Privacy Policy

This Privacy Policy explains how Vekst Labs LTD ("we", "us", "our"), trading as Alva, collects, uses, stores, and protects your personal data when you use our platform at app.alvahq.com and our marketing website at alvahq.com.

We are committed to protecting your privacy and processing your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Vekst Labs LTD is the data controller for personal data collected through Alva.

Company name: Vekst Labs LTD
Registered address: 426 Blackpool Road, Ashton-On-Ribble, Preston, England, PR2 2DX
Contact: privacy@alvahq.com

2. What Data We Collect

2.1 Account Data

When you register for Alva, we collect:

Your name and email address
Your company name and website
Your job title or role
Password (stored as a cryptographic hash — we never store your plaintext password)
OAuth credentials if you sign in via Google

2.2 CRM and Business Data

As part of using the platform, you input and store business data including:

Company and contact records (names, job titles, email addresses, phone numbers)
Deal information, pipeline stages, and notes
Activity logs (calls, meetings, emails, tasks)
Strategy documents, competitor information, and product details

This data is provided by you and relates to your business relationships. You are the data controller for the personal data of third parties (contacts, prospects) that you input into Alva. We process this data on your behalf as a data processor.

2.3 Email Content

If you connect your email account to Alva (via Google OAuth), we access and process email content to provide our Email Intelligence features. This includes reading email threads to extract business insights, buying signals, and suggested CRM updates. Email content is processed by our AI systems and stored in association with your account.

Gmail data limited use disclosure: Alva's use of data accessed via Gmail is limited solely to providing and improving the Email Intelligence features you have explicitly enabled. Gmail data is not used to serve advertisements, is not shared with third parties except as strictly necessary to operate the service, and is not used to train AI models without your explicit consent.

2.4 Usage Data

We automatically collect information about how you use Alva, including:

Pages and features accessed, and timestamps
AI assistant conversation history
Feature usage patterns and session data
IP address and browser/device information

2.5 Billing Data

Payment information is handled by Stripe. We store your subscription plan, billing history, and token usage. We do not store full payment card numbers — these are held securely by Stripe.

3. How We Use Your Data

We use your data to:

Provide, operate, and improve the Alva platform
Authenticate you and manage your account and team
Power AI features including deal scoring, email analysis, discovery, and the Alva assistant
Process billing and manage your subscription
Send transactional emails (account confirmations, team invitations, scheduled reports)
Monitor platform security and prevent abuse
Comply with legal obligations

Our lawful bases for processing under UK GDPR are:

Contract performance — processing necessary to deliver the service you have subscribed to
Legitimate interests — improving the platform, security monitoring, and fraud prevention
Legal obligation — where we are required to retain or disclose data by law
Consent — for email marketing (where applicable) and optional integrations

4. AI Processing

Alva uses large language models (LLMs) to power its AI features. Your data — including CRM records, email content, and conversation history — may be sent to third-party AI providers to generate responses and insights. We currently use:

Anthropic (Claude) — primary AI model for the Alva assistant, deal analysis, and BDR agents
OpenAI — used as a fallback AI model

We use these providers under data processing agreements that prohibit them from using your data to train their models. Data sent to AI providers is limited to what is necessary for the specific task being performed.

5. Third-Party Services

We share data with third-party service providers acting as data processors on our behalf. Each provider is engaged under a data processing agreement and is only permitted to process your data for the specific purpose for which they are engaged. These providers fall into the following categories:

Cloud infrastructure and hosting — servers, databases, file storage, and transactional email delivery, hosted in the United Kingdom (London region)
Payment processing — subscription billing and payment card handling via Stripe, an industry-standard payment provider
Authentication provider — Google, used for OAuth sign-in and, where you choose to connect it, Gmail integration
AI model providers — your data is processed by large language model APIs to power AI features. We currently use Anthropic (Claude) as our primary AI provider and OpenAI as a secondary provider. Both are engaged under data processing agreements that prohibit use of your data for model training
Professional data enrichment — where you use BDR agent or discovery features, limited contact and company information may be processed by specialist data providers to identify prospect contact details and professional profiles

We do not sell your personal data to any third party. A current list of our sub-processors is available on request by contacting privacy@alvahq.com.

6. Data Storage and Security

All application data is stored on cloud infrastructure hosted in the United Kingdom (London region), keeping your data within the UK. We implement appropriate technical and organisational measures to protect your data, including:

Encryption in transit (TLS) and at rest (AES-256 on RDS)
Access controls and authentication requirements
Regular automated database backups
Security monitoring and alerting

7. Data Retention

We retain your account data for as long as your account is active. If you cancel your subscription and close your account, we will delete your personal data within 90 days, except where we are required to retain it for legal or regulatory reasons (such as billing records, which we retain for 7 years in accordance with UK accounting requirements).

AI conversation history and email analysis data is retained for the duration of your account and deleted upon account closure.

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access — you can request a copy of the personal data we hold about you
Right to rectification — you can ask us to correct inaccurate data
Right to erasure — you can ask us to delete your personal data (subject to legal retention obligations)
Right to restriction — you can ask us to restrict how we process your data
Right to data portability — you can request your data in a structured, machine-readable format
Right to object — you can object to processing based on legitimate interests
Rights related to automated decision-making — you can request human review of automated decisions that significantly affect you

To exercise any of these rights, contact us at privacy@alvahq.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

9. Cookies

Alva uses essential cookies to maintain your login session and ensure the platform functions correctly. We do not use tracking or advertising cookies. The cookies we set are:

Session cookie — maintains your authenticated session (httpOnly, secure)
CSRF token — protects against cross-site request forgery

Our marketing website (alvahq.com) does not set any cookies.

10. Children's Privacy

Alva is a business-to-business platform intended for use by adults in a professional capacity. We do not knowingly collect personal data from anyone under the age of 16.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or via a notice in the platform. The "Last updated" date at the top of this page reflects the most recent version.

12. Contact Us

For any privacy-related queries or to exercise your rights, please contact us at:

Email: privacy@alvahq.com
Post: Vekst Labs LTD, 426 Blackpool Road, Ashton-On-Ribble, Preston, England, PR2 2DX