AlertOwl ("we," "us," or "our") is operated by Friday Surprise LLC, a company registered in the State of Delaware, USA. We operate the AlertOwl platform, an AI-powered email monitoring and alert service. This Privacy Policy explains how we collect, use, store, and protect your information when you use our service.

This policy applies to users in all jurisdictions where AlertOwl operates, including Germany, the United Arab Emirates, the United Kingdom, and the United States.

1. Information We Collect

1.1 Account Information

When you register for AlertOwl, we collect:

• Email address (used for login and system communications)
• Account name / business name
• WhatsApp phone number (for alert delivery)
• Timezone and language preference

1.2 Email Data (via OAuth Connection)

When you connect your Gmail or Outlook account, we access:

• Email metadata: sender address, recipient address, subject line, timestamps
• Email body content: message text used for AI classification (permanently removed immediately after classification — see Section 4)
• Attachments: we do not download, process, or store email attachments

We access your email via industry-standard OAuth 2.0 tokens with read-only permissions. Gmail uses the readonly scope; Outlook uses Mail.Read. We cannot send, delete, modify, or forward your emails. We never see or store your email password.

1.3 Payment Information

Payment processing is handled entirely by Stripe. We do not store credit card numbers, CVVs, or bank account details on our servers. We store only your Stripe customer ID and subscription status.

1.4 Usage Data

We collect aggregate platform usage data such as the number of messages processed, alert delivery rates, and classification accuracy metrics. This data is used to improve the service and is not shared externally.

2. How We Use Your Information

We use your information exclusively to:

• Classify messages: AI analysis of email content to determine category (Urgent, Complaint, Payment, Legal, VIP) and priority level
• Deliver alerts: Send WhatsApp notifications and daily digest emails to you
• Maintain your account: Authentication, subscription management, customer support
• Improve classification accuracy: Aggregate, anonymized analysis of classification patterns (never individual message content)
• Communicate with you: Service updates, security notices, billing information

3. Third-Party Services (Sub-processors)

We use the following third-party services to operate AlertOwl. Each is bound by their own privacy policy and data processing terms:

We will notify customers at least 14 days before engaging any new sub-processor. If you have concerns about a new sub-processor, contact us at privacy@alertowl.ai.

A formal Data Processing Agreement (DPA) covering all sub-processors is available upon request or from our Security page.

4. Data Retention

4.1 Two-Tier Retention Model

AlertOwl applies a two-tier data lifecycle to your email messages:

4.2 What Is Preserved After Content Removal

After content removal (Tier 1), the following metadata is retained until deletion (Tier 2) for reporting and audit purposes:

• Sender email address
• Email subject line
• AI classification result (category, priority, confidence)
• Alert delivery status and timestamps
• Message source (Gmail/Outlook) and received timestamp

The email body text itself is permanently and irreversibly replaced and cannot be recovered.

4.3 Account Data

Account information is retained for the duration of your subscription. If you request account deletion, your data is permanently deleted within 30 days. If you cancel your subscription without requesting deletion, your account data is retained for 90 days (to allow reactivation), after which it is permanently deleted.

4.4 OAuth Tokens

Gmail and Outlook OAuth tokens are encrypted at the application level using AES-256-GCM before storage, in addition to AES-256 disk-level encryption provided by our database host (Supabase). Tokens are revoked and deleted when you disconnect your email account or delete your account.

4.5 Backups

Automated database backups are retained for 7 days and are encrypted at rest. Backups older than 7 days are permanently deleted.

5. Data Security

We implement the following security measures:

• Encryption in transit: All data transmitted between your browser, our servers, and third-party APIs uses TLS 1.2+ encryption (HTTPS)
• Encryption at rest: Database storage is encrypted using AES-256 managed by Supabase
• Access control: Row-Level Security (RLS) policies on every database table ensure each customer can only access their own data
• Read-only email access: OAuth 2.0 with read-only scopes — we cannot send, delete, or modify your emails
• No password storage: We never see or store your email password
• Secret management: API keys and tokens are stored in encrypted environment variables on our backend servers, never in source code or client-side files
• Content masking: Email body content is permanently removed immediately after AI classification
• Monitoring: Automated error tracking with real-time alerts via Sentry

For detailed information about our security practices, certifications, and compliance roadmap, visit our Security page.

6. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data.

6.1 For All Users

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (completed within 30 days of verified request)
• Disconnect: Revoke email access at any time from your dashboard or directly from your Google/Microsoft account
• Export: Request an export of your data in a machine-readable format
• Retention control: Adjust your message metadata retention period from your dashboard settings

6.2 For EU/EEA Residents (EU GDPR)

If you are located in the European Union or European Economic Area, the EU General Data Protection Regulation (Regulation 2016/679) applies to our processing of your personal data. In addition to the rights listed above, you have the right to:

• Object to processing based on legitimate interest
• Restrict processing under certain conditions
• Data portability (receive your data in a structured, commonly used format)
• Lodge a complaint with your local supervisory authority
• Not be subject to automated decision-making with legal effects (AlertOwl's AI classification is advisory only and does not produce legal effects or similarly significant decisions)

Legal basis for processing: (a) Contractual necessity — providing the service you subscribed to (Article 6(1)(b)); (b) Legitimate interest — improving service quality and security (Article 6(1)(f)); (c) Consent — where applicable, such as marketing communications (Article 6(1)(a)).

Data transfers: Where your data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) as adopted by the European Commission (Decision 2021/914) and, where applicable, the EU-US Data Privacy Framework.

6.3 For German Residents

In addition to EU GDPR rights, the German Federal Data Protection Act (Bundesdatenschutzgesetz, "BDSG") applies. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) and the relevant state data protection authorities serve as supervisory authorities.

If AlertOwl is used to monitor a company email account subject to works council (Betriebsrat) oversight, the customer is responsible for ensuring compliance with applicable co-determination rights under the Works Constitution Act (Betriebsverfassungsgesetz). AlertOwl provides read-only, advisory classification and does not constitute employee monitoring or surveillance.

6.4 For UK Residents (UK GDPR)

If you are located in the United Kingdom, the UK General Data Protection Regulation and the Data Protection Act 2018 apply. You have the same rights as EU residents listed in Section 6.2 above, enforced by the UK Information Commissioner's Office (ICO).

• Supervisory authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, UK — ico.org.uk
• Data transfers: For transfers from the UK to the USA, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs
• UK adequacy: The EU's renewed adequacy decision for the UK (extended through December 2031) permits free data flow between the UK and EEA

As Friday Surprise LLC does not currently have an establishment in the UK, we will appoint a UK GDPR Article 27 representative when our UK customer base reaches meaningful scale. Until then, privacy inquiries from UK residents can be directed to privacy@alertowl.ai.

6.5 For UAE Residents (PDPL)

If you are located in the United Arab Emirates, the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL") applies. As the data controller, Friday Surprise LLC processes your data in accordance with the PDPL.

• Legal basis: Performance of a contract (providing the AlertOwl service) and your explicit consent obtained during account onboarding
• Your rights: Access, correction, erasure, restriction, objection to processing, data portability, and the right to withdraw consent at any time
• Cross-border transfers: Your data is transferred to the United States for processing. We rely on contractual safeguards modelled on international standards and your explicit consent. The UAE Data Office has not yet published an adequacy list or standard contractual clauses; we follow international best practices pending further guidance
• Data Protection Impact Assessment: We have conducted a DPIA covering our AI-based email classification processing, as required by the PDPL for high-risk processing involving automated technologies. This DPIA is available upon request
• Complaints: You have the right to lodge a complaint with the UAE Data Office
• Supervisory authority: UAE Data Office (established under the PDPL)

6.6 For California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) provides you with specific rights:

• Right to know: You can request details about the categories and specific pieces of personal information we collect, the sources, the business purpose, and the categories of third parties with whom we share it
• Right to delete: You can request deletion of your personal information (completed within 45 days of verified request)
• Right to opt-out of sale: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights
• Right to correct: You can request correction of inaccurate personal information

Under CCPA, our processing of your data constitutes a "business purpose" (service provision). To exercise any of these rights, contact us at privacy@alertowl.ai.

6.7 For US Residents (Other States)

As of 2026, multiple US states have enacted comprehensive privacy laws. AlertOwl's GDPR-level privacy controls — including data minimization, content masking, configurable retention, and the right to deletion — satisfy the requirements of all current US state privacy laws.

7. Data Breach Notification

In the event of a data breach that affects your personal data:

• We will notify affected users via email within 72 hours of becoming aware of the breach
• We will notify the relevant supervisory authority within 72 hours where required by law, including the relevant EU supervisory authority (for EU residents), the ICO (for UK residents), and the UAE Data Office (for UAE residents)
• Notification will include the nature of the breach, the data affected, likely consequences, and the measures we are taking to address it

Our Incident Response Plan documents our full breach detection, containment, and notification procedures. A copy is available upon request.

8. International Data Transfers

AlertOwl processes data across multiple locations. Here is exactly where your data flows:

For transfers from the EU/EEA to the United States, we rely on Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework. For UK transfers, we use the UK IDTA or UK Addendum to the SCCs. For UAE transfers, we rely on contractual safeguards and your explicit consent.

9. AI Processing

AlertOwl uses artificial intelligence (Anthropic's Claude API) to classify your incoming emails. This processing is advisory only — it does not produce automated decisions with legal effects or similarly significant impact on you. The classification is a tool to help you prioritize your communications.

Anthropic's API operates on a zero-retention basis: your email content is processed in real-time and is not stored, cached, or used to train AI models by Anthropic. Email content is permanently removed from our systems immediately after classification.

By connecting your email account and using the AlertOwl service, you consent to AI-based classification of your email content for the purpose of delivering alerts. You may withdraw this consent at any time by disconnecting your email account from the AlertOwl dashboard.

10. Children's Privacy

AlertOwl is a business service and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related inquiries, data access requests, or concerns:

• Privacy inquiries: privacy@alertowl.ai
• General support: support@alertowl.ai
• Security concerns: security@alertowl.ai
• Response time: We aim to respond to all privacy requests within 30 days (45 days for CCPA requests as permitted by law)

Data controller: Friday Surprise LLC, a Delaware limited liability company, operating as AlertOwl.