ALBY Privacy Policy
B.A.L.M. Collective operates ALBY, including its website, mobile applications, AI-assisted features, marketplace functions, and related services. This policy explains what information ALBY handles, why it is used, when it may be shared, how it is protected, and the controls available to users.
Information ALBY may handle
Depending on the features a user chooses, ALBY may process account information, content the user creates or uploads, marketplace and transaction information, device and browser information, security and diagnostic logs, location information when permission is granted, and prompts or context intentionally provided to ALBY AI features.
Google User Data and Gmail Limited Use
This section is stricter than ALBY's general data practices. If another part of this policy conflicts with this section, this Google User Data section controls.
Access is optional and user-initiated
ALBY accesses Google User Data only after a user deliberately connects a Google account and completes Google's OAuth consent flow. The current Gmail integration requests https://www.googleapis.com/auth/gmail.modify. That permission is not treated as authority to access unrelated Google products or unrelated account data.
What ALBY may access
When a user connects Gmail and invokes a Gmail feature, ALBY may access the data needed for that feature, including messages and threads, message content and metadata, labels, read/unread state, archive state, Trash state, and drafts. ALBY may create or update drafts and send or reply to email through user-facing ALBY functionality. The current integration moves messages to Trash rather than requesting broader authority for permanent deletion outside Trash.
Permitted uses
Google User Data is used only to provide or improve the specific user-facing ALBY feature requested by the user, such as displaying or searching Gmail, managing labels and mailbox state, archiving or moving messages to Trash, preparing drafts, sending user-approved email, or providing user-requested assistance about selected Gmail content.
Uses ALBY prohibits
- ALBY does not sell Google User Data.
- ALBY does not use Google User Data for targeted, personalized, retargeted, or interest-based advertising.
- ALBY does not transfer Google User Data to data brokers, information resellers, or advertising networks.
- ALBY does not use Google User Data to determine creditworthiness or for lending decisions.
- ALBY does not use Google Workspace API data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.
- ALBY does not use Google User Data for unrelated product development, profiling, or any purpose unrelated to the user-facing feature for which the data was obtained.
- Human access to Google User Data is not permitted except with affirmative user consent for a specific support or security purpose, when necessary to investigate abuse or a security incident, or when required by applicable law.
AI and machine learning
Google Workspace API data is not used to train, develop, or improve generalized or non-personalized AI/ML models. If a user expressly invokes an ALBY AI-assisted feature on Gmail content, ALBY may process only the content reasonably necessary to return that user's requested result. That processing does not authorize reuse for generalized model training, advertising, profiling, or unrelated product development.
Storage, security, retention, and deletion
- Production Gmail OAuth access and refresh tokens are stored encrypted at rest and are not intentionally written to application logs.
- Gmail message bodies are not intentionally written to ordinary application logs.
- ALBY limits retention of Google User Data to what is necessary to provide the requested feature, maintain the authorized connection, protect the service, or comply with law.
- When a user disconnects the Google integration, ALBY revokes the ALBY-side connection and deletes stored OAuth tokens associated with that connection, subject only to narrowly applicable legal or security retention obligations.
Sharing and transfers
ALBY does not transfer Google User Data except when necessary to provide or secure the user-requested ALBY feature, when the user directs or affirmatively consents to the transfer, or when required by applicable law. Any service provider receiving Google User Data on ALBY's behalf must be limited to the permitted ALBY purpose and may not use the data for advertising, sale, credit or lending decisions, or generalized AI/ML training.
User control
Users may disconnect Google access through ALBY when connection controls are available and may also revoke ALBY's access through Google Account permissions. Revoking access prevents future ALBY access through that authorization.
ALBY's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How non-Google information is used
ALBY may use non-Google information to operate accounts and requested features, process transactions and subscriptions, personalize ALBY features, provide support, prevent abuse and fraud, diagnose errors, improve reliability, and comply with applicable law.
Sharing
ALBY does not sell personal information. Non-Google information may be shared with service providers that operate ALBY, with users or businesses as necessary to complete a user-directed transaction, for lawful legal or safety obligations, or as part of a legitimate business transaction subject to applicable privacy obligations. Google User Data remains subject to the narrower rules above.
Security
ALBY uses administrative, technical, and organizational safeguards intended to protect information from unauthorized access, alteration, disclosure, or destruction. No internet-connected service can guarantee absolute security.
Retention and privacy rights
ALBY retains information only as long as reasonably necessary for the purpose for which it was collected, to provide services, protect the Platform, resolve disputes, enforce agreements, or comply with law. Depending on applicable law, users may have rights to access, correct, obtain a copy of, restrict certain processing of, object to certain processing of, or delete personal information.
Account deletion is available at /delete-account. Data deletion controls are available at /delete-data where supported.
Children's privacy
ALBY is not intended for children under 18 unless a specific experience clearly states otherwise and all required consent and safeguards are in place.
Cookies and third-party services
ALBY may use cookies, local storage, and similar technologies for authentication, security, preferences, session continuity, diagnostics, and feature operation. Third-party services linked or integrated with ALBY have their own privacy practices, but ALBY's use of Google User Data remains subject to the strict limitations above.
Changes to this policy
Material changes will be identified by an updated date and, when appropriate, additional notice. ALBY will not silently broaden its use of Google User Data beyond the disclosed, policy-permitted purposes.
Contact
B.A.L.M. Collective privacy inquiries: privacy@balmcollective.com
Support: support@balmcollective.com