1. Introduction
This Privacy Policy explains how Alistair (“we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you use Alistair (“the Service”). We are committed to protecting your privacy and handling your data transparently.
2. Information We Collect
2.1 Information You Provide
- Account information: Email address (for authentication via magic link).
- Financial profile: Information you share in chat conversations, including age, income, assets, liabilities, financial goals, risk tolerance, tax situation, estate planning status, and insurance coverage.
- Uploaded documents: PDFs, images, and text documents you upload for analysis. Extracted text is stored; original files are retained for reference.
- Billing information: Payment details are processed by Stripe and are not stored on our servers. We receive subscription status and transaction metadata from Stripe.
2.2 Information Collected Automatically
- Usage data: Chat message counts, feature usage, and session timing for billing and service improvement.
- Technical data: Standard server logs (IP address, browser type, timestamps) for security and debugging.
- Analytics data: Google Analytics is used to collect anonymous usage data including page views, session duration, and general interaction patterns to help us improve the Service.
3. How We Use Your Information
- To provide and personalize the Service.
- To generate AI-powered financial guidance based on your shared information.
- To manage your account, subscription, and billing.
- To send essential communications (magic link emails, billing notifications, service updates).
- To monitor and improve the Service.
- To enforce our Terms of Service and prevent abuse.
4. How We Store and Protect Your Data
Your data is stored in Supabase, a PostgreSQL database with encryption at rest and in transit. Authentication is handled by Supabase Auth using one-time magic links (no passwords are stored). All database access is protected by Row Level Security (RLS), which ensures you can only access your own data.
Document uploads are stored in Supabase Storage with private bucket policies — files are only accessible to the authenticated user who uploaded them.
5. AI Processing and Third-Party Subprocessors
We use the following third-party services to operate the Service:
- DeepSeek:Chat messages are sent to DeepSeek's API for AI processing. Messages are processed in real-time and are not used by DeepSeek to train their models. Review DeepSeek's privacy policy for details on their data handling.
- Supabase:All user data (account info, chat history, financial facts, documents) is stored in Supabase. Review Supabase's privacy policy for details.
- Stripe:Payment processing is handled entirely by Stripe. We do not store your credit card details. Review Stripe's privacy policy for details.
- Google Analytics:Anonymous usage data is collected via Google Analytics to help us understand how the Service is used and improve the user experience. Review Google's privacy policy at policies.google.com/privacy for details.
We do not sell your personal or financial data to any third party. We do not use your conversations or documents to train AI models.
6. Data Retention
We retain your data for as long as your account is active. Chat sessions older than 90 days and documents older than 180 days are automatically deleted. If you delete your account, all associated data (chat history, facts, accounts, documents, and recommendations) is permanently deleted within a reasonable processing period.
Stripe billing records are retained as required for tax and accounting purposes.
7. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access: Request a copy of your personal data.
- Rectification: Correct inaccurate or incomplete data.
- Deletion: Delete your account and all associated data (available in Settings).
- Portability: Receive your data in a structured, machine-readable format.
To exercise these rights, contact us at privacy@heyalistair.com.
8. Cookies
The Service uses essential cookies for authentication (session management via Supabase Auth) and security. We also use Google Analytics, which sets cookies to collect anonymous usage data for analytics purposes. Google Analytics cookies are governed by Google's privacy policy.
9. Children's Privacy
The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or through the Service. Continued use after changes take effect constitutes acceptance.