Privacy policy

Last updated: October 20, 2026

Alori ("Alori", "we", "us") is the all-in-one app for service businesses, operated by InputKit. This policy explains what information we collect when you use alori.dev, the apps you build with Alori, and the services connected to them, and what we do with it.

Our Privacy Officer is Maxime Lavoie. For a privacy question, a request about your information or a complaint, write to max@alori.dev. For technical support, write to support@alori.dev.

Who this policy covers

Account holders: business owners and teammates who sign up for Alori or are invited to an app built with Alori.
Your customers: people whose information a business stores in its Alori app (for example a customer record, a quote or an invoice). For that information, the business is in charge of it and we process it on its behalf. If you are a customer of a business that uses Alori, contact that business first about your data.

What we collect

Account information. Your name, email address, contact phone number when you provide it during sign-up or in your profile, password (stored as a secure hash) or the Google account you sign in with, your language, and the account and team you belong to. The phone number is optional at sign-up. It is used to text you when your site is ready and for notification features you use; it does not subscribe you to advertising messages.

Business information. What you tell us about your business during onboarding and in chat: trade, services, team size, location, and your current website address. When you give us a website address, we read that public page to build your first site.

What you build. Your chat messages and prompts, the code and settings of your apps, and the files and images you upload.

Records in your apps. The data you and your team enter in your apps: customers, contacts, quotes, jobs, schedules, invoices, notes, emails, text messages and call logs.

Billing information. Your plan, credit balance and payment history. Payments are processed by Stripe. We never see or store your full card number.

Technical information. IP address, browser and device type, pages visited, and error reports, which we use to keep the service running and to fix problems.

Optional statistics. If you accept visit statistics, we use Google Tag Manager, Google Analytics, Ahrefs Analytics and a random Alori visitor identifier. We measure pages, clicks, campaign sources, and sign-up and app creation steps. Funnel tracking may include business information associated with these steps. These measurements help us understand and improve the website and sign-up process.

Optional session replay. If you accept it separately, Sentry records your interactions to attach a replay to an error report. We enable masking of text, input fields and media. Replay helps us understand errors and may include pages visited and technical information about network requests.

The Sentry project is configured to prevent IP addresses from being stored in new events. This does not delete addresses stored before the setting was enabled.

Cookies and privacy choices

Detailed statistics stored in Alori (visitors and funnel events) are removed by a daily purge after 90 days. Aggregate totals without visitor identifiers are retained. This period does not apply to data stored separately by Google Analytics or Sentry.

Essential cookies and storage support sign-in, security, your language preference and work in progress. They stay active to provide these features.

Visit statistics and session replay stay off until you accept the corresponding purpose. You can reject all, accept all or customize these two choices without losing access to the service. Closing preferences or continuing to browse does not count as acceptance.

The Your privacy choices link at the bottom of each page of the site lets you change your choices at any time. We keep your choices for 180 days in this browser, then ask again. If your browser blocks storage, your choice applies only to the current page. Measurement identifiers include alori:hero in local storage and alori.utm and alori:onboarding:* in session storage; Google Analytics may also set its own cookies after acceptance.

When you withdraw statistics, we remove their known local identifiers and reload the page to stop tags already loaded. When you withdraw replay, we stop recording and discard data still in memory without sending it. Withdrawal stops future collection; it does not automatically delete data already sent. Contact Maxime Lavoie for a request about that data.

Information from Google accounts

A teammate in an Alori app can choose to connect Gmail and Google Calendar as two separate Google apps, each with its own consent screen. With their permission, Alori requests these Google scopes:

Send email (gmail.send): to send the quotes, invoices and messages the teammate writes in the app from their own Gmail address.
Read email (gmail.readonly): to receive replies and incoming messages from customers and attach them to the right customer conversation in the app. We skip automated mail (promotions, social, updates, forums, newsletters and no-reply senders).
Read contacts (contacts.readonly): to fill in the name, phone, address and company of a sender who is not yet a customer in the app.
See and edit events (calendar.events): to show Google Calendar events in the app's schedule, create, edit and delete events at the teammate's request, and synchronize events for assigned jobs and bookings. Moving a job's event in Google updates the job's schedule in Alori.
Read the calendar list (calendar.calendarlist.readonly): to identify the teammate's calendars and read their names, colors, primary status and access permissions so Alori can display and synchronize them. Calendar uses a different Google Cloud project and OAuth client from Gmail.

We store the Gmail messages that match the app's customer conversations, calendar names, colors and access permissions, synchronized event details and job-to-event links needed for the schedule, and an encrypted token for each connection that lets the app keep working until the teammate disconnects. When a teammate asks the app's assistant to draft a reply, the relevant conversation may be sent to our AI model provider to write that draft.

Alori's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Google user data only to provide and improve the email, contact and calendar features the teammate sees in the app.
We do not sell Google user data, and we do not use it for advertising.
We do not use Google user data to train general AI or machine learning models.
No person at Alori reads Google user data unless the teammate asks us to (for example for support), it is needed for security or to comply with the law, or the data is aggregated and anonymized.

A teammate can disconnect Gmail from the app's settings, and Google Calendar from the schedule, or revoke either from their Google account permissions. Disconnecting one does not disconnect the other. When they disconnect, we revoke that token and stop using that service.

How we use information

To build, host and update your apps, and to run the features you use.
To answer your chat requests with AI models.
To send emails and text messages your team asks the app to send.
To bill you and manage credits.
To give support, prevent abuse and keep the service secure.
To improve Alori, using usage patterns and error reports.
To send you service messages, such as sign-in codes, invitations and billing receipts.

We do not sell personal information.

We share information only with service providers that help us run Alori, under contracts that limit their use of it:

Convex (database and backend hosting)
Vercel (website and app hosting)
Stripe (payments)
Resend (email delivery)
Twilio (text messages, calls and video meetings, when your app uses them)
Cloudflare R2 (storage of recorded video meetings)
OpenRouter and the AI model providers it routes to (to answer chat requests and draft content; they do not use this data to train their models)
Google (Gmail or Google Calendar when a teammate connects them; Google Tag Manager and Google Analytics for visit statistics after acceptance)
Ahrefs Analytics (visit statistics after acceptance)
Sentry (technical error reports and, after separate acceptance, masked replay of sessions with errors)
Cloudflare Turnstile (an invisible check, when a new account or guest session is created, that a real browser is asking; it is a security measure, not a visit statistic)

We may also share information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of the business, in which case this policy continues to apply.

Where data is stored

Our main database is hosted in Canada (Montréal region). Some providers listed above may process data outside Québec, elsewhere in Canada and in other countries, including the United States. Error reports and accepted replays are sent to Sentry's service in the United States. Recorded video meetings are stored with Cloudflare R2 in North America. Accepting an optional tool does not replace our obligations to protect information shared with these providers.

How long we keep it

We keep your account and app data while your account is active. When you delete an app or your account, we delete its data within 30 days, except what we must keep for legal, tax or accounting reasons. Backups are overwritten on a rolling schedule.

Security

We encrypt data in transit and at rest, encrypt Gmail and Calendar tokens with a separate key, and limit access to the people who need it. No system is perfectly secure, so please tell us right away at support@alori.dev if you think your account has been compromised.

Your rights

Depending on the laws that apply to your situation, you can request access to, correction or deletion of your personal information, or withdraw consent to its use or disclosure. In Québec, you can also request computerized personal information collected from you in a structured, commonly used technological format, subject to the exceptions provided by law.

Send your request to Maxime Lavoie, Privacy Officer, at max@alori.dev. Specify the account concerned and what you are requesting. We may need to verify your identity to protect your information. Do not send a password or card number. We answer access and correction requests within 30 days of receipt. Legal obligations may limit a deletion request or require us to retain certain information.

Responsibilities and complaints

Maxime Lavoie is your contact for privacy requests and complaints. Access to information within Alori is limited to authorized people who need it for their work. The providers named in this policy process information for the functions described. General retention and deletion rules are described above.

To make a complaint, write to max@alori.dev with a description of the situation, the information concerned and how to reach you. You can also contact the Commission d'accès à l'information du Québec, including if you dispute a response to an access or correction request. This recourse does not depend on accepting optional tools.

Children

Alori is for businesses. It is not meant for anyone under 16, and we do not knowingly collect their information.

Changes

If we change this policy, we will update the date at the top. For important changes, we will tell you by email or in the product before they take effect.

Contact

InputKit, operator of Alori

Maxime Lavoie, Privacy Officer

max@alori.dev

Technical support: support@alori.dev