Privacy Policy

01Who we are

Alex is a service of Evergrow Management PTE LTD (trading as alex.app), a company registered in Singapore. In this policy, "Alex", "we", "us", and "our" refer to Evergrow Management PTE LTD.

We build Alex, an AI employee that businesses integrate into how they already work, so she can answer customers across WhatsApp, phone, SMS, and email, support their teams, and open a verified, permissioned door for other AI agents to act on inventory and bookings.

This policy explains what personal information we collect, why, who we share it with, and the choices and rights you have. If you have any questions, contact us at [email protected].

02Scope & our role

This policy covers the alex.app website and the Alex service we provide to our business customers. It does not cover any third-party website or service we link to, nor a business's own privacy practices.

Our role in handling your data depends on the context:

• We are the controller for our own website visitors, prospective customers, and the contacts and accounts of the businesses that hire us. We decide why and how that information is processed.
• We are a processor (service provider) when Alex handles the conversations and records of a business that uses her. In that case, the business is the controller: they decide what Alex does with the data, and we act on their documented instructions.

03Information we collect

When you visit alex.app

This site is a static, dependency-free page. We don't run analytics, advertising, or tracking on it. Our hosting provider automatically logs standard technical information, such as your IP address, browser type, and the pages requested, to deliver the site and keep it secure. Web fonts are loaded from Google Fonts, which means Google may receive your IP address when your browser requests them; see Google's privacy policy.

When you contact us or book an integration

If you message us on WhatsApp, email us, or book an integration call, we collect what you choose to share, such as your name, business, phone number, email address, and the content of your messages, so we can respond and evaluate how Alex could fit your business.

When your business hires Alex

To set Alex up for a business, we collect and process:

• Account & contact details for the people who administer the service.
• Integration credentials such as API keys, tokens, and connection settings that let Alex work with your channels and systems. These are stored encrypted and used only to operate the service.
• Business content Alex needs to do her job, such as your catalogue, pricing, policies, availability, calendars, and the knowledge that shapes her replies.
• Usage and operational data such as logs of actions Alex takes, performance metrics, and escalations to your team.

When you interact with a business that uses Alex

When you reach a business that has hired Alex, we process, on that business's behalf, information such as:

• Contact identifiers for the channel you used, such as your phone number, WhatsApp ID, or email address.
• Conversation content, including the messages, voice calls, and attachments you exchange, and the language you write in.
• Transaction details such as bookings, orders, quotes, appointments, and the questions you ask.

When an AI agent acts on your behalf

Where a business enables it, other AI agents can query inventory, request quotes, and ask for bookings through a verified, permissioned interface. We process the agent's verified identity and the scoped requests it makes, subject to the permissions the business has set.

Sensitive information

Because Alex works for businesses such as dental and medical practices, the conversations she handles on a business's behalf may include sensitive or special-category information, such as health details, that a customer chooses to share. Where Alex processes this as a processor, the business is the controller and is responsible for establishing the lawful basis or consent that such data requires, including under GDPR Article 9. We process sensitive information only under our agreement with that business, including a data processing agreement and, where applicable, a HIPAA Business Associate Agreement, and we apply the safeguards described in Security.

04How we use information

We use personal information to:

• Provide and operate the service, including answering customers, taking bookings and orders, routing conversations, and escalating to a human when needed.
• Tailor and improve Alex for each business, integrating her into their workflow and tuning her to their catalogue, tone, and rules.
• Communicate with you, respond to enquiries, and provide support.
• Keep the service secure and reliable, prevent abuse and fraud, and debug problems.
• Comply with legal obligations and enforce our agreements.

Where the law requires a legal basis (for example, under the GDPR), we rely on performance of a contract, our legitimate interests in running and improving the service, your consent where applicable, and compliance with legal obligations.

05AI & automated processing

Alex uses AI models to understand messages and generate replies and actions. This is core to how the service works. To do this, relevant content may be processed by the AI model providers we use as sub-processors, under contractual confidentiality and security terms.

We do not permit our AI model providers to use a business's content or its customers' conversations to train their general-purpose foundation models, except where a business has specifically authorised it. A business can configure what Alex is allowed to do automatically, what requires a login, and what needs human sign-off, and a human on the team can be brought in at any point.

If a decision made solely by automated means would produce a legal or similarly significant effect on you, you have the right to request human review where applicable law provides for it.

06How we share information

We share personal information only as needed to run the service:

• The business you contacted. Conversations and records are shared with the business that uses Alex, as their data.
• Service providers & sub-processors that help us operate, such as cloud hosting and infrastructure, messaging and telephony platforms, email delivery, AI model providers, and tools for security and support. They may process data only on our instructions.
• Integrations you or a business connect, such as a calendar, CRM, or commerce platform, so Alex can do her job.
• Legal, safety & compliance recipients, where we are required to disclose information by law or to protect rights, safety, and the integrity of the service.
• Business transfers, if we are involved in a merger, acquisition, or sale of assets, in which case we will continue to protect your information and notify you of any change.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

07Channels & third-party platforms

Alex works across the channels your customers already use, including WhatsApp, phone, SMS, and email. When you communicate over one of these channels, the platform that carries the message (for example, WhatsApp, operated by Meta, or a telephony and SMS provider) also processes your data under its own terms and privacy policy. We encourage you to review the policy of any platform you use to reach a business.

08International transfers

We are based in Singapore and work with service providers that may process data in other countries. Where we transfer personal information across borders, we rely on appropriate safeguards, such as standard contractual clauses or an adequacy decision, where required by applicable law. You may contact us for more information about these safeguards.

09Data retention

We keep personal information only for as long as we need it for the purposes described in this policy, to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. For data we process on a business's behalf, retention is governed by that business's instructions and our agreement with them. When information is no longer needed, we delete or anonymise it.

10Security

We take reasonable technical and organisational measures to protect personal information, including encryption in transit and at rest where appropriate, access controls, scoped and permissioned actions, and monitoring. Integration credentials are stored encrypted. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly if something goes wrong.

11Your rights & choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. These include rights under the EU and UK GDPR, the California CCPA/CPRA, and Singapore's PDPA, among others.

• If we are the controller (our website, prospects, and customer accounts), contact us at [email protected] and we will respond as the law requires.
• If your request concerns a conversation with a business that uses Alex, that business is the controller. Contact them directly, or reach us and we will forward your request to them.

If you are in the European Economic Area or the United Kingdom, you can reach us about your GDPR rights at [email protected]. Where the law requires us to designate a local representative, we will identify one.

We will not discriminate against you for exercising your rights. If you believe we have not handled your data properly, you may lodge a complaint with your local data protection authority.

12Cookies & similar technologies

The alex.app website does not use tracking, analytics, or advertising cookies. We may use strictly necessary cookies or similar storage only where required to deliver and secure the site. Any signed-in product dashboards we operate may use essential cookies needed to keep you logged in; where we ever introduce non-essential cookies, we will ask for your consent first.

13Children's privacy

Alex is a service for businesses and is not directed to children. We do not knowingly collect personal information directly from children. If you believe a child has provided us information directly, contact us and we will take appropriate steps to delete it.

14Changes to this policy

We may update this policy from time to time. When we do, we will revise the "last updated" date above, and for material changes we will provide a more prominent notice where appropriate. Please check back periodically to stay informed.