Privacy Policy

1. Introduction and Scope

Alaga, operated by Alaga LLC ("we," "our," or "us"), is a business-to-business software-as-a-service (B2B SaaS) platform that provides pet care management tools for groomers, boarding facilities, daycare operators, and related pet care businesses. Alaga LLC is headquartered in Humble, Texas.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you interact with our platform, website, and related services. It applies to the following categories of individuals:

• Business Subscribers: Pet care business owners and operators who subscribe to the Alaga platform.
• Staff Users: Employees, contractors, and team members who are granted access to a Business Subscriber's Alaga account.
• End-Users (Pet Owners): Individuals whose information is entered into Alaga by a Business Subscriber or their staff in connection with pet care services.
• Website Visitors: Individuals who visit alaga.io or any Alaga-operated website.

Our Role as Data Processor and Data Controller

Alaga operates as an independent software vendor (ISV) that provides tools to pet care businesses. Under this model:

• Data Controller: Alaga acts as the data controller for information we collect directly for our own purposes, including Business Subscriber account data, subscription and billing information, website analytics, and marketing communications.
• Data Processor: Alaga acts as a data processor for the personal data that Business Subscribers enter into the platform about their clients (End-Users), pets, appointments, and business operations. The Business Subscriber is the data controller for this information and determines the purposes and means of processing. Alaga processes this data on their behalf in accordance with our Terms of Service and applicable data processing agreements.

2. Information We Collect

2a. Business Subscriber Information

When you create a Business Subscriber account or interact with our sales and support teams, we collect:

• Account Information: Name, email address, phone number, business name, business address, and business logo.
• Billing Information: Subscription billing is processed by Stripe. We store your Stripe customer ID and subscription status. We do not store credit card numbers, CVVs, or full payment card details on our servers.
• Staff Data: Names, email addresses, assigned roles and permissions, time entries and clock-in/clock-out records, payroll rates, and commission rates for staff members added to your account.

2b. End-User Information (Collected on Behalf of Business Subscribers)

Business Subscribers and their staff enter the following information about their clients (pet owners) into the platform. Alaga processes this data on behalf of the Business Subscriber:

• Client Profile: First name, last name, email address, phone number, and mailing address.
• Pet Data: Pet name, species, breed, weight, date of birth, gender, color/markings, microchip number, medical notes, dietary needs, veterinarian name, veterinarian phone number, emergency contact information, and pet photos.
• Activity Data: Appointments, boarding/daycare reservations, invoices and payment history, booking history, signed service agreements, and responses to intake questionnaires.
• Communication Data: Messages sent and received through the platform, SMS history, and notification preference settings.

2c. Automatically Collected Information

When you access our platform or website, we automatically collect certain information, including:

• Usage Data: Pages visited, features used, actions taken, timestamps, and session duration.
• Device Data: Browser type and version, operating system, screen resolution, and device type.
• Network Data: IP address, approximate geographic location derived from IP, and referring URL.
• Cookies and Similar Technologies: We use cookies and similar tracking technologies as described in our Cookie Policy.

2d. Marketing and Communication Preferences

We track the following consent-related information to ensure compliance with applicable messaging laws:

• Email Preferences: Opt-in or opt-out status and the timestamp of each preference change.
• SMS Preferences: Opt-in or opt-out status and the timestamp of each preference change, including the method of consent (e.g., web form, in-person, keyword reply).

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and Improve Our Services: To operate, maintain, and enhance the Alaga platform, including developing new features and fixing issues.
• Process Payments: To process subscription payments, facilitate payment transactions between Business Subscribers and their clients through integrated payment processors, and manage billing records.
• Transactional Notifications: To send appointment reminders, booking confirmations, invoice receipts, account alerts, and other service-related communications necessary for platform operation.
• Marketing Communications: To send promotional emails, product updates, and newsletters only to individuals who have provided explicit opt-in consent. You may unsubscribe at any time.
• Customer Support: To respond to inquiries, troubleshoot issues, and provide technical assistance.
• Analytics and Research: To analyze usage patterns, measure feature adoption, and inform product decisions. Analytics data is aggregated and does not identify individual End-Users.
• Security and Fraud Prevention: To detect, investigate, and prevent unauthorized access, abuse, or fraudulent activity on our platform.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforceable governmental requests.

4. Legal Bases for Processing

We process personal information under the following legal bases:

• Contractual Necessity: Processing is necessary to perform our contract with Business Subscribers, including providing access to the platform, processing payments, and delivering the subscribed services.
• Legitimate Interest: Processing is necessary for our legitimate business interests, such as improving our services, ensuring platform security, preventing fraud, and conducting aggregated analytics, provided these interests are not overridden by your rights and freedoms.
• Consent: Where required by law, we obtain your explicit consent before processing, including for marketing communications, SMS messaging, and the use of non-essential cookies. You may withdraw consent at any time.
• Legal Obligation: Processing is necessary to comply with applicable laws and regulations, including tax reporting, financial record-keeping, and responding to valid legal process.

5. Third-Party Data Processors and Sub-Processors

We use the following third-party service providers to operate and deliver the Alaga platform. Each provider processes data only for the purposes described below and is bound by contractual data protection obligations:

6. SMS and Messaging Privacy

Alaga enables Business Subscribers to send SMS and text messages to their clients through our platform using Twilio as the messaging infrastructure provider. This section provides additional detail about how mobile information is handled. For complete messaging terms including message frequency, rates, and carrier-specific disclosures, please see our Messaging Terms and Conditions.

Consent Tracking

We maintain records of SMS consent for each End-User, including the method of opt-in (web form, in-person, keyword reply), timestamp of consent, and the Business Subscriber on whose behalf the consent was obtained. Consent records are retained for the duration of the messaging relationship and for a reasonable period thereafter to demonstrate compliance.

Opt-Out Mechanisms

End-Users may opt out of SMS messages at any time through any of the following methods:

• Reply STOP: Reply STOP (or QUIT, CANCEL, END, UNSUBSCRIBE) to any message received through the platform.
• Client Portal: Update messaging preferences through your client portal if your Business Subscriber has enabled one.
• Email Request: Send a request to chris@alaga.io with the subject line "SMS Opt-Out" including your phone number and the business name.

7. Data Sharing

We share personal information only in the following limited circumstances:

• Third-Party Service Providers: We share data with the sub-processors listed in Section 5, solely for the purposes described in that section. Each provider is contractually obligated to protect the data and use it only as directed.
• Business Subscriber Access: End-User data entered into the platform is accessible to the Business Subscriber and their authorized staff members in accordance with their assigned roles and permissions. For example, a staff member with a "groomer" role may see appointment details but not payroll data.
• End-User Visibility: End-User data is accessible to the Business Subscriber that collected it. End-Users may view their own data through a client portal if their Business Subscriber has enabled that feature.
• Law Enforcement and Legal Process: We will disclose personal information to law enforcement agencies, courts, or other governmental authorities only in response to a valid legal process, such as a subpoena, court order, or search warrant, or where disclosure is necessary to protect the safety of any person.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, personal information may be transferred as part of that transaction. We will provide notice via email and/or a prominent notice on our website before any such transfer and before your personal information becomes subject to a different privacy policy.

8. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected. Specific retention periods are as follows:

• Active Accounts: Business Subscriber data, staff data, and associated End-User data are retained for the duration of the active subscription.
• After Cancellation: Upon cancellation, Business Subscribers have a 30-day window to export their data. After the export period, account data is scheduled for deletion and will be permanently removed within 90 days.
• End-User Data: End-User data entered by a Business Subscriber is retained for as long as that Business Subscriber's account remains active. End-User data is deleted in accordance with the Business Subscriber's account deletion schedule.
• Financial and Tax Records: Invoices, payment records, and other financial data required for tax compliance are retained for 7 years, as required by applicable law.
• Activity Logs: Platform activity logs (login history, feature usage, audit trails) are retained for 2 years.
• Backups: Automated backup copies are purged within 30 days of the deletion of the source data.

9. Your Rights

9a. All Users

Regardless of your location, you have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion (Erasure): Request deletion of your personal information, subject to legal retention requirements.
• Data Portability: Request a copy of your data in a structured, machine-readable format (JSON or CSV export).
• Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing performed prior to withdrawal.
• Object to Processing: Object to the processing of your personal information for certain purposes, including direct marketing.

If you are an End-User whose data was entered by a Business Subscriber, please direct your request to the Business Subscriber first. If you are unable to reach them or need additional assistance, you may contact us directly.

9b. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale: You have the right to opt out of the sale of your personal information. Alaga does not sell personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

9c. Texas and Other State Privacy Laws

Residents of states with comprehensive privacy legislation may have additional rights. These laws include, but are not limited to:

• Texas Data Privacy and Security Act (TDPSA): Texas residents have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of the processing of personal data for targeted advertising, sale, or profiling.
• Virginia Consumer Data Protection Act (VCDPA): Virginia residents have similar rights to access, correction, deletion, portability, and opt-out.
• Colorado Privacy Act (CPA): Colorado residents have rights to access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, or profiling.
• Connecticut Data Privacy Act (CTDPA): Connecticut residents have similar rights to access, correction, deletion, portability, and opt-out of targeted advertising, sale, or profiling.

10. International Data Transfers

The Alaga platform is hosted in the United States and our third-party service providers primarily process data within the United States. If you access the platform from outside the United States, you understand and consent to the transfer of your personal information to the United States, where data protection laws may differ from those in your jurisdiction. We take reasonable steps to ensure that your personal information receives an adequate level of protection in the jurisdictions in which we process it.

11. Children's Privacy

The Alaga platform is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA).

Pet data and client profile information entered into the platform by Business Subscribers or their staff is entered by adults in their capacity as pet care professionals. Where a pet owner is a minor, the information is entered by the minor's parent, guardian, or the business on their behalf, and is treated as parental data for the purposes of this policy.

If you believe that we have inadvertently collected personal information from a child under 13, please contact us immediately at chris@alaga.io so that we can take appropriate steps to delete the information.

12. Data Security

We implement technical and organizational security measures designed to protect your personal information, including:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS).
• Encryption at Rest: Data stored in our database is encrypted at rest using AES-256 encryption provided by our infrastructure providers.
• Row-Level Security: Our database implements row-level security (RLS) policies through Supabase, ensuring that each Business Subscriber can only access their own data.
• Role-Based Access Control: Staff members within a Business Subscriber's account are granted access only to the features and data appropriate to their assigned role.
• Secure Authentication: We use JSON Web Tokens (JWT) for session management, with secure token handling, expiration policies, and support for multi-factor authentication.
• PCI Compliance: Payment card data is handled exclusively by our PCI-DSS compliant third-party payment processors (Stripe, Square, Paygistix). Alaga does not store, process, or transmit cardholder data.
• Regular Security Reviews: We conduct periodic reviews of our security practices, access controls, and infrastructure configurations.

While we strive to protect your personal information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to maintaining commercially reasonable safeguards.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• Material Changes: For material changes that significantly affect how we collect, use, or share your personal information, we will provide at least 30 days' advance notice via email to the address associated with your account before the changes take effect.
• Non-Material Changes: Minor updates, clarifications, and formatting changes will be reflected by updating the "Last updated" date at the top of this page.

Your continued use of the Alaga platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated policy, you should discontinue use of the platform.

14. Contact Us and Data Protection Requests

If you have questions about this Privacy Policy, our data practices, or wish to exercise any of your rights described above, please contact us:

Data Rights Requests: To submit a request to access, correct, delete, or export your personal information, please send an email to chris@alaga.io with the subject line "Data Rights Request." Include your name, email address, the nature of your request, and any details that will help us identify your account. We will acknowledge your request and respond within 45 days. If additional time is needed due to the complexity of the request, we will notify you of the extension.

Related Policies

This Privacy Policy should be read in conjunction with our other policies:

• Terms of Service
• Cookie Policy
• Messaging Terms and Conditions
• Acceptable Use Policy