Privacy Policy

Last updated: 3 April 2026

1. Data Controller

AlphaFRS Ltd ("we", "us", "our"), a company registered in England and Wales, is the data controller for personal data processed through this service. Contact us at [email protected].

2. Data We Collect

  • Account data: Email address, name, company (optional)
  • Payment data: Processed by Stripe — we never store card numbers
  • Research inputs: Queries, parameters, and skill selections you provide
  • Usage data: Pages visited, features used, timestamps
  • Waitlist data: Email address and signup source

3. Purpose & Legal Basis

  • Consent: Waitlist signups, marketing emails
  • Contract performance: Account management, research delivery, billing
  • Legitimate interest: Service improvement, security, fraud prevention

4. Third-Party Processors

  • Supabase: Database and authentication (EU region)
  • Stripe: Payment processing (PCI-DSS compliant)
  • Resend: Transactional email delivery
  • LLM providers (e.g. OpenAI): Research generation — your inputs are processed to generate reports but are not used to train models

5. Data Retention

  • Account data: retained while active + 30 days after deletion
  • Credit transaction ledger: 7 years (financial records requirement)
  • Research reports: retained until you delete them
  • Waitlist emails: retained until launch or until you unsubscribe

6. Your Rights (GDPR Articles 15–22)

You have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Erase your data ("right to be forgotten")
  • Port your data to another service
  • Restrict or object to processing

To exercise any right, email [email protected]. We will respond within 30 days.

7. International Transfers

Data may be processed in the United States by our payment and AI providers. We ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.

8. Cookies

We use essential cookies only. See our Cookie Policy for details.

9. Children

AlphaFRS is not available to individuals under 18 years of age. We do not knowingly collect data from children.

10. Changes to This Policy

We will notify you of material changes via email at least 30 days before they take effect. Continued use after the effective date constitutes acceptance.