Privacy Policy
1. Information we collect
You give us
- Account details: name, email, password (stored scrambled, never in plain text), plan, and optional business profile (company, title, NMLS IDs, phone, address, licensing line).
- Your content: chat messages, projects, calculator inputs you send to chat, documents and photos you upload, client pipeline records, client questionnaire answers, sworn statements, jobs and notes.
- Information about your clients and other people that you choose to enter or upload (see section 5).
- Security settings: passkey public keys, an encrypted authenticator-app secret, scrambled backup codes, and a phone number if you turn on text codes.
- Payment details: handled by Stripe. We receive your Stripe customer ID, subscription status and billing dates, not your full card number.
Collected automatically
- Usage: how much AI usage you've used, which features you use, and timestamps.
- Device and security information: IP address, browser and device type, sign-in history, remembered devices and security events (shown to you in Alfred Vault).
- Cookies: a sign-in cookie, a "remember this device" cookie if you choose it, and short-lived cookies for Google/Apple sign-in. Your browser also stores a few preferences (like calculator values). We don't use advertising or tracking cookies.
2. How we use information
- To provide the Service: answer your questions, run calculators, read documents, fill in forms, and run client links and shared statements.
- To keep accounts secure: two-step sign-in, new-device alerts, fraud and abuse prevention, rate limits.
- To process payments and manage plans and usage limits.
- To send service emails: sign-in codes, password resets, security alerts and important notices. We don't send marketing emails without your permission.
- To fix problems and improve Alfred, and to follow the law.
3. Companies that help us run Alfred
We share information only with service providers that process it for us under their own security and privacy commitments:
| Provider | What they do | What they receive |
|---|---|---|
| Anthropic | AI that powers Alfred's answers and document reading | The messages, documents and form details needed to answer each request. Anthropic's commercial terms state that data sent through its API isn't used to train its models. |
| Render | Hosting (servers in the United States) | All stored data, encrypted in transit |
| Stripe | Payments and subscriptions | Your email, plan and payment details you enter on Stripe's pages |
| Resend | Sending emails | Your email address and the email content (codes, links, alerts) |
| Google / Apple | Optional sign-in | Only if you choose to sign in with them |
| Twilio | Optional text codes | Your phone number and the code, only if you turn on text codes |
We may also share information if required by law or legal process, to protect the rights, safety and security of our users or the public, or as part of a merger or sale of the business (with notice to you). We don't sell or rent personal information, and we don't share it for advertising.
4. How long we keep it
- Files uploaded in chat (bank statements, pay stubs and so on) are deleted automatically after 30 days. The chat text stays until you delete the chat.
- Documents clients upload through questionnaire links are deleted after 180 days.
- Chats, projects, clients, statements and jobs stay until you delete them or your account.
- Security history is kept to protect your account. Password-reset links expire after 60 minutes.
- Billing records may be kept as required for tax and accounting.
5. Information about your clients
When mortgage brokers, lenders, accountants, attorneys, insurance professionals, contractors or other businesses use Alfred, they may upload information about their own clients. In that case the business is responsible for having the right to share it and for meeting its own legal duties (such as the Gramm-Leach-Bliley Act and state privacy and professional rules), and we process that information on the business's behalf to provide the Service. If you're a client of a business that uses Alfred, please contact that business with privacy questions; we'll help them respond. People who receive a questionnaire or sworn statement link from a business can see who sent it on the page.
6. Security
We use https encryption, scrambled password storage (scrypt), encrypted authenticator secrets, optional two-step sign-in with passkeys, security keys, authenticator apps and backup codes, separation between accounts, private file storage, rate limits on sign-in and codes, alerts for new devices, and automatic file deletion. No method is 100% secure, so please use Alfred Vault and keep your devices safe.
7. Your choices and rights
- See and change your account and business details in Settings, and your security settings in Alfred Vault.
- Delete chats, projects, clients, statements and jobs yourself, or email us to delete your account and its data.
- Get a copy of your information, or correct it, by emailing us.
- Billing: manage or cancel your plan through "Manage billing".
Depending on where you live (for example California, Colorado, Virginia or other states), you may have additional rights to know, access, correct, delete or opt out of certain uses of your personal information. We don't sell personal information or use it for targeted advertising. We'll respond to verified requests as the law requires and won't discriminate against you for using your rights.
8. Children
Alfred isn't for anyone under 18, and we don't knowingly collect information from children. If you think a child has given us information, contact us and we'll delete it.
9. Where data is stored
Alfred is run from the United States, and information is stored and processed in the United States by us and our providers.
10. Changes
We may update this Policy. If a change is significant, we'll let you know through the Service or by email before it takes effect.
11. Contact
Questions or requests: FortShadow LLC · West Bloomfield, Michigan · x@chatalfred.com