Privacy policy.

01. Account

• —Email address.
• —Name (optional).
• —Password (stored only as a salted hash; we never see the plaintext).
• —Account preferences and settings you configure.

02. If you use Watchdog (agent protection)

When you connect an AI agent to Watchdog, the messages that agent receives are sent to us for evaluation before your agent acts on them. Those messages come from your own systems and users, and they may contain personal data of those users. We process them on your behalf, as your service provider.

• —What we receive. The message content your agent submits for a check, the agent and fleet identifiers, tool-call metadata, and timing.
• —How we evaluate it. Fast automated checks run on every message. A small share of borderline messages is additionally evaluated by a large language model operated by a third-party AI provider named in our Subprocessors list, under an agreement that bars the provider from training on it.
• —What we keep. The verdict (allowed, flagged, blocked), the reason, and short excerpts needed to show you why. Excerpts and evaluation rationales are cleared after 30 days, unless you opted in to improving detection (below); the verdict record itself is kept so your audit trail stays intact, and is deleted with your account.
• —If you opt in to improving detection. Each fleet has a setting, off by default, to contribute to improving detection for every customer who opted in. With it on, the redacted excerpts behind flagged verdicts are kept as training examples for our own security detection models. They are never used to train generative AI, and never sold. Turn the setting off at any time: future contribution stops and that fleet's stored examples are erased. Models already trained on examples with safeguards against re-identification are not retrained.
• —What we never do with it. We do not sell agent messages, and we do not use them to train generative AI.

03. Usage and analytics

• —Device information (browser type, OS, device type).
• —IP address and general location (country and city level, not street address).
• —Pages visited, clicks, and features used.
• —Error logs and performance metrics.
• —Service-usage statistics in aggregate.

04. If you sign in with Google or GitHub

When you choose “Sign in with Google” or “Sign in with GitHub,” the provider sends us a minimum profile so we can create or match an account. Specifically we receive your email address, your display name, your avatar URL, and a stable account identifier. We do not receive your password, your contacts, or anything else from those accounts. Google's and GitHub's own policies govern what they do with the act of signing in.

05. If you install the Alovia GitHub App (code security scans)

You can connect your GitHub repositories to Alovia by installing the Alovia GitHub App on the repositories you pick, so our security scan can examine your code for issues such as exposed keys, open databases, and injection risks. This is separate from signing in with GitHub. It grants Alovia scoped, per-repository access that GitHub itself controls.

• —What we receive. For each repository you install the App on: repository metadata (name, default branch, visibility), file contents, commit history, and webhook events for pushes, renames, archival, and repository add/remove actions.
• —What we do with it. Scan the code you selected for security issues and show you the findings with fix steps. Portions of scanned code may be evaluated by a large language model operated by a third-party AI provider named in our Subprocessors list, under an agreement that bars the provider from training on it.
• —What we never receive. Repositories you did not install the App on. Your GitHub password. Your private keys. Other users' code unless they themselves install the App.
• —Revocation. You can uninstall the GitHub App at any time from your GitHub settings. Uninstallation revokes our access immediately and stops new webhooks. Stored scan results are deleted on request via privacy@aloviaai.com.

GitHub's own terms and privacy policy govern the underlying hosting relationship between you and GitHub. Our responsibilities cover only what Alovia does with the data GitHub sends us.

06. If you use Shield (website protection)

When you connect a website to Alovia so we can protect it from scrapers and unwanted bots, visitor requests to that site pass through our protection. We handle this traffic on your behalf, as your service provider, to run the protection and to make it respond better over time.

• —What we receive. For requests to a site you protect: the visitor's IP address, request details such as the path, method, headers, referrer, and timestamp, the user agent, and signals about whether the request looks automated. To tell returning verified visitors from bots, Shield sets a short-lived signed cookie that includes one-way hashes derived from the visitor's IP address and browser details; the cookie is described in our Cookie Policy.
• —What we do with it. Decide whether to allow, challenge, or block a request, show you your own traffic and security activity, and improve how our protection recognizes and responds to unwanted automated traffic.
• —What we never do with it. We do not sell it, and we do not use it to train generative AI. We keep it for up to 90 days to run and improve the protection you asked for, then delete it.

Making protection better for everyone. We use this traffic to make Shield smarter over time at telling automated traffic from real visitors. What it learns from the sites we protect helps strengthen protection for every site we guard. The goal is to spot bots, not to identify or profile any individual person. We keep the underlying traffic for up to 90 days, and we never sell it or use it to train generative AI.

If you use Shield as a business to protect your own site, our Data Processing Addendum governs how we handle your visitors' data on your behalf. You remain responsible for giving your own visitors any notice your local law requires.

• —Run website protection for sites you connect, and improve how it recognizes and responds to unwanted automated traffic.
• —Evaluate the messages your connected agents receive and return verdicts before the agent acts.
• —Run the security scans you request on your sites and selected repositories.
• —Send security alerts and service notifications.
• —Communicate important updates and security alerts.
• —Improve our detection and protection systems.
• —Prevent fraud and abuse.
• —Comply with legal obligations.
• —Provide customer support.

We do not train generative AI on your data, and we do not sell it. These two commitments are load-bearing to the product and are non-negotiable.

We share information in three narrow circumstances, and no others.

01. Sub-processors we rely on

The following sub-processors receive a narrow slice of your data to run the parts of Alovia they are contracted to run. All are located in the United States and are bound by data-processing agreements that forbid them from using your data for their own purposes.

• —Hosting, database, and storage providers (US). Run the service and securely store your account records, security findings, and traffic history.
• —AI model provider (US). Evaluates a small share of borderline agent messages and requested code scans, under an agreement that bars training on your data.
• —Cache and queue providers (US). Hold short-lived session data, rate-limit counters, and background job state.
• —Email delivery providers (US). Send transactional email such as verification, password reset, and detection alerts.
• —Product analytics provider (US). Aggregated pageviews and feature usage, tied to your account only after you sign in. We honor the Do Not Track browser signal. With it on, we do not capture pageviews or identify you. More in our Cookie Policy.
• —Error-monitoring provider (US). Receives technical details when something breaks on a signed-in request, so we can fix it.
• —Sign-in providers (US). Only if you choose to sign in with an outside account. They send us the minimum profile described in Section 01.

We use providers in the categories above, all located in the United States and bound by agreements that bar them from using your data for their own purposes. A current list of the specific providers we work with is published at Subprocessors, and questions can go to privacy@aloviaai.com.

02. Legal obligations

We may disclose information when required by law, court order, or to:

• —Comply with legal process.
• —Enforce our Terms of Service.
• —Protect our rights, privacy, safety, or property, or that of our users.
• —Respond to verified requests from law enforcement, subject to applicable legal standards.

03. Business transfer

If Alovia is acquired or merged, your information may transfer to the acquiring entity. We will notify you before this happens, and the acquirer is bound by the commitments in this policy until and unless you agree to revised terms.

• —TLS for data in transit (HTTPS everywhere).
• —Passwords stored using strong one-way hashing, never in plaintext.
• —Environment secrets kept out of source control and rotated on exposure.
• —Role-based access controls, with two-factor authentication available for user accounts.
• —Rate limiting and bot detection at the edge.
• —Managed-infrastructure backups and point-in-time recovery via our database provider.
• —Audit logs of user- and admin-facing actions, retained for incident review.

No method of transmission or storage is perfectly secure. We implement industry-standard practices; we do not claim absolute security, because nobody honest can.

If a breach happens. If we discover a breach that exposes your personal information, we will notify affected users without unreasonable delay, and we will notify regulators where the law requires it, in line with California's breach-notification law (Cal. Civ. Code §§ 1798.29 and 1798.82). Our notice will describe what happened, what information was involved, and the steps you can take.

• —Account data. Until you delete your account.
• —Shield traffic history. Up to 90 days, then deleted. Removing a site erases its visitor history immediately; the site's own record (domain and settings) is kept for 30 days for support, then deleted.
• —Watchdog message excerpts and evaluation rationales. Cleared after 30 days. The verdict records themselves (what was allowed, flagged, or blocked, and when) are kept for your audit trail and deleted with your account.
• —Security scan results. Until you delete the site or your account, or on request.
• —Logs and analytics. 90 days.
• —Legal holds. If we are required to preserve information for an actual or anticipated legal matter, that information is retained until the hold is lifted, even if you ask us to delete it.

When you delete your account, we permanently delete your personal data, your sites' traffic history, and your fleets' findings and verdicts within 30 days, except for data subject to a legal hold and any other data we are legally required to retain. If your account is under a legal hold, deletion is paused until the hold is lifted.

If you are a California resident, the California Consumer Privacy Act and the California Privacy Rights Act give you:

• —Right to know. Request what personal information we collect, use, and disclose about you.
• —Right to delete. Request deletion of your personal information. Some exceptions apply, such as information we have to keep to meet a legal obligation or that is preserved under a legal hold.
• —Right to opt out of sale or sharing. We do not sell or share your personal information for cross-context behavioral advertising. Never have, never will. We also honor browser opt-out preference signals, including Global Privacy Control (GPC): if your browser sends one, we treat it as an opt-out and turn off analytics for you automatically.
• —Right to correct. Request correction of inaccurate personal information.
• —Right to limit use of sensitive data. Direct us to limit how we use your sensitive personal information.
• —Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

To submit a request, email privacy@aloviaai.com with the subject line “CCPA Request.” We will verify your identity and respond within 45 days.

• —Access. Request a copy of your personal data by emailing privacy@aloviaai.com with the subject line “Data Access Request.” We respond within 45 days.
• —Correction. Request correction of your information by emailing privacy@aloviaai.com with the subject line “Correction Request.”
• —Deletion. Request deletion by emailing privacy@aloviaai.com with the subject line “Deletion Request.” A 30-day grace period applies, during which you can cancel; after it elapses your account and its data are permanently deleted.
• —Opt out of marketing. Unsubscribe using the link in any marketing email (CAN-SPAM Act).
• —Withdraw consent. Revoke permissions at any time.

Alovia is intended for adults and is not directed at minors. You must be at least 18 years old to use Alovia, and we do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe a minor has provided us with personal information, email privacy@aloviaai.com and we will delete it promptly.

We use cookies and similar technologies to keep you logged in, remember your preferences, analyze usage, and prevent fraud. For the full treatment, covering categories, control paths, Do Not Track, and California-specific rules, see our Cookie Policy.

Alovia is operated from California and serves users in the United States. Your data is stored and processed in the United States. If you access Alovia from outside the US, your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country.

This policy is governed by the laws of the State of California and applicable US federal law (CCPA/CPRA, CAN-SPAM, 17 U.S.C. § 512). Nothing in this section affects statutory rights that cannot be limited by contract.

We may update this policy from time to time. We will notify you of material changes by email or through the platform. Continued use of Alovia after changes take effect constitutes acceptance of the updated policy.

Alovia is a service operated by its founder, Chanpreet Singh, based in San Francisco, California, United States. A postal address is available on request.

Questions about this policy, or how we handle your data, go to privacy@aloviaai.com. Copyright concerns go to copyright@aloviaai.com.