Alfred
Privacy Policy
Effective 11 June 2026
1. Who We Are
Alfred is operated by Beema Solutions Limited (registered as Beema Solutions Ltd), a company registered in England and Wales, company number 17097442, registered office 7 Brewhouse, Georges Square, Bristol BS1 6LA. Beema Solutions Limited is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and — for users in the EU/EEA — the EU GDPR.
Contact: oli@beema.solutions
2. What Data We Collect
Account information — Your phone number (WhatsApp identifier), display name, honorific, city/location, latitude and longitude, and timezone.
Messages — Text messages you send to and receive from Alfred, voice message transcripts, and image descriptions. Voice audio files are processed for transcription and then deleted.
Connected accounts — If you choose to connect Google or Microsoft, Alfred can access your calendar events, emails, and contacts through those integrations. OAuth tokens are stored to maintain the connection.
Google user data — When you connect a Google account, Alfred may access your Gmail messages (read, send, organise, and filter), Google Calendar events (view, create, update, and delete), and Google Contacts (read-only). Email and calendar content is processed in real time and cached in memory for up to 10 minutes to serve your requests — it is never written to a database or stored permanently. OAuth tokens, your sync preferences, and any contacts you choose to sync (see Contacts, below) are persisted.
Microsoft user data — When you connect a Microsoft account, Alfred may access your Outlook Mail (read, send, organise, and filter), Outlook Calendar events (view, create, update, and delete), and Outlook Contacts (read-only). The same data handling applies: email and calendar content is cached in memory for up to 10 minutes only, never stored permanently; OAuth tokens, sync preferences, and any contacts you sync are persisted.
Contacts — Alfred keeps a private contact list (a "rolodex") for you. You can add contacts in chat, and if you connect Google or Microsoft you can sync your contacts into it. Stored details may include names, phone numbers, email addresses, birthdays, addresses, and any notes you add. This list is private to you and is used only to help you look people up — Alfred never contacts anyone on your behalf without your explicit instruction.
Fitness data (Strava) — If you connect Strava, Alfred fetches your recent activities — type, time, distance, duration, heart rate, pace, elevation, and activity start location — to include in your evening check-in, and stores short summaries of them in your memory.
Tasks and notes — Tasks you create (including subtasks, recurrence rules, labels, priorities, and reminders), task activity logs (creation, updates, completions, reschedules), and wellbeing check-in data.
Padel court watches — If you ask Alfred to watch for padel court availability, the venues, dates, times, and any search area or coordinates you provide are stored until the watch is fulfilled or you cancel it.
Memory — Facts and preferences Alfred remembers about you to personalise responses. This includes a "living profile" — a narrative summary regenerated nightly from your recent conversations and stored facts.
Daily journal — Each evening, Alfred generates a short second-person journal entry summarising your day based on conversations, completed tasks, and wellbeing data. These are stored in the database and used for briefings and profile updates.
Briefing topics — If you configure custom briefing topics (e.g. stock prices, news), those topic names and the web search queries they generate are stored.
Feedback — Bug reports, feature requests, and support messages you submit through Alfred.
Billing data — If you subscribe, your Stripe customer ID, subscription ID, subscription status, trial dates, and payment history are stored. Payment card details are held by Stripe and never stored by Alfred.
Usage data — Message counts, AI token usage, and estimated cost per service, used for service management.
Quality and security data — Per-message metadata (response time, AI model used, tools called) for service quality monitoring. Messages flagged as potential prompt injection attempts are logged with a short excerpt for security review.
3. How We Use Your Data
- To provide the Alfred service — processing your messages, managing your calendar, email, tasks, and contacts.
- To personalise Alfred's responses using your stored preferences and memory.
- To send daily briefings and task reminders at your configured times. Custom briefing topics trigger web searches on your behalf (e.g. fetching stock prices or news headlines you have requested).
- To generate nightly journal entries and update your living profile, which improve Alfred's context and personalisation over time.
- To monitor usage, enforce service limits, and track subscription billing.
- To monitor service quality (response times, model performance) and detect prompt injection attempts.
- To improve the service over time.
As the sole operator, Beema Solutions Limited (Oli Woodman) has access to your account data — including the content of messages you send to and receive from Alfred — for the purposes of providing support, debugging issues, monitoring service quality, and maintaining the service. The operator may also contact you directly via WhatsApp — for example, to follow up on a support request, ask for feedback, notify you of an issue affecting your account, or check whether the service is working as expected. Such messages will be clearly identified as coming from a person rather than from Alfred. Access to data from connected Google and Microsoft accounts is more restricted — see the Limited Use Disclosure in section 4. Your data is not sold, and is not shared with or made visible to any other person — except where we are required to disclose it in order to comply with a legal obligation (for example, a valid court order or a lawful request from a public authority).
4. Google API Services — Limited Use Disclosure
Alfred's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Alfred only uses Google data to provide and improve the user-facing features you see in the app.
- Alfred does not use Google data for advertising, market research, or to build user profiles for any purpose other than providing the Alfred service.
- Alfred does not sell Google data to third parties.
- Alfred does not use Google data for purposes unrelated to the core functionality described in this policy.
- No human reads your Google data except where (a) you have given explicit consent (e.g. to debug an issue you report), (b) it is necessary to comply with applicable law, or (c) the data is aggregated and anonymised so that it no longer identifies you.
5. Legal Bases
We rely on the following legal bases under Article 6 of the UK GDPR — and, for users in the EU/EEA, the EU GDPR. The bases are the same under both:
- Performance of a contract (Article 6(1)(b)) — processing necessary to provide the Alfred service you signed up for: handling your messages and managing your calendar, email, tasks, contacts, reminders, and briefings.
- Legitimate interests (Article 6(1)(f)) — service monitoring, security, fraud and abuse prevention, and improving the service. You can object to processing based on legitimate interests (see Your Rights).
- Consent (Article 6(1)(a)) — optional integrations (Google, Microsoft, Strava) are activated only when you explicitly connect them, and can be disconnected at any time.
6. Third-Party Processors
Alfred relies on the following third-party services to function. Your data is shared with them only as necessary to provide the service.
| Processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Microsoft Azure OpenAI | AI responses, image recognition, message routing and verification | Messages, images | UK / USA |
| Groq | Voice transcription, text-to-speech | Audio files, text | USA |
| Twilio | WhatsApp message delivery | Phone number, messages | USA |
| Supabase | Database hosting | All stored data | AWS |
| Railway | Application hosting | All processed data | USA |
| Stripe | Subscription billing and payments | Customer ID, subscription status, payment events | USA |
| Gmail, Calendar, Contacts | Account data (if connected) | USA | |
| Microsoft | Outlook Mail, Calendar, Contacts | Account data (if connected) | USA/EU |
| Strava | Fitness and activity data (if connected) | Activity details, metrics, activity start location | USA |
| Playtomic | Padel court availability searches you request | Search area / coordinates, dates, preferences (only when you use padel search) | EU |
| Brave Search | Web search queries (on-demand and custom briefing topics) | Search terms | USA |
| Open-Meteo / OpenWeatherMap | Weather forecasts | Location coordinates | EU / USA |
| Photon (Komoot) | Geocoding for meeting point calculations | Location queries | EU |
| TfL | Journey planning, line status, meeting point routing | Location queries | UK |
| PostHog | Product analytics on the dashboard and landing page | Page views, anonymised usage events | USA |
| Google Fonts | Dashboard and landing-page typography | IP address (via font file requests) | USA |
7. International Transfers
AI processing is primarily handled by Microsoft Azure OpenAI in the UK. Some of the processors listed above are based in the United States or the EU, so using Alfred involves transferring your data outside the UK.
Where data is transferred to a country without UK "adequacy" status, we rely on appropriate safeguards under Article 46 of the UK GDPR. For transfers to the United States this is, depending on the processor, the UK Extension to the EU–US Data Privacy Framework (where the recipient is certified), the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum. Transfers from the EU/EEA rely on an EU adequacy decision or the EU Standard Contractual Clauses. To obtain a copy of the safeguards relied on for any processor, contact us at oli@beema.solutions.
8. Data Retention
Your data is retained for as long as your account is active. Conversation messages are stored in the database for continuity; the AI only loads the most recent 20 messages as active context, but the full history is retained until you delete your account. OAuth tokens are stored for as long as an integration remains connected. Email and calendar content from connected accounts is cached in memory for up to 10 minutes and never written to the database.
Some records are kept on a different timetable: billing and transaction records are retained for six years to meet UK tax and accounting law, and routine encrypted backups are cycled out within 30 days, so deleted data clears from backups within that window.
You can delete your account and all associated data at any time by: visiting your dashboard (Settings → Delete Account), asking Alfred directly ("please delete my account"), or emailing oli@beema.solutions. Deletion removes everything that identifies you: messages, tasks, contacts, memory, daily journals, usage data, and OAuth tokens. The only thing we may retain afterwards is anonymised, aggregate statistics that no longer identify you — for example, the fact that an account was deleted, when, and roughly how long it had been active — which we keep to understand and improve the service. This contains no name, phone number, or message content and cannot be linked back to you.
9. Your Rights
Under UK GDPR, you have the right to:
- Access — Request a copy of the personal data we hold about you.
- Rectification — Ask us to correct inaccurate data.
- Erasure — Request deletion of your data.
- Restriction — Ask us to limit how we use your data.
- Portability — Receive your data in a portable format.
- Objection — Object to processing based on legitimate interest.
To exercise any of these rights, contact oli@beema.solutions.
Complaints. If you're unhappy with how we handle your data, please contact us first at oli@beema.solutions — we aim to acknowledge complaints within 30 days and resolve them as quickly as we can. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EU/EEA, you may instead complain to your local data protection authority (listed at edpb.europa.eu).
10. Security
We take reasonable measures to protect your data, including:
- All data is encrypted in transit (HTTPS) and at rest (Supabase).
- Row-level security on all database tables.
- OAuth tokens encrypted at rest with AES-256-GCM and stored server-side only — never exposed to the client.
- Dashboard sessions use httpOnly, secure, sameSite cookies with HMAC-SHA256 JWT.
11. Cookies and Analytics
The Alfred dashboard uses a single httpOnly session cookie for authentication. We do not use advertising cookies.
The dashboard and landing page use PostHog for product analytics. PostHog collects anonymised usage data (page views, feature interactions) to help us understand how the service is used and where to improve it. PostHog may set its own cookies or use local storage for session tracking. No advertising or cross-site tracking is performed. You can opt out by using a browser ad-blocker or disabling JavaScript on the dashboard.
12. Children
Alfred is not intended for anyone under 16 years of age. We do not knowingly collect data from children under 16.
13. Changes to This Policy
This policy may be updated from time to time. Material changes will be communicated via WhatsApp. Continued use of Alfred after changes constitutes acceptance.
14. Contact
For any questions about this privacy policy or your data, contact Beema Solutions Limited at oli@beema.solutions.