Privacy Policy

1. Introduction

Alora ("we", "our", "us") is committed to protecting the privacy of its users and clients. This privacy policy explains how we collect, use, disclose, and protect your personal information when you use our website aloradesign.ca and our AI voice receptionist service (24/7 inbound call answering, appointment booking, call transcripts, and call recordings).

By using our services, you consent to the practices described in this policy.

2. Information We Collect

We may collect the following types of information:

Information you provide directly

• Name, email address, phone number, and business name (during registration)
• Your agent's configuration (prompt, business hours, voice, knowledge base, call-flow cascade) entered in the AI Lab
• Contacts you import into the CRM
• Payment information (securely processed by Stripe; we never store your credit card data)

Information collected automatically

• IP address, browser type, operating system, and pages visited
• Usage data via Vercel Web Analytics (cookieless, anonymized)
• Essential cookies required for authentication and language preference

Call data processed by the AI receptionist

When your AI receptionist answers a call, we process:

• Caller phone number (provided by Twilio with each inbound call)
• Call audio streamed to ElevenLabs Conversational AI for real-time voice synthesis and transcription
• Call transcripts (all plans) stored in your customer portal for your review
• Audio recordings (all plans), retained by the applicable telephony or voice provider and made accessible through your customer portal
• Booking details the caller provides (name, callback number, requested time slot) written to Alora Calendar or the external calendar you connected

3. Authentication and Connected Calendars

We offer the option to sign in via Google OAuth. When you use this authentication method, we receive your name, email address, and profile photo. Account sign-in is separate from the optional connection of a calendar.

If you voluntarily connect a calendar, we request only the permissions needed to check availability and create, modify, or delete appointments managed by Alora. For Google, Alora creates and manages a dedicated calendar and may query free/busy status to prevent conflicts without reading the titles or details of your personal events. Outlook uses delegated calendar permissions; Apple uses the app-specific password you provide. Calendar credentials are encrypted and never sent to the browser.

4. Data Storage and Security

Your data is securely stored via Supabase, a platform that complies with modern security standards. We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, modification, disclosure, or destruction.

Payments are processed by Stripe, certified PCI DSS Level 1, the highest level of security certification in the payment industry.

5. Use of Information

We use your information to:

• Answer your inbound calls and book appointments on your behalf
• Generate transcripts and make call audio recordings accessible for your review
• Create and manage your customer account
• Process your payments and manage your subscription
• Communicate with you regarding your account or service status
• Send service-related communications (via Resend)

6. Cookies

We use a minimal set of cookies:

• Essential cookies: required for authentication (alora_session, alora_refresh) and client portal functionality
• Preference cookies: to remember your preferred language (alora_lang, French/English)
• No analytics cookies: we use Vercel Web Analytics, which measures traffic without setting cookies or identifying individual visitors

You can configure your browser to refuse cookies, but client portal authentication will stop working.

7. Information Sharing (sub-processors)

We never sell your personal information. We rely on the following sub-processors to deliver our services:

• Vercel: website hosting and anonymized traffic statistics (Web Analytics + Speed Insights)
• Supabase: storage of account data, agent configuration, contacts, bookings, transcripts, and call references
• Stripe: secure payment processing (PCI DSS Level 1)
• Resend: transactional emails (confirmation, notifications, password reset)
• Twilio: phone-number provisioning, call routing, audio streaming, and recordings for certain call paths
• ElevenLabs: Conversational AI voice synthesis, transcription, call orchestration, and AI-conversation recordings
• Anthropic (Claude) / OpenAI: language-model reasoning used by the agent during a call
• Google Cloud: OAuth sign-in, Alora's dedicated calendar, and free/busy availability without reading personal-event details
• Microsoft: Outlook connection and calendar read/write using the delegated permissions you accept
• Apple iCloud: CalDAV synchronization when you provide an app-specific password
• Competent authorities: if required by law

8. Your Rights

In accordance with Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25) and applicable federal laws, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Withdraw your consent to data processing
• Request data portability

9. Data Retention

Private call content (audio, transcript, phone numbers, and summaries) is retained for no more than 12 months after the call ends, then deleted from applicable providers and scrubbed from Alora's usage record. Contacts, bookings, follow-up requests, and account settings are retained while the account is active to provide the service. Cancelling a subscription stops the service but is not, by itself, a deletion request. From Profile, a customer can download a structured JSON copy or start verified deletion. That request disables access, cancels the subscription, deletes call artifacts from Twilio and ElevenLabs, revokes calendar connections, releases Alora-owned numbers, then purges operational data. A ported number is blocked for manual port-out before any release. Financial and audit records that must be retained are isolated, anonymized, and deleted when their legal obligation expires.

10. Changes

We may update this privacy policy periodically. Any changes will be posted on this page with a revised update date. We encourage you to review this page regularly.

11. Contact Us

For any questions regarding this privacy policy or to exercise your rights, please contact us: