Privacy Policy

Effective from May 24, 2026

This policy describes how Alvarium Technology S.R.L. (hereinafter, “AlvaDocs” or “we”) collects, uses, and protects the personal and business data of users of app.alvadocs.com, its website www.alvadocs.com, and associated services (collectively, the “Service”). The Service is used and promoted by Alvarium Standard S.R.L.

1. Data we collect

1.1 Account data

Email, full name, optional phone number, and job title.
If you sign up with Google OAuth, we receive your email, name, and avatar as Google provides them.
Password hash (we never store passwords in plain text).

1.2 Your tax / accounting activity data

The invoice images and PDFs you upload to the Service.
The data extracted by our AI: vendor, TRN/RNC, date, line items, total, taxes, currency.
Categories, projects, and clients you create to organize your invoices.
Operational metadata: upload timestamps, extraction confidence levels, manual corrections you make to extracted data.

1.3 Technical data

IP address and browser user-agent at the time of each backend call (Supabase and Vercel logs).
Session identifiers stored on your device (localStorage / AsyncStorage) to keep you signed in.

1.4 Public waitlist data

If you submitted your email on the landing form at www.alvadocs.com, we only store email, chosen language, and date. We don't use tracking cookies.

2. How we use that data

Operate the Service: authenticate your session, show your invoices, run the AI extraction, generate PDFs and CSV exports.
Improve AI accuracy: when you correct a misread field, that correction may be used anonymously to improve extraction of future invoices from the same vendor (not shared with other users).
Transactional communication: send team invites, password recovery, security notifications.
Support: respond to questions you send us by email.
Legal compliance: respond to authority requirements when we are legally obligated.

We do not sell your data and don't use it for third-party advertising.

3. Processors and sub-processors

We use third-party infrastructure services that process data on our behalf, all with data processing agreements:

Supabase Inc. (United States): database, file storage, authentication.
Vercel Inc. (United States): landing and web app hosting.
Anthropic PBC (United States): AI API that reads your invoice content to extract structured data. Images are sent via HTTPS, not permanently stored on Anthropic's side, and not used to train their general models (subject to Anthropic's policies).
Resend Inc. (United States): transactional email delivery (team invites, password reset).
Google LLC: only if you choose to authenticate with Google OAuth.

4. International transfers

Your data is stored and processed on infrastructure located in the United States. By using the Service you accept this transfer. We apply encryption in transit (HTTPS/TLS) and encryption at rest where the provider supports it.

5. Retention

While your account is active: we retain your invoices, extracted data, and configuration indefinitely so you can access your history.
After you delete your account: your invoices, extracted data, companies, and memberships are cascade-deleted within a reasonable timeframe (typically 30 days, subject to rotating backups).
Administrative audit logs: retained for a minimum of 24 months for security and traceability reasons.

6. Your rights

You may exercise the following rights at any time:

Access: view all your invoices and data from the app.
Rectification: correct extracted data directly in the validator.
Deletion: delete individual invoices from the app, or write to hello@alvadocs.com to delete your full account.
Portability: export your invoices in CSV or PDF from the export module.
Objection: to any processing you consider inadequate.

7. Security

We apply standard best practices: TLS encryption on all traffic, encryption at rest for Storage files, JWT-based authentication, Row-Level Security in the database to ensure only you see your invoices, and audit logging of every administrative action. Report any suspected security incident to support@alvadocs.com.

8. Cookies and tracking

We currently do not use tracking cookies or third-party analytics tools (Google Analytics, Mixpanel, etc.). The only client-side storage is what's needed to keep your session.

9. Minors

The Service is not designed for users under 18 years of age. If you discover that a minor has created an account, contact us and we will remove the information.

10. Changes to this policy

We may update this policy as the Service evolves. If we make material changes, we will notify you by email at the address associated with your account and update the effective date at the beginning of the document.

11. Contact

For any privacy inquiry, write to hello@alvadocs.com or to the postal address of Alvarium Technology S.R.L., Dominican Republic.

For questions about this document write to hello@alvadocs.com.