Alloomi Privacy Policy

Meland Labs Limited, a company incorporated in Hong Kong with its registered office at 19H Maxgrand Plaza, No. 3 Tai Yau Street, San Po Kong, Hong Kong, is responsible for the processing of personal information described in this Privacy Policy, except as described in Section 2.

This Privacy Policy does not apply to third-party services that you connect to or use alongside Alloomi, such as your email provider, messaging platforms or any AI service provider that you configure yourself. Your use of those services is governed by their own terms and privacy policies. In particular, if you choose to configure the Services to use your own AI provider account or API key, information you submit through that configuration is sent directly to that provider and is governed by that provider's terms.

Individual users. When you use the Services on your own behalf, Alloomi is the controller of your personal information as described in this Privacy Policy.

Organization accounts.Where an organization (for example, a company subscribing to a Team plan) provides you with access to the Services, we process content and personal information submitted through that organization's account on behalf of the organization, as its service provider or processor, under our agreement with that organization. In that case, the organization's own privacy notice governs, and questions about that processing should be directed to the organization.

3.1 Information Collected When You Use the Services

We collect the following limited information in order to provide your account and operate the Services:

• Account information, such as your name, email address and login credentials or the identifier of the third-party account you use to sign in.
• Subscription and payment information, such as your plan, billing history and billing details. Payments are processed by our payment processor, Stripe. We do not store your full payment card number.
• Device and technical information, such as IP address, device type, operating system, application version, language and time zone settings, and error and performance logs needed to keep the Services working.
• Strictly necessary cookies and local storage used to keep you signed in and to secure the Services.

3.2 Information Collected Only When You Turn On a Feature

Each feature described in this Section 3.2 is turned off by default. We collect the information described below only after you choose to connect an account or turn on the relevant feature, and we stop collecting it when you disconnect the account or turn the feature off. Section 9 explains how to do so.

(a) Connected Accounts. If you choose to connect a third-party account, such as Gmail, Google Calendar or a supported messaging platform, we access information from that account to the extent permitted by the authorization you grant. This may include the content and metadata of emails, messages and calendar events, attachments, and the names and contact details of the people you communicate with. Authorization for connected accounts is managed through our integration and authorization service provider, Composio, which handles the authorization credentials required to connect your accounts.

(b) Screen Memory. If you turn on Screen Memory, the Services capture screenshots of your screen at the interval you configure and extract text and short descriptions from them, so that you can later search and recall what you have worked on. Screenshot image files are automatically deleted from your device within six (6) hours of capture. The extracted text and descriptions are stored on your device until you delete them. You can pause or turn off Screen Memory at any time. Because Screen Memory may capture anything displayed on your screen, we recommend that you pause it when viewing information that you do not wish to be captured.

(c) Meeting Recording and Transcription. If you turn on meeting recording, the Services record audio from meetings on your device and generate transcripts and summaries. You are responsible for informing meeting participants and obtaining any consent required by applicable law before recording.

(d) Voice Input. If you use voice input, the Services capture your voice recording in order to convert it into text.

(e) Automations and Agent Actions. If you set up scheduled tasks, turn on automations such as automatic reply drafting, or instruct the Services to take actions on your behalf, we process the information needed to carry out those tasks. Depending on what you authorize, this may include reading and writing files on your device, running commands, operating applications, browsing websites, and preparing or sending messages through your connected accounts. A record of certain actions taken on your device is kept in a local audit log that you can review.

(f) Web Search. If you use features that search the web, the search queries generated for your request are sent to our search service provider.

3.3 Information You Choose to Provide to Us

• Support and feedback. Information you provide when you contact us, report a problem or give feedback.
• Diagnostic reports. If you choose to export and send us a diagnostic report, we receive the information it contains. Diagnostic reports are designed to remove credentials and mask certain identifiers, but they may include conversation content and other information from your use of the Services. Please review a report before sending it to us.

3.4 Information About Other People

Content you process through the Services, such as emails, messages, meetings and screen content, may include personal information about other people. You are responsible for ensuring that you have the right to process that information through the Services and for complying with laws that apply to you.

On your device. Content from your connected accounts, Screen Memory, meeting recordings and transcripts, and your conversations with Alloomi are stored primarily in a local database on your device.

AI processing. When you use a feature that requires AI processing, such as summarizing, drafting, answering a question or analyzing a screenshot or meeting, the relevant portions of your content are sent to the AI service providers listed in Section 8 so that they can generate the result for you. These providers are bound by agreements that restrict their use of the content to providing their services to us.

In our cloud. We store in our cloud infrastructure your account and subscription information, your application settings, and certain derived results needed to deliver the Services across sessions or devices.

We use the information described in this Privacy Policy to:

• (a) provide, operate and maintain the Services, including generating the summaries, drafts, reminders, memories and other outputs that you request or enable;
• (b) personalize the Services for you, including by building and maintaining the context and memory associated with your account;
• (c) maintain, evaluate and improve the quality, reliability, safety and performance of the Services, and develop new features and functionality;
• (d) troubleshoot, debug and provide support, including when you choose to share diagnostic information with us;
• (e) protect the security and integrity of the Services and detect, prevent and respond to fraud, abuse and violations of our Terms of Service;
• (f) communicate with you about the Services, including service-related notices and, where permitted, product updates; and
• (g) comply with applicable law and legal process.

Your Content Serves You.Content that we access or process on your behalf, including content from your connected accounts, Screen Memory, meeting features and your conversations with Alloomi ("User Content"), is used to provide the Services to you. We do not sell User Content, and we do not use User Content to serve advertising.

We may de-identify or aggregate information, including information relating to your use of the Services, so that it can no longer reasonably be used to identify you or any other individual. We may use de-identified or aggregated information to maintain, analyze and improve the Services. We maintain and use such information only in de-identified or aggregated form and do not attempt to re-identify it, except as required or permitted by applicable law. Where we share de-identified information with third parties, we contractually require them not to attempt to re-identify it.

This Section does not apply to:

• information received through Google APIs, which is governed by Section 7; or
• the content of Screen Memory captures, meeting recordings and meeting transcripts, which we do not use for the purposes of this Section other than in the form of aggregated statistics about how often features are used.

Alloomi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use information obtained through Google APIs only to provide and improve the user-facing features of the Services that you choose to use, and we do not transfer or sell such information except as permitted under those requirements.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as described below.

Service providers. We use service providers to help us operate the Services. They may process personal information only on our behalf and in accordance with our instructions and applicable data protection agreements.

We may update this list from time to time as our providers change.

At your direction. When you instruct the Services to send a message, post content or take an action through a connected account or third-party service, we share the relevant content with that service in order to carry out your instruction.

Organization accounts. If you use the Services through an organization account, information may be shared with the organization that administers the account.

Legal requirements and protection. We may disclose information where we believe in good faith that it is required by law, regulation or valid legal process, or necessary to protect the rights, property or safety of Alloomi, our users or others.

Business transfers. Information may be transferred as part of a merger, acquisition, financing or sale of assets, subject to the recipient honoring commitments consistent with this Privacy Policy.

With your consent. We may share information for other purposes with your consent.

• Connected accounts.You can disconnect any connected account at any time in the Services' settings. You can also revoke Alloomi's access through the settings of the third-party service.
• Features.You can turn off Screen Memory, meeting recording, voice input, automations and other features at any time in the Services' settings.
• Local data. You can delete Screen Memory entries, transcripts, conversations and other content stored on your device from within the Services, or by removing the application and its data folder from your device.
• Account deletion.You can delete your account in the Services' settings, or by contacting us using the details in Section 19. Section 10 explains what happens to your information after deletion.
• Communications. You can opt out of non-essential emails by using the unsubscribe link in the email. We will still send service-related notices.
• Cookies. You can manage cookies through your browser settings. Disabling strictly necessary cookies may prevent the Services from working properly.

We keep personal information for as long as needed to provide the Services and for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

We use technical and organizational measures designed to protect personal information, including encryption of data in transit using TLS, encryption of data stored in our cloud infrastructure, access controls that limit internal access to authorized personnel, and a local audit log of certain actions performed on your device. Authorization credentials for connected accounts are stored in encrypted form. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for securing your device and account credentials.

If we become aware of a security incident affecting your personal information, we will notify the relevant authorities and affected individuals as required by applicable law and take steps to contain and remedy the incident.

We and our service providers process information in the United States and other countries, which may have data protection laws different from those of your country. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to countries that have not been recognized as providing an adequate level of protection, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.

Depending on where you live, you may have the right to:

• access the personal information we hold about you and obtain a copy of it;
• correct inaccurate or incomplete personal information;
• delete your personal information;
• restrict or object to certain processing;
• receive your personal information in a portable format; and
• withdraw your consent at any time where we rely on consent, without affecting processing that took place before withdrawal.

Much of your information is stored on your device and is under your direct control, as described in Section 9. To exercise your rights with respect to information we hold, contact us using the details in Section 19. We will need to verify your identity before responding, and we may ask for information to do so. You may use an authorized agent where permitted by law, and we may require proof of the agent's authority. If we decline your request, you may appeal by replying to our decision, and you may contact your local data protection authority. We will not discriminate against you for exercising your rights.

Controller. Meland Labs Limited is the controller of your personal information, except as described in Section 2.

Legal bases. We process personal information on the following legal bases:

Where we rely on legitimate interests, you have the right to object. You also have the right to lodge a complaint with your local supervisory authority.

This Section applies to residents of US states with comprehensive privacy laws, including California.

Categories of personal information. In the past twelve months, we have collected the following categories of personal information, from you, your device and the accounts you choose to connect, for the purposes described in Section 5:

• identifiers, such as name, email address and IP address;
• customer records, such as billing information;
• commercial information, such as subscription history;
• internet or other electronic network activity information, such as technical and usage logs;
• audio, electronic and visual information, only if you use Screen Memory, meeting recording or voice input;
• professional or other information contained in the content of the accounts you connect;
• inferences, such as the context and memory the Services build for you; and
• sensitive personal information, consisting of account login credentials and, if you connect them, the contents of your email and messages.

We disclose these categories to the service providers described in Section 8 for business purposes. We do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. We use sensitive personal information only to provide the Services you request and for other purposes permitted by law, and not to infer characteristics about you. Retention periods are described in Section 10.

We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. The information described in Section 3.1 is necessary to provide your Account and the Services; if you do not provide it, we may not be able to provide the Services to you. Providing the information described in Section 3.2 is voluntary, and it is collected only if you turn on the relevant Feature. You may request access to and correction of personal data we hold about you by writing to our Data Protection Officer at the email address or postal address set out in Section 19. We will not use your personal data for direct marketing without your consent.

The Services are intended only for individuals aged 18 or older, or the age of majority in their jurisdiction if higher. We do not knowingly collect personal information from anyone below that age. If we learn that we have collected such information, we will delete it.

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last Updated" date. If we make material changes, including any change that expands how we use User Content, we will notify you in advance by email or through the Services, and where required by applicable law, we will obtain your consent before the change applies to information collected before the change.

If you have questions about this Privacy Policy or our privacy practices, please contact us:

• Email: support@melandlabs.ai
• Address: Meland Labs Limited, 19H Maxgrand Plaza, No. 3 Tai Yau Street, San Po Kong, Hong Kong