Privacy Policy

Information you provide to us

We collect information you give us directly when you:

• Fill out a form on our website, including the project brief (/start-project)
• Book a strategy call through our scheduling system
• Communicate with us by email, phone, or WhatsApp
• Request a quote or describe a project through our AI-assisted chat (Nova)

This information may include: your name, company name, email address, phone number, and details about your project or needs.

Information we collect automatically

When you browse our website, we automatically collect certain technical and usage information, such as:

• Pages viewed and interactions on the site
• Approximate location derived from your IP address (e.g., city or country)
• Device and browser data (device type, operating system, browser)
• Cookie identifiers and similar technologies
• Campaign parameters (such as UTM parameters), captured by our analytics tool when analytics cookies are active
• Your cookie preference choice and, where applicable, a Global Privacy Control (GPC) signal sent by your browser

Details about the specific cookies we use, their categories, and how to manage your preferences are in our Cookie Policy. Cookie Policy.

We use the following tools, verified and active on this site, to understand how it is used and to improve its performance:

• Google Analytics 4: general measurement of website usage and performance. Only activates when you accept the Analytics cookie category.
• Microsoft Clarity: session analytics (including interaction recordings and heatmaps) to understand how visitors use our pages. Only activates when you accept the Analytics cookie category.

We use Google Consent Mode. This means that even before you respond, or while analytics is declined, Google may receive limited, cookieless signals (not tied to a cookie identifier) used to model aggregate trends; no analytics cookie is set or read without your consent.

We do not currently use Google Ads or any other advertising or remarketing technology on this site. If this changes, we will update this policy before activating that technology, reflected in Section 9.

You can accept, decline, or adjust the use of analytics cookies at any time from the Cookie Preferences center, accessible from the "Cookie Preferences" link in the site footer. See our Cookie Policy for more details.

Depending on applicable law, we process your information based on one or more of the following legal bases, depending on the type of processing:

• Consent, for non-essential analytics and advertising technologies where required
• Steps you requested before entering into a contract, such as evaluating a project or preparing a proposal
• Performance of a contract, when providing our services
• Legitimate interests, such as site security, responding to business inquiries, and improving our services, when those interests are not overridden by your individual rights
• Legal, accounting, and recordkeeping obligations

No single legal basis applies to everything we do. In particular, we do not use consent as the basis for processing information strictly necessary to answer a project inquiry — for that, the applicable basis is the pre-contractual steps described above.

We use the information we collect to:

• Respond to your inquiries and requests for information
• Schedule and confirm strategy calls
• Prepare proposals and quotes for your project
• Improve our services, content, and user experience
• Measure website performance and the performance of our marketing campaigns
• Prevent fraud and protect the security of our site and systems
• Comply with legal and contractual obligations

We work with trusted service providers who process information on our behalf to deliver their services, following our instructions where they act as our processor, and subject to their own contractual and privacy obligations. These include providers of:

• Hosting and infrastructure (Render)
• Transactional email (Resend)
• Scheduling and calendar (Google Calendar)
• Web analytics (Google Analytics 4, Microsoft Clarity)
• AI-assisted chat (Anthropic, for Nova)
• Live chat with a member of our team (Crisp), only when you request it

These providers only have access to the information necessary to perform their services. We do not currently use any advertising provider or customer relationship management (CRM) system to process this site’s information.

Nova is our website’s AI-assisted chat experience. Messages you send to Nova are processed by ALCA and by Anthropic, the AI service provider we use to generate Nova’s responses.

Do not submit sensitive personal information, passwords or other credentials, financial information, health information, or confidential third-party information to Nova.

Nova’s responses may be inaccurate. Nova does not make decisions that produce legal or similarly significant effects on you; it only answers questions and, where appropriate, directs you to our contact form or connects you with a member of our team.

You can ask to speak with a real person at any time; Nova will connect you to our live chat (Crisp).

In your browser, the conversation is stored only for your browsing session and is cleared when you close the tab or browser. We do not keep a copy of your messages on our own servers beyond what is needed to generate the response. Anthropic processes messages under its applicable commercial API terms, which state that this input is not used to train its models; we recommend checking Anthropic’s current terms if you need the exact retention detail on their systems.

We keep inquiry and project data for as long as our relationship remains active or a follow-up is reasonably expected (for example, responding to a proposal), and for the additional time needed to meet accounting, legal, or dispute-and-security recordkeeping obligations. The exact period depends on how sensitive the information is and whether it can be deleted or anonymized without affecting those obligations.

Analytics data (Google Analytics 4, Microsoft Clarity) is retained according to each tool’s own retention setting, controlled in that provider’s admin dashboard, and according to your cookie preferences. We have not externally confirmed the exact retention period configured in the Google Analytics 4 property dashboard as of this update; that value requires authenticated dashboard access and remains pending owner confirmation.

Nova conversations are retained in your browser only for your session, as explained in Section 6, and are not retained on our servers beyond what is needed to generate each response.

You can request deletion of your personal data at any time by emailing hello@alcasoftware.com. We will act on your request unless we must retain certain information for legal or contractual reasons; in that case, we will delete or anonymize the information once it is no longer reasonably necessary.

Depending on where you live and applicable law, you may have the right to:

• Know whether we process personal information about you
• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion, subject to exceptions
• Receive a portable copy where applicable
• Withdraw consent
• Opt out of marketing communications
• Opt out of sale, sharing, or targeted advertising where applicable
• Object to or restrict certain processing where applicable
• Appeal a denied request where applicable
• Not receive discriminatory treatment for exercising applicable rights
• File a complaint with a competent data-protection authority where applicable

To exercise any of these rights, email us at hello@alcasoftware.com. We may need to verify your identity before acting on the request. Not every right applies in every jurisdiction. We will respond within the timeframe required by applicable law.

We do not sell your personal information for monetary consideration. We also do not currently use any advertising or remarketing technology (see Section 2), so today we do not disclose online identifiers or website activity to advertising partners for conversion measurement, remarketing, or targeted advertising.

If we activate Google Ads or another advertising technology in the future, we will update this policy before turning it on to explain what identifiers and activity would be shared, with whom, and for what purposes — including whether, under certain privacy laws, those disclosures could be considered a "sale," "sharing," or processing for targeted advertising.

This does not mean we never share information: we share it with the service providers described in Section 5 (hosting, email, calendar, analytics, AI-assisted chat) so they can perform their services for us. That is not a sale or a disclosure for advertising purposes.

You can manage your advertising and analytics preferences at any time from the Cookie Preferences center. See also Section 10 on Global Privacy Control.

Where required and technically supported, we recognize Global Privacy Control (GPC) as a request to opt out of the sale or sharing of personal information and targeted advertising.

When your browser sends a GPC signal, the Marketing cookie category remains denied, even if you had previously accepted that category or if you click "Accept all" while the signal is active. Your Analytics preference is not affected by GPC and remains separately under your control.

You can see that advertising is disabled for this reason from the Cookie Preferences center. You remain able to reject all optional categories independently.

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects. This includes Nova, which only answers questions and directs you to our team or contact form — it never decides anything on your behalf.

We use reasonable administrative, technical, and organizational safeguards to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our services are intended for businesses and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child provided us with personal information, email hello@alcasoftware.com to request its removal.

Our service providers may process information in the United States and in other countries, whose privacy laws may differ from those of your own country. We use the safeguards required by applicable law in each case. We do not claim to have Standard Contractual Clauses, adequacy decisions, or other specific transfer mechanisms in place unless their implementation has been verified with the relevant provider.

We may update this privacy policy periodically to reflect changes in our practices, in the tools we use, or for legal reasons. The date of the last update is shown at the top of this page. We recommend checking this page from time to time.

If you have questions, concerns, or wish to exercise your rights related to this privacy policy, you can contact us:

For more information about the cookies we use and how to manage your preferences, visit our Cookie Policy.