AlphOne

Privacy policy

Version 1. Last updated: 2026-11-01.

In short

  • Who: Miriam Blanco, Ciudad Real, support@alph.one. We sell and run AlphOne Pro, and we decide how the data on this page is used.
  • What: the email address you type on our site, what you give at checkout, your workspace name, your emails to us, and your sign-in to the app.
  • Why: to sell you the service and run it, to bill you, to answer you, to keep the service safe and, only if you ask, to send you product news.
  • Who else: Stripe for payments, Resend for email (United States), Hetzner for our server (Finland), Amazon Web Services for backups (Ireland), and Spaceship (United States) and Cyberlabs Inc. for email to us.
  • Cookies: none for visitors to alph.one. One sign-in cookie on the app.
  • Your rights: you can ask to see, correct, delete or take your data, limit or object to its use, and withdraw consent. Write to support@alph.one. You can complain to the Spanish data protection authority (AEPD).
  • Workspace content: the contacts, conversations and tasks inside a workspace belong to the customer that runs it. That customer decides about them, and we handle them on its behalf.

Visitors to alph.one

  • We set no cookies and load nothing from other companies.
  • Our server sees your IP address with each request, as every website does. We do not record visits.
  • To stop abuse, the sign-up, checkout, naming and billing portal steps count requests per IP address, and per email address or checkout reference. The count is kept only in the server's memory, as a short code computed from the value, not the value itself. It is cleared at the latest by the first of those steps that anyone takes 20 minutes or more later, and on every restart.
  • Our software records events and errors, not visits. An error message can include an email address or a workspace name. These records sit on our server in a few files of limited size, and new lines overwrite the oldest as the files fill.
  • Legal basis: our legitimate interest in keeping the site safe and working (GDPR article 6(1)(f)).

Buyers

When you type your email address on the pricing page:

  • We email you a link to checkout. We store nothing in our own database at this point. The link carries your address and your answer to the product news box. It stops working after 24 hours.
  • When you open the link, we create your customer record at Stripe with your email address and your product news answer. Stripe also keeps a copy of the link, with your address and that first answer, on your checkout and subscription records.
  • Legal basis: steps you ask for before a contract (GDPR article 6(1)(b)).

At checkout and after:

  • Stripe collects your card, billing name, billing address and, if you give one, your tax ID. We never see your card.
  • We keep your email address, the name you gave at checkout, your workspace name, Stripe's references for your customer record and subscription, and your payment status and dates.
  • We use them to create your workspace and its first administrator account, to bill you, to send you service emails and to support you. Legal basis: the contract (GDPR article 6(1)(b)).
  • We keep invoices and accounting records because tax and commercial law require it. Legal basis: legal obligation (GDPR article 6(1)(c)).
  • We use them to catch double payments and fraud, and to handle disputes and chargebacks. Legal basis: our legitimate interest in protecting our business (GDPR article 6(1)(f)).
  • You must give your email address and billing details to buy. Without them we cannot sell you the service.

Product news:

  • We send product news only if you tick the box. It is not ticked by default.
  • The news is about new AlphOne features and offers for AlphOne Pro. We send it at most once a month.
  • Your answer is stored with your customer record at Stripe.
  • Every news email has a link to stop. You can also write to support@alph.one. Stopping does not affect what we sent before.
  • Legal basis: your consent (GDPR article 6(1)(a) and LSSI article 21).
  • You can also join the Spanish advertising exclusion list, Lista Robinson.

People with an account in a workspace

  • The customer that runs the workspace invited you. It decides about your account and your work there, and we handle that data on its behalf. Ask that customer first.
  • We create the first administrator account of a workspace from the buyer's email address and the name given at checkout.
  • We send invitation and password reset emails through Resend.
  • When you sign in, your browser gets one sign-in cookie (see Cookies).
  • To stop abuse, we count failed sign-ins, reset requests and bad links per IP address, and reset requests per email address, in memory only. Legal basis: our legitimate interest in keeping the service safe (GDPR article 6(1)(f)).

People whose details are in a workspace

  • If a business that uses AlphOne Pro holds your details, that business is the controller. We store and process your data for it, under a data processing contract.
  • To use your rights, contact that business. If you write to us, we pass your request on to it.

Emails to us

  • When you write to support@alph.one, we use your message to answer you. Legal basis: the contract if you are a customer, otherwise our legitimate interest in answering you (GDPR article 6(1)(b) and (f)).
  • Email to that address passes through Spaceship, which forwards it to our mailbox at Cyberlabs Inc..

Security and fraud checks

Under our legitimate interest in keeping the service and our customers safe (GDPR article 6(1)(f)), we:

  • count requests and failed sign-ins in memory, as described above
  • sign the checkout and billing links we email, so nobody can forge one
  • check that the address that paid is the address that asked for the link
  • watch for double payments, disputes and chargebacks
  • keep a record of the commands our staff run on the server, which can include your email address or workspace name
  • check accounts, member counts, tokens, webhook addresses, error records and payment risk signals for signs of abuse, without reading what a workspace holds

Stripe may also screen payments for fraud, under its own privacy policy. We switch a workspace off automatically when Stripe reports that payment failed for good or the subscription ended, as the terms say. We make no other decision about you based only on automated processing.

Who receives your data

  • Stripe (AlphOne): payments, tax, invoices and the billing portal. Stripe also uses the data for its own purposes, such as fraud prevention, as a controller under Stripe's privacy policy. It sends you receipts and billing emails. Stripe may transfer data to the United States and other countries, using the EU-US Data Privacy Framework and the EU standard contractual clauses.
  • Resend (Plus Five Five, Inc.), United States: sends the emails our site and our app send automatically. Safeguards: the EU-US Data Privacy Framework and the EU standard contractual clauses.
  • Hetzner Online GmbH, Germany: runs our server in Finland, which holds the site, the app and their databases.
  • Amazon Web Services EMEA SARL, Luxembourg: stores our backups in Ireland.
  • Spaceship, Inc., United States: runs our domain and forwards email sent to support@alph.one. Safeguards: the EU standard contractual clauses.
  • Cyberlabs Inc.: holds our support mailbox and the mailbox for our own service alerts. An alert can show a buyer's email address. Location: Delaware, USA.
  • Authorities and courts, when the law requires it.

We do not sell your data. Ask us for a copy of the safeguards for any transfer outside the European Economic Area.

How long we keep data

  • The checkout link: it stops working after 24 hours. Its copy at Stripe stays with your checkout and subscription records for as long as Stripe keeps them.
  • Request counts for abuse checks: in memory only, as described above.
  • Event and error records: until newer lines overwrite them, as described above.
  • Copies of these records, and of member and token lists, that we save for a security check: 30 days.
  • Backups: about 30 days.
  • Stripe customer records of people who opened the checkout link but never paid: up to 90 days. We delete them by hand every month.
  • Your purchase records: while you are a customer and during the 12 months in which you can come back. After that we keep only what accounting and tax law require, for 6 years, then we delete it.
  • Your answer on product news: on your customer record until you withdraw it or we delete the record. We follow only that record, not the copy in the checkout link.
  • Emails to support and our service alerts: 2 years after the last message in the conversation. We delete older ones by hand every month.
  • Records of the commands our staff run: 2 years.
  • Workspace content and accounts: as the customer decides, and as section 11 of our terms of service explains.

Cookies

  • alph.one sets no cookies. Only our own staff get a sign-in cookie, when they sign in to the site's admin.
  • app.alph.one sets one cookie, __Host-alphone_session, when you sign in. It keeps you signed in for up to 30 days, or until you sign out. It is needed to use the app, and we use it for nothing else.
  • Checkout and the billing portal run on Stripe's own website, which sets its own cookies under Stripe's policies.
  • We use no analytics, advertising or tracking cookies.

Your rights

You can ask us to:

  • give you a copy of your data
  • correct it
  • delete it
  • limit how we use it
  • send it to you or to another company in a common format
  • stop using it, where we rely on our legitimate interest

You can withdraw your consent at any time.

How to ask:

  • Email support@alph.one from the address we know. If you cannot, email us from another address.
  • It is free. We may ask you to prove who you are.
  • We answer within one month. For complex requests we can take two more months, and we tell you why within the first month.
  • For data inside a workspace, ask the customer that runs it.

You can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, at aepd.es or through its electronic office. You can also complain in the EU country where you live or work.

Changes

Each version has a date. If a change matters, we email customers before it applies.