Alovate AI
Privacy Policy
Last updated: 11 August 2026
1. Who we are
This policy explains how we handle personal data collected through alovate.ai and through the services we provide to our clients.
Alovate AI of Tel Aviv, Israel is the data controller for personal data collected through this website and for client workspace content. It decides why and how that data is processed, and it is the entity you deal with when you exercise any of the rights described below.
Subscriptions are sold and billed by our United States affiliate, Alovate AI of Delaware, United States, which is the contracting party under our Terms of Service. The two companies share personal data only as far as is needed to sell, bill and deliver the service. Throughout this policy, “we” and “us” mean both companies acting in those roles. You can reach either of them at hello@alovate.ai.
2. Personal data we collect
You give us
- Name, email address and phone number, through the contact form.
- Company name and free-text message, where you choose to provide them.
- Booking details when you schedule a call — name, email, timezone, and anything you type into the booking form.
- For clients: workspace login credentials, and the content of tickets, comments and files you upload.
We collect automatically
- IP address, user-agent, referring URL, pages viewed and timestamps.
- Page performance measurements (load timing and Core Web Vitals).
- With your consent, analytics and advertising identifiers — see the cookie table in section 9.
Payment data
Checkout runs entirely on Stripe-hosted pages. Your full card number, expiry date and security code are submitted directly to Stripe and never reach our systems. Stripe returns to us only what we need to run the subscription: the billing name and email, the billing country, the card brand and its last four digits, and whether each charge succeeded or failed. We use that solely for billing, accounting and fraud prevention.
3. Why we use it, and our lawful basis (GDPR)
| Purpose | Lawful basis (Art. 6) |
|---|---|
| Replying to a contact-form enquiry | Steps prior to entering a contract (Art. 6(1)(b)) |
| Scheduling and holding a call | Steps prior to entering a contract (Art. 6(1)(b)) |
| Providing the service and the client workspace | Performance of a contract (Art. 6(1)(b)) |
| Billing and financial records | Legal obligation (Art. 6(1)(c)) |
| Site security and abuse prevention | Legitimate interests (Art. 6(1)(f)) |
| Analytics | Consent (Art. 6(1)(a)) |
| Advertising and campaign measurement | Consent (Art. 6(1)(a)) |
| Marketing email to prior enquirers | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, we have balanced that interest against your rights and keep a record of the assessment. You can object to legitimate-interest processing at any time — see section 7. Where we rely on consent, you can withdraw it at any time, and doing so does not affect processing already carried out.
4. Sharing and subprocessors
We do not sell personal data for money. We share it with the service providers that operate this site and our delivery process. The current list, what each one receives, and where it is hosted, is published at alovate.ai/subprocessors.
We may also disclose personal data where legally required, or in connection with a merger, acquisition or sale of assets.
5. International transfers
Our providers are largely US-based, so personal data originating in the EEA, the UK or Israel is transferred outside its country of origin.
Israel holds an adequacy decision from the European Commission, so transfers of personal data from the EEA to our Israeli controller do not require an additional safeguard.
For transfers to our providers in the United States we rely on the Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum where UK data is involved), incorporated into our data processing agreement with each provider. Where a provider is self-certified under the EU-US Data Privacy Framework and its UK extension, we rely on that framework instead. You can ask us which mechanism applies to a specific provider at hello@alovate.ai.
6. Retention
We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires. In practice that means:
| Category | Retention period | What triggers deletion |
|---|---|---|
| Contact-form enquiries | 24 months | From our last substantive contact with you. |
| Booking records | 24 months | From the date of the booked call. |
| Client workspace content, tickets and uploaded files | Subscription term + 90 days | Deleted 90 days after the subscription ends, unless you ask us to delete it sooner. |
| Billing and financial records | 7 years | Required by tax and company record-keeping law; not shortened on request. |
| Transactional email logs | 12 months | From the date the message was sent. |
| Analytics data | 14 months | Google Analytics 4 property retention setting; expires automatically. |
| Cookie consent records | 180 days | The lifetime of the consent cookie itself; renewed when you re-confirm. |
When a period expires we delete the data or irreversibly anonymise it. Backups are overwritten on their own cycle and are purged within 90 days of the live record being deleted.
7. Your rights in the EEA and the UK (GDPR)
If you are in the EEA or the UK you have the right to access your personal data, to rectify it, to erase it, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing already carried out. You also have the right to lodge a complaint with your supervisory authority.
To exercise any of these, contact us at hello@alovate.ai. We respond within one month. If a request is complex we may extend that by a further two months and will tell you why within the first month. We do not charge for responding, and we may ask you for enough information to confirm your identity before we act.
We have not appointed a Data Protection Officer, because our processing does not meet the conditions in Art. 37 — we do not carry out large-scale systematic monitoring, and special categories of data are not part of our core activity. Data protection questions go to the same address above and are handled by our management directly.
8. California residents (CPRA)
Notice at collection. We collect the categories of personal information described in section 2 — identifiers, commercial information, internet activity, and, for clients, professional information — for the purposes in section 3. We do not collect sensitive personal information for the purpose of inferring characteristics.
Categories disclosed in the preceding 12 months. We disclosed identifiers (name, email, phone) and internet activity to the providers listed at alovate.ai/subprocessors for the business purposes stated there. We disclosed commercial information to our payment processor for billing. We did not disclose personal information to any third party for monetary consideration.
Sale and sharing.We do not sell personal information for money. Our use of Google Ads may constitute “sharing” for cross-context behavioural advertising as the CPRA defines it. You can opt out at any time:
That control withdraws advertising consent on this browser. We also treat a Global Privacy Control signal as a valid opt-out of sharing, applied on this browser as soon as the signal is detected.
California residents have the right to know, delete, correct, and to non-discrimination for exercising these rights. To exercise the right to know, delete or correct, email hello@alovate.ai. You may use an authorised agent, in which case we will ask for proof of their authority.
9. Cookies and similar technologies
Necessary cookies are set on every visit. Analytics and advertising cookies are set only after you consent, and Google Consent Mode holds those categories in a denied state until you choose. You can change or withdraw your choice at any time using the Cookie preferences link in the footer.
The booking calendar is supplied by Cal.com in an iframe. It loads on our booking pages because it is strictly necessary to provide the booking you asked for, and it may set its own storage under cal.com. Our accessibility panel stores the display preferences you select in your browser’s local storage; it writes only when you change a setting, and nothing it stores leaves your device.
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| alovate_consent | Alovate (first-party) | Stores your cookie choice and the timestamp of it, so you are not re-prompted. | 180 days | Necessary |
| alovate_workspace | Alovate (first-party) | Signed, HTTP-only client workspace session. | 7 days | Necessary |
| alovate_client | Alovate (first-party) | Signed, HTTP-only project board session. | 8 hours | Necessary |
| alovate_admin | Alovate (first-party) | Signed, HTTP-only administrator session. Staff only. | 8 hours | Necessary |
| alovate_portal | Alovate (first-party) | Legacy workspace session, read for backwards compatibility only; never newly set. | Legacy — cleared on logout | Necessary |
| alovate-a11y, alovate-a11y-lang | Alovate (first-party, localStorage) | Remembers accessibility settings you selected, such as contrast and text size. | Until cleared in your browser | Necessary |
| Cal.com booking embed | Cal.com (third-party iframe) | Runs the booking calendar on our booking pages. Strictly necessary to provide a booking you requested. | Set by Cal.com under cal.com | Necessary |
| _ga | Google Analytics | Distinguishes returning visitors. | 2 years | Analytics |
| _ga_<measurement id> | Google Analytics | Maintains GA4 session state for this property. | 2 years | Analytics |
| _gcl_au | Google Ads | Attributes an enquiry to the advertising click that produced it. | 90 days | Marketing |
| IDE, test_cookie, NID | Google (doubleclick.net, google.com) | Advertising measurement and remarketing set on Google domains. | Up to 13 months (Google-defined) | Marketing |
10. Israeli Privacy Protection Law
Our Israeli controller processes personal data under the Israeli Privacy Protection Law, 5741-1981, as amended by Amendment 13, which took effect in August 2025.
Where Israeli law applies, you have the right to:
- inspect personal data we hold about you;
- request that it be corrected, completed or deleted where it is inaccurate;
- ask that your details not be used for direct-marketing purposes; and
- complain to the Privacy Protection Authority (gov.il).
Requests go to hello@alovate.ai and are answered within 30 days. We apply the information-security obligations set by the Privacy Protection (Data Security) Regulations to the databases we operate, and where a security incident affecting personal data reaches the threshold set by law we notify the Privacy Protection Authority, and affected individuals where required.
11. Security
We use HTTPS throughout, restrict access to client data to authorised personnel, and use providers that maintain recognised security standards. Workspace session cookies are HTTP-only, signed, and expire. Passwords are stored hashed, never in plain text. No method of transmission or storage is completely secure.
12. Children
This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has given us personal data, contact hello@alovate.ai and we will delete it.
13. Changes to this policy
We may update this policy. The current version is always published on this page with its last-updated date. Where a change materially affects how we use personal data we already hold, we will tell you before it takes effect.
14. Contact
Questions or requests about this policy: hello@alovate.ai.