destruction, ask that these actions be notified to third parties, object to a result against you that arises solely from automated analysis, and claim compensation for damage. See the Data subject requests page for how to apply; applications are answered free of charge within 30 days at the latest.

9. People in the European Economic Area and the United Kingdom

Where the EU General Data Protection Regulation (GDPR) applies, your data is processed on the basis of performance of a contract, legal obligation, legitimate interests and, where needed, consent. You have the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests; you may withdraw consent at any time and lodge a complaint with the data protection authority in your country. For requests: info@alvaraai.com.

10. Children's privacy

The service is not directed at anyone under 18 and we do not knowingly collect their data. If you believe we hold such data, write to info@alvaraai.com; the data is deleted on request.

11. Third-party links

Our site and the Platform may link to third-party sites. The Company is not responsible for their privacy practices.

12. Changes

We may update this policy from time to time. The current version is always published on this page; material changes are announced to registered users by email or in-app notice.

13. Contact

For privacy and KVKK requests: info@alvaraai.com.