Privacy Policy

We collect information in the following categories depending on how you interact with the Service.

1.1 Information You Provide Directly

Account Information

—

Full name, email address, job title, company name, phone number.

Billing Information

—

Payment card type, last four digits, billing address (processed by Stripe).

User Content

—

Contacts, deals, proposals, decks, invoices, documents, notes, and any other data you create or upload within the Service.

Communications

—

Messages you send to our support team, feedback, or survey responses.

Integration Credentials

—

OAuth tokens for connected services (Google, Xero) that you voluntarily link.

1.2 Information Collected Automatically

Device and Browser Data

—

IP address, browser type and version, operating system, device identifiers.

Usage Data

—

Pages visited, features used, timestamps, click paths, search queries within the Service.

Performance Data

—

Page load times, errors, crash reports.

1.3 Information from Third-Party Services

When you choose to connect a third-party service to Alana, we receive information from that service as described below.

Google Account Data. If you connect your Google account to Alana, we access the following data:

• Authentication (via WorkOS). We receive your name, email address, and profile picture to create and authenticate your account when you sign in with Google.
• Gmail Send. When you connect Gmail for outbound email, we access the ability to send emails on your behalf through your connected Gmail account. We send emails only when you explicitly initiate or approve the send action within Alana.
• Gmail Signature. We read your Gmail signature (via the gmail.settings.basic scope) so that outbound emails sent through your Gmail account include your existing signature. Your signature is cached for up to 24 hours and refreshed periodically.

We do not read, scan, index, or store the contents of your Gmail inbox, sent mail, drafts, or any other Gmail messages. We do not access your Google Drive, Google Calendar, Google Contacts, or any other Google service beyond what is described above.

Xero Account Data. If you connect your Xero organisation, we access invoice, payment, and contact data within your Xero organisation solely to provide the reconciliation and accounting features of the Service.

We use the information we collect for the following purposes:

• Providing and operating the Service, including processing your transactions and delivering features you request. Legal basis: Performance of contract.
• Authenticating your identity and managing your account. Legal basis: Performance of contract.
• Sending emails on your behalf through your connected Gmail account when you initiate a send action. Legal basis: Performance of contract (your explicit instruction).
• Displaying your Gmail signature on outbound emails. Legal basis: Performance of contract (your explicit instruction).
• Reconciling invoices and payments through your connected Xero account. Legal basis: Performance of contract (your explicit instruction).
• Communicating with you about your account, support requests, and service updates. Legal basis: Performance of contract / Legitimate interest.
• Improving, maintaining, and securing the Service. Legal basis: Legitimate interest.
• Detecting, preventing, and addressing fraud, abuse, or security issues. Legal basis: Legitimate interest.
• Complying with legal obligations, including responding to lawful requests from public authorities. Legal basis: Legal obligation.
• Aggregating and anonymising data for internal analytics and product development. Legal basis: Legitimate interest.

We do not use your information, including Google user data, to serve advertising, build advertising profiles, or for any purpose unrelated to providing or improving the Service.

Alana's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Specifically:

1. (a)We limit our use of Google user data to providing or improving user-facing features that are prominent in Alana's user interface (sending emails on your behalf and displaying your signature).
2. (b)We do not transfer Google user data to third parties, except: (i) to provide or improve user-facing features with your consent; (ii) for security purposes such as investigating abuse; (iii) to comply with applicable laws; or (iv) as part of a merger, acquisition, or sale of assets with your explicit prior consent.
3. (c)We do not allow humans to read your Google user data unless: (i) you have given affirmative agreement; (ii) it is necessary for security purposes; (iii) it is necessary to comply with applicable law; or (iv) the data is aggregated and anonymised for internal operations.
4. (d)We do not use Google user data for serving advertisements, retargeting, or interest-based advertising.
5. (e)We do not sell Google user data to third parties, advertising platforms, data brokers, or information resellers.
6. (f)We do not use Google user data to determine creditworthiness or for lending purposes.

We do not sell your personal information. We share information only in the following circumstances:

4.1 Service Providers (Sub-processors)

We engage the following service providers who process data on our behalf under contractual obligations to protect your information:

4.2 At Your Direction

When you connect third-party integrations (such as Google or Xero), data flows between Alana and those services as you direct. These transfers are governed by your relationship with those third parties and their respective privacy policies.

4.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

We implement reasonable and appropriate technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit and at rest.
• Access controls based on the principle of least privilege, with multi-factor authentication for internal access.
• Continuous monitoring, logging, and vulnerability management.
• Regular encrypted backups.

Further detail about our security program and compliance posture is available to customers and prospective customers on request.

No method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

We retain your information only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

You may request deletion of your account and associated data at any time by using the self-service termination feature in Settings, or by submitting a written request to your Yora Account Manager.

Upon termination:

1. (a)Your account enters a 30-day grace period during which it is frozen but reversible.
2. (b)During this period, you may request a full data export or cancel the termination.
3. (c)After 30 days, your data is permanently and irreversibly purged from our production systems and from the third-party sub-processors that hold it on our behalf.
4. (d)OAuth tokens for connected services (Google, Xero) are revoked and deleted.
5. (e)Any residual copies in encrypted backups are overwritten within our standard backup lifecycle.

A durable termination record is retained as compliance proof of the erasure request and its completion.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access

—

Request a copy of the personal information we hold about you.

Correction

—

Request correction of inaccurate or incomplete information.

Deletion

—

Request deletion of your personal information (subject to legal retention obligations).

Data Portability

—

Request your data in a structured, machine-readable format.

Restriction

—

Request that we restrict processing of your information in certain circumstances.

Objection

—

Object to processing based on legitimate interests.

Withdraw Consent

—

Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@yora.com. We will respond within 30 days (or sooner where required by applicable law).

8.1 Australian Privacy Act

If you are located in Australia, you have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs.

8.2 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or UK GDPR. Our lawful bases for processing are set out in Section 2 above. You may lodge a complaint with your local supervisory authority.

8.3 California (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). We do not sell or share your personal information for cross-context behavioural advertising. You have the right to know, delete, correct, and opt out of the sale or sharing of personal information.

Alana's primary infrastructure is hosted on Google Cloud Platform in the Australia (Sydney) region. Some of our sub-processors are located in the United States (see Section 4.1). Where personal data is transferred outside of Australia, the EEA, or the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required.

We use essential cookies to operate the Service (for example, to maintain your authenticated session). We use PostHog for pseudonymised product analytics. We do not use advertising cookies or third-party tracking pixels.

You can control cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you by email or by posting a prominent notice within the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

For matters related to Google user data specifically, you may also contact us at privacy@yora.com with "Google Data Inquiry" in the subject line.

You may disconnect your Google account from Alana at any time through the Settings page within the Service. Upon disconnection:

• We immediately cease sending emails through your Gmail account.
• Your cached Gmail signature is deleted.
• Your Google OAuth tokens are revoked and removed from our systems.

You may also revoke Alana's access to your Google account directly from your Google Account permissions page (https://myaccount.google.com/permissions).