California Notice at Collection

Effective Date: April 16, 2026 · Last Updated: April 16, 2026

This Notice at Collection is provided to California residents under the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), Cal. Civ. Code §§ 1798.100 et seq. It describes the categories of personal information we collect, the purposes, retention, and your rights. For the full description of our privacy practices, see our Privacy Policy.

1. Categories of personal information we collect

Identifiers — name, email address, user ID, IP address, device identifiers.

Customer records — billing address, telephone number, employer.

Commercial information — subscription tier, invoice history, promo codes redeemed.

Internet / network activity — log-in events, pages viewed, API calls, feature usage.

Geolocation — approximate city-level location derived from IP address.

Professional information — job title, organisation, role (if volunteered).

Communications content — email headers, body and attachments transmitted through the service.

Inferences — AI-derived priority scores, sentiment, relationship strength, writing-style signals.

Sensitive PI — account login credentials, contents of email, recovery keys, passkey public credentials.

2. Business or commercial purposes

• Delivering the AlecRae Service (sending, receiving, storing and organising email).

• Account authentication and security, including passkey ceremonies and fraud detection.

• Providing AI-assisted features that you have enabled or that are essential to the service (spam / phishing protection).

• Billing and subscription management through Stripe.

• Providing support when you contact us.

• Complying with legal and regulatory obligations.

• Protecting the rights, property, or safety of AlecRae, our users, or the public.

3. Sensitive personal information

We use sensitive personal information only for the purposes listed in CPRA § 1798.121(a) — to perform the services you requested, to prevent fraud and security incidents, to protect the physical safety of users, and to comply with law. We do not use sensitive personal information to infer characteristics about you.

4. Sale, sharing, and cross-context behavioural advertising

We do not sell or share personal information and we never target advertising on the basis of your email or product usage. See our Do Not Sell or Share page for details.

5. Retention

We retain personal information for as long as needed to provide the Service plus a limited grace period for account recovery, legal compliance and fraud prevention:

• Account and billing records: life of subscription + 7 years (tax / financial law).

• Email content: while the account is active; 30-day soft-delete after termination; then secure deletion.

• Server and security logs: up to 13 months, then aggregated.

• Customer-support records: up to 3 years from last contact.

• AI-derived data: deleted within 30 days of account closure.

6. California rights

California residents have the right to know, delete, correct, opt-out of sale or sharing, limit the use of sensitive PI, and non-discrimination. Submit a request to [email protected] or in the app under Settings > Privacy > California rights. A full description of these rights is at /do-not-sell.

7. Shine the Light (Cal. Civ. Code § 1798.83)

California residents may request once per calendar year a list of the categories of personal information disclosed to third parties for direct marketing purposes. AlecRae does not disclose personal information to third parties for direct marketing purposes, but you may still request confirmation by emailing [email protected].