Privacy Policy

Alba Digital Development LLC ("AlbaDigi", "we", "us", or "our"), 221 Majorca Avenue, Coral Gables, FL 33134, USA, operates the albadigi.com platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

1. Information We Collect

1.1 Information You Provide

• Account Information: When you sign in via Google OAuth, we receive your name, email address, and profile picture from your Google account.
• Business Information: Business name, address, phone number, logo, and other details you provide to configure your account and tools.
• Content: Data you create using our tools, including invoices, bookings, digital cards, landing pages, QR codes, contracts, and other business documents.
• Payment Information: When you subscribe or purchase products, payment is processed by Stripe. We do not store your credit card number — Stripe handles this securely.
• Communications: If you connect your Gmail account, we access your Gmail only to send emails on your behalf (e.g., invoices, booking confirmations). We do not read or store your inbox.

1.2 Information Collected Automatically

• Usage Data: Pages viewed, features used, timestamps, and interactions with our platform.
• Device Information: Browser type, operating system, IP address, and device identifiers.
• QR Scan Data: When someone scans a QR code you created, we collect the scanner's approximate location (via IP geolocation), device type, and timestamp for your analytics dashboard.
• Digital Card Analytics: Views, taps, and lead submissions on your LixCard digital business cards.

1.3 Attendance and Time Clock Data (AlbaCard Business)

Businesses that use AlbaCard Business can record their employees' working hours. When they do, we process the following data on behalf of that business (the employer), which decides how it is used and is responsible for informing its employees:

• Clock-in and clock-out records: the date and time of each entry and exit, how it was made (badge, phone or manual) and any changes the business makes to it.
• Phone location when clocking in or out: when an employee taps Clock in or Clock out on their phone, the browser asks for permission and, if it is granted, sends the location (latitude, longitude and accuracy) once, at that moment. We compare it with the employee's assigned work site and store the result and the distance with the record. We never collect location in the background, between punches or anywhere outside that button. If permission is denied, the punch is recorded without a location and marked as such for the employer.
• AlbaDigi TimeClock app (Android): a phone or tablet that a business pairs as its time clock sends, for each badge tap, the identifier written on the badge, a device identifier (Android ID), the device's time zone and its model. The app does not access location, contacts, photos, the microphone or files. Its pairing code is stored encrypted on the device, and the business can remove a device at any time. The pairing QR code is read with the Google Play services code scanner, which does not give the app access to the camera.
• Time off: requests, dates, types, reasons and approval decisions entered by the employee or the business.

Attendance data is kept for as long as the business keeps it in its account, and is deleted when the business deletes the records or closes its account (see Section 6). Employees who want to see or correct their attendance records should contact their employer; we help the employer respond to those requests.

1.4 Data About Your Customers, Clients and Employees

When you use AlbaDigi to run your business, you enter data about other people: your contacts and leads, clients, bookings, orders, invoices, employees and, if you use tools such as TheraPlay (group therapy sessions) or FitCoach (coaching), health and wellness information about your clients or patients. For that data, you are the controller and AlbaDigi processes it only on your behalf, to provide the service. You are responsible for having a legal basis to collect it, for informing those people and, where the law requires it (for example for minors or health data), for obtaining their consent.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our platform and services
• Process transactions and send related notifications
• Send you the emails needed to run your account (see Section 6)
• Send emails on your behalf through connected Gmail accounts
• Provide analytics and insights about your business tools (QR scans, card views, booking stats)
• Record attendance on behalf of employers: clock-in and clock-out, hours worked, overtime and time off
• Respond to customer service requests
• Keep a record of the version of our Terms of Service and this Privacy Policy you accepted, when, and how
• Detect and prevent fraud or abuse
• Comply with legal obligations

3. Google OAuth & Gmail Integration

Our platform uses Google services in two ways:

3.1 Google Sign-In (OAuth 2.0)

We use Google OAuth solely for authentication. We request only basic profile scopes (openid, email, profile) to verify your identity and create your account. We do not access any other Google services through this login.

3.2 Gmail Send Integration (Optional)

If you choose to connect your Gmail account to send emails (invoices, booking confirmations, etc.), we request the gmail.send scope. This allows us to:

• Send emails on your behalf from your Gmail address
• Send only the emails you explicitly trigger (e.g., sending an invoice)

We do not:

• Read, scan, or index your email inbox
• Access your email contacts, drafts, or labels
• Send any emails without your explicit action
• Share your Gmail data with any third party

Your Gmail OAuth tokens are encrypted at rest using AES encryption and stored securely. You can disconnect your Gmail at any time from your account settings, which immediately revokes our access.

3.3 Google Places API

If you use the Google Business Profile integration, we use the Google Places API to help you find and connect your business listing. We retrieve your business name, address, rating, and reviews to display on your landing page or digital card. This data is fetched in real time and not permanently stored.

4. Artificial Intelligence

Some features use artificial intelligence: the Alba AI assistant, text and image generation, reading invoices and documents you upload, and suggestions inside the modules. When you use them, the content needed for that request (for example your question, the document or the data of the record you are working on) is sent to the AI provider that generates the answer:

• Google Gemini (Google Cloud) — the provider we use by default.
• DeepSeek or Qwen — only if you choose one of them in your settings and add your own API key; the request is then made with your key, under that provider's terms.
• Anthropic Claude — only if you connect your own Claude account to AlbaDigi; Claude then reads the data you allow it to access, under Anthropic's terms.

AlbaDigi does not use your content or your customers' data to train AI models. Google processes it under the paid Gemini API and Google Cloud terms, under which it does not use it to train or improve its models. Your AI conversations are stored in your account until you delete them or close your account. AI answers can be wrong: review them before relying on them.

5. Service Providers

We use the following providers, which may process personal data to provide their part of the service. Some are always used; others only when you (or the business you deal with) connect them.

Always used

• Google Cloud Platform: hosting, database, file storage, and AI services (Gemini, Document AI)
• Cloudflare: domain name service, content delivery and protection against attacks; it handles every request to our sites, including the visitor's IP address
• Google Workspace (Gmail): delivery of the emails AlbaDigi sends you
• Stripe: payment processing (Stripe Privacy Policy)
• ip-api.com: receives the IP address of whoever scans a QR code, to estimate their approximate location for the QR owner's analytics
• OpenStreetMap: map tiles and address search used by businesses to place their work sites (the address typed is sent; employee locations are never sent)

Only when connected

• Google OAuth / Gmail API / Google Places: sign-in, sending email from your Gmail, and your Google Business Profile (see Section 3)
• PayPal and Square: payment links for a business's invoices
• Twilio: text messages sent with a business's own Twilio account
• Shippo and USPS: shipping rates and labels (sender and recipient names and addresses, parcel details)
• Intuit QuickBooks: importing and exporting products and accounting data
• Slack and Telegram: notifications and messages through a connected workspace or bot
• DeepSeek, Qwen and Anthropic Claude: AI, as described in Section 4

We do not sell, rent, or trade your personal information to third parties.

6. Emails We Send

Service emails. Creating an account means we will send you the emails needed to run and protect it: sign-in and security notices, receipts, invoices and renewals, trial expirations, changes to the modules you use, support replies, and important changes to our Terms or this Policy. These are part of the service and cannot be turned off while your account is open.

News and promotions. We may also send you news about AlbaDigi, tips, recommendations and referral program updates. Every one of these emails has an unsubscribe link; once you use it, we stop sending them to that address from all of AlbaDigi, and it does not affect service emails. You can also ask us at support@albadigi.com.

Emails businesses send with AlbaDigi. When a business uses AlbaDigi to email its own contacts, that business is the sender and is responsible for having permission. We add an unsubscribe link to those emails and stop sending that business's emails to anyone who uses it.

7. Data Storage & Security

Your data is stored on Google Cloud Platform servers in the United States. We implement industry-standard security measures including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Encryption at rest for sensitive credentials (OAuth tokens, API keys)
• Access controls and multi-tenant data isolation
• Regular security reviews and updates

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account:

• Your personal information is deleted within 30 days
• Business data (invoices, bookings, etc.) is permanently removed
• Gmail OAuth tokens are immediately revoked and deleted
• Anonymized analytics data may be retained for aggregate reporting

We keep the record of which version of our Terms and this Policy you accepted, and of any unsubscribe request, for as long as your account exists, and afterwards only as long as we need it to show that we honored it.

9. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data
• Portability: Request your data in a machine-readable format
• Objection: Unsubscribe from news and promotions at any time
• Revoke Consent: Disconnect Gmail or any other integration, or delete your account, at any time

To exercise any of these rights, contact us at support@albadigi.com. If your data was entered by a business that uses AlbaDigi (for example as its customer, patient or employee), please contact that business first; we will help it respond. If you are in the European Union, you can also complain to your data protection authority.

10. Cookies

On albadigi.com we use only the essential cookies required for sign-in and session management. We do not use advertising or third-party tracking cookies. Session cookies are deleted when you close your browser.

Websites and online stores that businesses publish with AlbaDigi may include analytics or advertising tags (such as Google Analytics or the Meta Pixel) that the business adds itself. That business is responsible for informing its visitors and, where required, asking for their consent.

11. Children's Privacy

AlbaDigi accounts are for people 18 or older, as our Terms of Service require. We do not knowingly collect personal information from children to create accounts. Businesses that use AlbaDigi may enter information about minors (for example, a coach's or therapist's clients); they are responsible for obtaining the consent of a parent or guardian, and we process that information only on their behalf.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page, update the "Effective" date, and show you the notice again the next time you sign in.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: support@albadigi.com
• Mail: Alba Digital Development LLC, 221 Majorca Avenue, Coral Gables, FL 33134, USA
• Website: albadigi.com
• WhatsApp: +1 (786) 402-1740