Legal Center
Privacy Notice
Last updated 1 October 2026
Alfred is an AI assistant that helps businesses reply to their customers on WhatsApp, Facebook Messenger, Instagram Direct, web chat and voice, and manage bookings in connected calendars and booking systems. This notice explains what personal data Alfred handles, why, who we share it with, how long we keep it and how to make a request.
1. Who we are and our two roles
Alfred is operated by 0123 Digital Pte. Ltd. (UEN 202326211G), trading as 01 Digital, 33 Ubi Avenue 3, #08-68 Vertex, Singapore 408868. Our data protection officer can be reached at [email protected].
•
For our own customers and visitors (business account holders, their staff users, billing contacts and visitors to our website), we decide how personal data is used and this notice applies directly.
•
For people who message a business that uses Alfred, that business decides how their data is used, and we process it on the business’s behalf under the Alfred Customer Terms. The business’s own privacy notice applies, and requests are best sent to the business. We will pass on requests we receive.
2. What we collect
•
Account information: names, work email addresses, phone numbers and login details of business users, and the business details and knowledge base content they provide.
•
Billing information: billing contact and company details, subscription and payment history. Card details are handled by our payment provider; we do not store full card numbers.
•
Connected-account information: when a business connects a Facebook Page, Instagram Business account, WhatsApp number, Google Calendar or booking system, we store the access tokens, account names and identifiers needed to operate the connection. We do not store Facebook, Instagram or Google passwords. For Google Calendar we store the connected account email, selected calendar ID, OAuth tokens and expiry, availability responses and the IDs of booking events Alfred creates, updates or deletes.
•
Conversation data: messages, voice-call content, attachments, timestamps and platform identifiers of people who contact a business through Alfred, together with Alfred’s replies, staff replies and the booking and customer records created from them. This includes contact details only where people share them or the channel provides them, such as a WhatsApp number.
•
Preview information: if you try Alfred’s preview, your email address, the public pages of your website that Alfred reads to prepare it, and your test-chat transcripts.
•
Voice dictation: audio that business users record when dictating in the dashboard, and its transcript.
•
Technical data: server logs (timestamps, status codes, IP addresses) and error diagnostics used for security and troubleshooting.
3. How we use it
•
Generate replies and carry out the actions a business has enabled, such as checking availability or creating a booking.
•
Show conversations, bookings and customer records to the business in its dashboard, and send its staff handoffs and alerts.
•
Send replies from Alfred or the business's staff through the connected channel.
•
Measure usage for billing, and give the business operational reports.
•
Provide support, keep the service secure, monitor AI response quality and fix errors.
•
Manage our customer accounts and billing, and meet legal obligations.
We do not sell personal data or share it for advertising. We do not use conversation data to train general Alfred models or third-party AI models. We do not use Google Calendar data for advertising, and Alfred’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Who we share it with
We share personal data with the service providers that help us run Alfred, listed on our Subprocessors page, and with the channels and systems a business connects, as needed to deliver its messages and bookings. We may also disclose data where the law requires it.
5. International transfers
Alfred’s main servers are in Singapore, and our monitoring tools are hosted in Germany. Some of our providers, including our AI model providers, process data in the United States. Where data is processed outside Singapore, we require providers to protect it to a standard comparable to Singapore’s Personal Data Protection Act. We use OpenAI and Google under their enterprise API plans, so their processing is subject to their enterprise terms and privacy commitments.
6. How long we keep it
•
Conversation and customer data is kept while the business's subscription is active, unless the business deletes it sooner.
•
When a subscription ends, we delete the business's data as set out in section 10 of the Customer Terms. Conversation history is not exported.
•
Access tokens are deleted when a business disconnects the channel or calendar they belong to.
•
Preview information is kept for 90 days, and you can delete a preview earlier from its page.
•
Backups expire within 90 days after data is deleted from our active systems.
•
Server logs are kept for 30 days.
•
Billing records are kept for as long as accounting and tax law requires.
7. Your choices and requests
If you messaged a business that uses Alfred, contact that business to access, correct or delete your messages. You can also email [email protected] with the business name and the channel you used; we will pass your request to the business and help it respond. Your messages also remain in your own messaging app.
If you use Alfred for your business, you can update account details in the dashboard, or email us to access or correct your data or withdraw consent. To stop a connection, click Disconnect on the integration card; this revokes our access token and stops webhooks or calendar sync. You can also revoke Alfred’s access from your Google Account permissions page. When someone removes Alfred from their Facebook or Instagram settings, Meta’s data-deletion callback automatically disables that connection and clears its stored tokens.
We respond to requests within 30 days. If we need more time, we will tell you when to expect a reply.
8. Security
We use encrypted connections, verify incoming Meta webhooks with their signature, use short-lived sign-in sessions with refresh rotation, keep access tokens on the server and never expose them to the browser, and restrict production access to authorised personnel.
9. Cookies and browser storage
Alfred uses only the browser storage needed to keep you signed in and remember interface preferences, such as the selected business or an open chat session. Our public forms use Cloudflare Turnstile to block automated abuse. We do not use advertising or third-party analytics cookies.
10. Changes to this notice
We will post updates here and change the date at the top of this page. Earlier versions will be listed on the Legal page.