What we collect, why, where it lives and how to get it back. Written to be read, not skimmed past.
Last updated 26 September 2026
Alavida Ltd (“Alavida”, “we”, “us”) is a company registered in England and Wales with company number 16765050, whose registered office is at Flat 15 Cardinal Mansions, Carlisle Place, London SW1P 1EY. We build and operate a platform that gives a business’s AI agents governed access to the tools and accounts the business already uses. We are the data controller for the personal data described in this policy, except where we process data on a customer’s instructions, in which case the customer is the controller and we act as their processor.
Questions about this policy, or requests about your data, go to alex@alavida.ai.
This policy covers the Alavida website (alavida.ai), the Alavida platform and workspaces served on our subdomains, and the AI agents we run for our customers. It does not cover the practices of the third-party services you choose to connect through the platform, such as Google, Attio or Granola, which have their own policies.
Account data. When you sign in we receive your name, email address and a stable identifier from our identity provider, WorkOS. If you sign in with Google, Google shares only your basic profile (name, email address, profile picture). We do not receive your Google password.
Workspace data. Your organisation’s configuration: which servers and tools are enabled, which people and teams may reach them, which agents exist and who owns them.
Connected accounts. When you connect a third-party account (for example Gmail, Google Calendar, Attio, Granola or Spotify), the credentials for that account are held in a credential vault operated by our sub-processors (WorkOS, Amazon Web Services or Composio) and are used only to act on your behalf when you or an agent you own asks. Our own database never holds the plaintext credential.
Tool activity. For every tool call made through the platform we record who called it, which tool, on whose account, whether it succeeded, and when. We do not store the content of the request or the response in this record.
Agent conversations. Messages you exchange with an agent (for example over WhatsApp or the portal chat) are processed by that agent so it can answer, and are stored with the agent, in infrastructure dedicated to your organisation.
Website data. Standard server logs and, if you book a call, the details you give our scheduling provider.
Alavida’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sign in with Google gives us only your basic profile. Access to Gmail or Google Calendar is granted separately, by you, through a consent screen, and only for the account you choose to connect. That access is used solely to perform the actions you or your agent request (reading, drafting and sending mail; reading and managing calendar events). We do not use Google user data to train models, we do not sell it, and we do not share it with third parties except the sub-processors that carry the connection. You can revoke access at any time from your Google account or by disconnecting the account in your Alavida workspace.
Under UK GDPR we rely on performance of a contract (providing the service you or your organisation signed up for), our legitimate interests (securing and improving the service), consent (where you connect a third-party account or accept non-essential cookies) and compliance with legal obligations.
We use the following providers to run the service. Each is bound by terms that restrict use of your data to providing their service to us.
The platform runs in Amazon Web Services regions in the European Union and the United Kingdom. Each customer’s agents run in infrastructure dedicated to that customer. Some sub-processors operate globally; where personal data leaves the UK or EEA we rely on adequacy decisions or standard contractual clauses.
You can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent where we rely on it. Write to alex@alavida.ai. If you are a member of a customer’s workspace we may direct your request to that customer, as the controller. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).
Every action an agent takes is authenticated and checked against the organisation’s policy before it runs. Credentials are held in dedicated vaults and vended per call rather than copied. Data in transit is encrypted with TLS and data at rest is encrypted by our providers. Access to production systems is limited to named staff with multi-factor authentication.
The website sets one optional cookie: Google Analytics, which tells us which pages are read and how visitors found them. It runs only if you accept it in the cookie banner, and you can change your choice at any time from “Cookie settings” at the foot of every page. Your choice is remembered in your browser’s own storage and is not sent to us. The platform uses a session cookie to keep you signed in. We do not use advertising cookies.
We will post any changes on this page and update the date at the top. Where a change materially affects how we use your data we will tell workspace administrators directly.