Privacy Policy
Alula is an AI companion. To work, it has to remember things about you, so this page explains plainly what we keep, who else sees it, and how to get it deleted.
1. Who we are
Alula is operated by Graham, an individual based in the United Kingdom, who is the data controller for the personal data described here. Contact: support@lecaz.co.uk.
2. What we collect and why
| Data | Why | Basis (UK GDPR) |
|---|---|---|
| Email address — stored encrypted; a one-way hash is used to find your account. | Create and secure your account, send verification and password-reset emails, billing receipts. | Contract |
| Password — stored only as a salted bcrypt hash; we cannot read it. | Sign you in. | Contract |
| Your conversations and the memories Alula distils from them (facts, preferences, emotional patterns, dream/reflection summaries). | This is the product: Alula remembers you between conversations. | Contract |
| Voice (Gold plan only, when you use the microphone) — audio is streamed to our voice provider to understand what you say and how you say it. Our own servers do not keep audio recordings. | Voice conversation and emotion-aware replies. | Your consent, given by choosing to use voice. You can stop at any time by not using it. |
| Account and billing status — your plan, a Stripe customer/subscription ID, a daily message counter. | Apply plan limits and manage your subscription. | Contract |
| Technical logs — IP address, timestamps and request details held by our web server and application logs. | Security, abuse prevention and fixing faults. | Legitimate interests |
Your name. The name you type is kept in your own browser and sent with your messages so Alula can address you by it. We do not save it in our database. It is, however, included in the text sent to the AI providers below, and it can appear in our server logs.
We do not sell your data, and we do not use it for advertising or to train our own or anyone else's AI models. Please don't share more sensitive information than you are comfortable with a service like this holding.
3. Who else handles your data
We use these providers to run the service. Each only receives what its job needs.
| Provider | Purpose | What it receives |
|---|---|---|
| Hetzner (Germany/Finland) | Hosting of the app and database | Everything we store |
| Google (Gemini) and Anthropic (Claude) | AI that writes Alula's replies and extracts memories | Your messages, relevant memories, your name |
| Hume AI | Voice and vocal-emotion analysis (Gold) | Your voice audio and the conversation text |
| Replicate | Image generation, when Alula creates an image | An image prompt derived from the conversation |
| Stripe | Payments | Your email and payment details (we never see your card number) |
| Resend | Sending our emails | Your email address and the email content |
Several of these providers are in the United States. Where personal data leaves the UK, we rely on the UK's approved transfer mechanisms (such as the UK–US data bridge or the International Data Transfer Addendum) offered by those providers.
4. Cookies and local storage
Alula sets no cookies and runs no analytics or advertising trackers. It uses your browser's local storage to keep you signed in and remember your name, theme and recent conversation. This is strictly necessary for the service to work, so no consent banner is shown. Signing out clears it.
5. How long we keep it
We keep your account, conversations and memories until you ask us to delete them or close your account. Payment records are kept by Stripe and by us as long as the law requires for accounting. Backups are rotated, so deleted data can remain in a backup for a short time before it ages out.
6. Your rights
Under UK GDPR you can ask to see a copy of your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent (for voice) at any time. Email support@lecaz.co.uk from the address on your account and we will respond within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.
7. Security
Connections use HTTPS, passwords are hashed, emails are encrypted at rest, and the database is not reachable from the public internet. No system is perfectly secure; if a breach affects you we will tell you as the law requires.
8. Children
Alula is for adults aged 18 and over. We do not knowingly collect data from children; if you believe a child has an account, contact us and we will remove it.
9. Changes
If we change this policy in a way that matters, we will update the date above and, for significant changes, tell you by email or in the app.