Privacy Policy

Alertedly ("Alertedly", "we", "us", "our") is a business intelligence company based in Toronto, Ontario, Canada. This policy explains how we collect, use, disclose and retain personal information when you visit alertedly.com, submit a form, request a free report, create an account, subscribe, or use any of our products, including competitor intelligence, Investor Intelligence, Vendor Intelligence and Store Intelligence, and our dashboard, Slack app, Shopify app, CRM integrations, MCP server and API (together, the "Service").

For the personal information described in this policy, Alertedly is the organization responsible for it (in GDPR terms, the "controller"). This policy should be read with our Terms of Service.

Information you give us

• Account and contact details, such as your name, work email address, company, role, and sign-in credentials (passwords are held by our authentication provider as salted hashes).
• Organization and team details, such as your firm or company, team members, roles and invitations.
• Inputs, such as the companies, portfolio, dealflow or markets you track, lists you upload or import, your settings and preferences, and questions you ask inside the Service.
• Form submissions, such as free report, portfolio report, Vendor Intelligence, contact and support requests, and anything else you send us.

Information we collect automatically

• Usage and device information, such as pages viewed, features used, clicks, referring pages, campaign tags, browser and device type, IP address, approximate location, time zone and language.
• Email engagement, such as whether you open our emails or click links in them.
• Logs of API requests, AI-assistant (MCP) tool calls, integrations and deliveries, including the account or key used, what was requested, timing and outcome.
• Cookies and similar technologies, described below.

Information from third parties

• Sign-in providers. If you sign in with Google, we receive your name, email address and profile picture.
• Integrations you connect, such as Slack or a CRM. We receive the tokens and details needed to connect them, and the records you choose to import.
• Payment processor. Subscription and billing status. Card numbers go directly to our payment processor; we do not receive or store them.

Information about others

If you give us personal information about other people, such as colleagues you invite or contacts in a CRM you connect, you confirm that you have the authority and any notices or consents needed to do so. Where we handle records from your systems to provide the Service to you, we do so on your behalf and under your instructions, and you remain responsible for that information under the laws that apply to you.

Public business information

The Service researches organizations, not private individuals. We compile information about companies, funds and other organizations from publicly available sources. These sources can include information about people in their public, professional capacity, such as the name and title of a founder, executive or spokesperson, or a public post made on behalf of an organization. We use that information only as part of business intelligence about the organization. If you believe information about you in our Service is inaccurate or should be removed, contact us.

We use the information we collect to:

• provide, operate, deliver and personalize the Service, and authenticate users;
• research the organizations you track and produce reports, alerts, datasets and answers;
• process payments, manage subscriptions and keep business, tax and accounting records;
• communicate with you, including support, service, security and billing messages;
• maintain, analyze, improve and develop the Service and new products, features, research methods, datasets and models;
• create aggregated, anonymized or de-identified information;
• monitor and enforce limits, prevent fraud and abuse, and keep the Service secure;
• send marketing where permitted by law;
• comply with legal obligations, enforce our Terms, and establish, exercise or defend legal claims.

We send marketing emails only where you have agreed or the law otherwise permits it, including under Canada's Anti-Spam Legislation, and every marketing email includes a way to unsubscribe.

Aggregated and de-identified information

Information that has been aggregated, anonymized or de-identified so that it no longer identifies you is not personal information. We may use and disclose it for any lawful purpose, including to develop and improve our products, and we will not attempt to re-identify it.

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract: to provide the Service you signed up for or requested.
• Legitimate interests: to operate, secure, analyze, improve and develop our business and products, to compile business intelligence about organizations from public sources, and to market to business contacts. We balance these interests against your rights.
• Consent: where we ask for it. You may withdraw consent at any time.
• Legal obligation: to comply with tax, accounting and other legal requirements.

We may disclose personal information to:

• Service providers who host, operate, secure and support the Service on our behalf, including hosting and database, AI model, data and search, email delivery, payment, audio and analytics providers. We share only what they need to provide their services to us. Our main providers are listed on our security and compliance page.
• Your organization, such as your firm or company administrators and team members.
• Integrations and destinations you choose, such as Slack, a CRM, an AI assistant, a webhook endpoint or anyone you share a report with.
• Professional advisors, such as lawyers, accountants and auditors.
• Authorities and others where required by law, or where we believe disclosure is necessary to protect the rights, property or safety of Alertedly, our users or the public, or to enforce our Terms.
• A buyer or successor in connection with a financing, merger, acquisition, reorganization or sale of all or part of our business or assets.
• Affiliates, such as any current or future parent, subsidiary or related company.
• Anyone else with your consent or at your direction.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

This section applies if you install Alertedly Store Intelligence from the Shopify App Store. The rest of this policy also applies.

What the app accesses from Shopify

• Store details: your store's name, its myshopify.com domain, its primary domain and its Shopify store ID. We use them to set up your Alertedly workspace, to fill in your own store (so the suggested moves in your brief are about your store) and to keep the app connected to the right store.
• Staff details: for each staff member who opens the app, their Shopify user ID, email address and whether they are the store's account owner (Shopify also sends their name, which we do not keep). We use them to sign staff in to the app, to give them access to your workspace (the account owner as an admin) and to send the weekly brief to the addresses you choose. If an email address already belongs to an Alertedly account, we never link the two automatically; you can link them yourself in the app's Settings after signing in to Alertedly.
• Plan status: which plan you are on, any trial and the billing period, read from Shopify's billing system. Shopify handles the payment; we do not receive card details.

What the app does not access. The app requests no access to your customers, orders, products or other store data, and we do not receive your customers' personal information from Shopify.

Security. The access tokens Shopify issues to the app are stored encrypted at rest and are used only by the app's server.

Where competitor information comes from. Briefs about the stores you track are compiled from public sources, such as public web pages, public ad libraries and public social posts. We never use one merchant's Shopify data in another merchant's brief or report, we do not use Shopify data to train machine-learning or AI models, and we do not sell Shopify data.

Retention and deletion. When you uninstall the app, we disconnect your store, delete its access tokens and stop any plan billed through Shopify. Shopify then sends us a request to erase your store's data, 48 hours after you uninstall. When it arrives we delete the store's connection and the staff details above and, if the app created your workspace and nobody outside your store uses it, the workspace and everything in it. A workspace someone outside your store also uses (for example one billed by card on alertedly.com, or with members who joined there) stays with them. In any case we delete this Shopify data within 30 days of uninstall. If you linked an existing Alertedly account, that account and any workspace it already had stay yours under the rest of this policy. Billing records are kept as described in "How long we keep information".

Contact. Privacy questions: contact@alertedly.com. Help with the app: support@alertedly.com.

We are based in Canada, and our service providers may store or process information in the United States, the European Union and other countries whose data protection laws may differ from yours, and where authorities may be able to access it under local law. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

We and our providers use cookies, local storage and similar technologies to:

• Keep you signed in and make the Service work. These are necessary.
• Measure and improve the Service, using product analytics (PostHog and Google Analytics) and session recording and heatmaps (Microsoft Clarity), which can capture clicks, scrolling, mouse movement and page content. Sensitive input fields are masked.
• Process payments and prevent fraud on our payment processor's checkout pages.

You can block or delete cookies in your browser settings. Blocking necessary cookies or storage will sign you out or stop parts of the Service from working. Some browsers send "Do Not Track" signals; there is no common standard for them, and the Service does not respond to them.

We keep personal information for as long as your account is active and, after that, for as long as reasonably necessary for the purposes described in this policy, including to comply with legal, tax and accounting obligations, resolve disputes, enforce our agreements, prevent fraud and abuse, maintain security and backups, and for our legitimate business purposes. How long depends on the type of information and why we hold it:

• Account, team and settings information: while your account is open, and then for as long as needed to close it out, resolve any open matters and keep our records.
• Inputs and connected integrations: until you delete them, disconnect the integration or close your account, and then as described above.
• Billing and transaction records: at least as long as tax and accounting law requires (in Canada, generally six years).
• Usage, security and access logs: as long as needed for security, abuse prevention, troubleshooting and support.
• Messages and form submissions: as long as needed to respond, keep a record of the exchange and follow up.
• Marketing preferences: as long as needed to honor them, including unsubscribe requests.

Research, reports, datasets and history about organizations form a long-term record that our Service relies on, and we keep them indefinitely. When personal information is no longer needed, we delete it or de-identify it. De-identified and aggregated information may be kept indefinitely.

• Account details. You can review and update your details in your account settings or by contacting us.
• Marketing. You can unsubscribe using the link in any marketing email. We will still send service, security and billing messages.
• Integrations. You can disconnect Slack, CRMs, AI assistants and API keys at any time in the dashboard.
• Declining to provide information. We need certain information to provide the Service. If you do not provide it, we may not be able to provide some or all of the Service.
• Other sites. The Service links to third-party websites and services that we do not control. Their own privacy policies apply, and we are not responsible for them.

We use administrative, technical and physical safeguards designed to protect personal information. An overview is on our security and compliance page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of security safeguards creates a real risk of significant harm, we will notify you and regulators as required by law. Report security issues to security@alertedly.com.

Depending on where you live, you may have the right to access, correct or delete your personal information, to object to or restrict certain processing, to receive a portable copy, and to withdraw consent. To make a request, email contact@alertedly.com from the address associated with your account. We may need to verify your identity, and we will respond within the time the law requires. These rights are subject to legal limits and exceptions, for example where we must keep information to meet legal obligations, to establish or defend claims, or where a request would reveal information about others. We will not discriminate against you for exercising your rights.

Canada (PIPEDA)

You may access and correct your personal information and ask how it has been used and disclosed. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

European Economic Area and United Kingdom

You may lodge a complaint with your local data protection authority or, in the UK, the Information Commissioner's Office.

California

California residents may request to know, correct or delete their personal information, personally or through an authorized agent. In the last 12 months we collected identifiers, commercial information, internet or other electronic activity information, professional information, and inferences drawn from them, from the sources and for the purposes described above, and disclosed them to the categories of recipients described above. We do not sell personal information or share it for cross-context behavioral advertising, we do not use sensitive personal information to infer characteristics, and we do not knowingly collect personal information from anyone under 16.

The Service is for businesses and is not directed to children. You must be at least 18 to use it. We do not knowingly collect personal information from children; if you believe a child has provided us information, contact us and we will delete it.

We may update this policy from time to time. We will change the date at the top of this page and, for material changes, notify you by email or in the Service before they take effect.

Our Privacy Officer is accountable for our compliance with this policy and applicable privacy law. Questions or requests about privacy: contact@alertedly.com.

Alertedly
100 King St W Suite 5600
Toronto, ON M5X 1C9
Canada