Privacy Policy

1. Scope

This Privacy Policy applies to services operated byAlleria AI, Inc., including PriorityEngine, the BSOS Developer Portal, the BSOS Partner Channel and the related public website.

The information processed depends on which service you use. PriorityEngine is designed for business inbox intelligence, the BSOS Developer Portal provides the operational surface for OEM access and capacity management, and the Partner Channel supports approved distribution partners.

2. Information we collect

PriorityEngine account and workspace data

When you create or use a PriorityEngine account, we may process information such as your email address, name, company name, role, account status, subscription plan, workspace information and settings.

Workspace configuration may include information such as industry, business model, country, language, timezone and other information used to configure the service.

Connected inbox information

When you connect an email account, PriorityEngine processes the connection information necessary to access the inbox through supported Gmail or IMAP integrations.

Depending on the connection method, PriorityEngine may process an email address, provider and mailbox configuration, Gmail OAuth credentials or IMAP connection credentials. Stored email connection credentials are protected using application-level encryption. PriorityEngine account passwords are stored as password hashes rather than plaintext passwords.

Email and message data

PriorityEngine may process and store message information required to provide inbox intelligence and workflow features, including:

• sender name and email address;
• subject and message content;
• message identifiers and timestamps;
• plain-text or HTML message content;
• raw email data where required for supported email operations;
• analysis results, classifications, priority and recommended actions;
• assignment, notes, replies, follow-ups and activity data;
• usage records related to message analysis and AI assistance.

3. AI processing in PriorityEngine

PriorityEngine uses external AI processing as part of certain intelligence and assistant features.

For semantic email analysis, information sent for processing may include the email subject, sender name, sender email address and a portion of the message body. This processing is used to assist with classification, priority, recommended action and trust or fraud-risk assessment.

When a user explicitly uses AI Reply functionality, additional context may be processed, including message content, detected language, analysis results, intended reply strategy and the replying user's name, role and company information.

PriorityEngine currently uses OpenAI technology for these AI processing functions. Information is transmitted only as needed to provide the requested service functionality.

4. BSOS Developer Portal information

The BSOS Developer Portal processes information required to administer OEM organizations, applications, API access, processing capacity, usage and security.

This may include:

• developer name, business email and email verification status;
• organization membership and role;
• organization name, website and technical contact details;
• application names, descriptions and operational identifiers;
• API-key identifiers, permissions, capabilities and lifecycle state;
• capacity allocation and processing-unit usage records;
• runtime, provisioning and security-event metadata;
• support and operational communication where applicable.

BSOS API secrets are not stored as complete API keys. The Portal persists a cryptographic hash and operational identifiers required to authenticate and administer API access.

BSOS usage ledger records contain operational usage metadata such as execution identifiers, organization, application, API key, environment, processing units and runtime or engine versions. The usage ledger is not designed to store the business content submitted for processing.

5. BSOS Partner Channel information

The Partner Channel is an invitation-controlled portal for approved commercial partners.

Information processed through the Partner Channel may include:

• partner user name, email, role and account status;
• partner organization legal and business information;
• registration and business address information;
• organization website and country information;
• invitation, acceptance and terms-acceptance records;
• client-link and referral-attribution information;
• confirmed sales and provider order references;
• commission records;
• payout request and payout audit records.

Payout information

When a partner requests a commission payout, the Partner Channel collects the payment, legal and tax information necessary to process that specific payout. Depending on the partner and payment destination, this may include legal payee information, registration or tax information, bank account details, routing information and bank-country information.

Sensitive payout-submission data is held separately from the permanent payout and commission records. After a payout is marked as paid or rejected, the sensitive payout-submission data is permanently deleted from the Partner Channel.

Records necessary to document the commission and completed payment may remain in Alleria AI, Inc. accounting records and with the company's banking or payment provider as required for financial, accounting and legal purposes. These records are separate from the sensitive payout submission stored temporarily in the Partner Channel.

Where the same beneficiary and banking details are used for a future payout, those details may already be available through the company's banking relationship. The Partner Channel is not used as permanent storage for sensitive bank-account and tax-submission data.

6. How we use information

We process information to:

• provide and operate our services;
• authenticate users and maintain account access;
• connect and synchronize supported inboxes;
• analyze business communications and generate requested AI assistance;
• administer organizations, teams and permissions;
• enforce workspace-owner controls for subscriptions, additional usage purchases and destructive operations;
• provision and secure BSOS API access;
• measure processing capacity and service usage;
• detect abuse, credential compromise and security incidents;
• operate partner attribution, commissions and payouts;
• provide support and service communications;
• maintain operational, financial and security records;
• comply with applicable legal obligations.

7. Legal bases for processing

Where applicable data-protection law requires a legal basis, processing may be based on performance of a contract, steps taken at your request before entering a contract, legitimate interests in operating and securing our services, compliance with legal obligations, or consent where consent is required.

8. Third-party services

We use third-party infrastructure and service providers where necessary to operate our services. These may include hosting, database, email connectivity, AI processing, authentication, payment and communication providers.

PriorityEngine uses Google APIs for supported Gmail connections and uses OpenAI technology for certain AI processing functions.

When commercial payment processing is enabled, the applicable authorized payment provider or Merchant of Record may process payment and billing information directly. Payment card information processed directly by such a provider is not required to be stored by PriorityEngine or BSOS solely for payment-card processing.

9. Browser storage, analytics and measurement

PriorityEngine uses browser local storage for certain application functions, including authentication state and locally stored application information.

Certain onboarding pages currently use Google Ads conversion measurement through the Google tag. Additional information about browser storage and measurement technologies is provided in our Cookie Policy.

10. Data retention

We retain information for as long as reasonably necessary to provide the applicable service, maintain account and operational records, protect the security and integrity of our systems, satisfy contractual requirements and comply with legal, accounting or regulatory obligations.

Different categories of information may have different retention requirements. We do not apply one universal retention period to all service data.

Certain records, including security events, commercial transactions, commission records and other audit information, may need to remain after an account or access relationship ends.

11. Data deletion and account closure

PriorityEngine workspace controls

PriorityEngine separates workspace administration from day-to-day team collaboration. The workspace owner controls administrative, commercial and destructive operations for the workspace.

Team members may work with the business email workflows available to them, including replies, follow-ups and internal notes. Team members cannot manage the workspace subscription, purchase additional usage packs or perform owner-restricted destructive actions.

Permanent Delete

Permanent Delete is restricted to the workspace owner. Team members cannot perform this action.

Permanent Delete is a manual, user-initiated operation and is never performed automatically. Before deletion is executed, PriorityEngine displays a confirmation warning explaining that the action is destructive and irreversible.

After the workspace owner explicitly confirms the operation, PriorityEngine first attempts to permanently delete the selected email from the connected email provider. If the provider deletion succeeds, PriorityEngine then removes the email from the PriorityEngine inbox. The operation cannot be undone.

Disconnecting an inbox

A connected Gmail or IMAP account may be disconnected from PriorityEngine at any time. When an inbox is disconnected, PriorityEngine deletes the stored connection data used to access that provider and stops importing new emails from that account. PriorityEngine will not access or import new messages from the disconnected provider unless the workspace owner explicitly connects the account again.

Disconnecting an inbox is separate from Permanent Delete. Disconnecting removes the provider connection and stops future imports; it does not itself permanently delete emails that were previously imported into PriorityEngine.

Account and organization closure

Full account, workspace or organization closure may require an administrative process. Certain operational, security, contractual, financial or audit records may need to be retained where necessary to operate the service, document prior transactions, protect the integrity of the platform or comply with applicable obligations.

BSOS organization closure and related data requests are handled through an administrative or contractual process rather than automatic self-service destruction of operational and audit records.

In the BSOS Partner Channel, sensitive payout-submission data, including submitted banking and tax details, is deleted when the associated payout request is marked paid or rejected. Minimum payout, commission and audit records required to document the transaction lifecycle may remain.

More information is available in ourData Deletion policy.

12. Security

We use technical and organizational controls designed to protect service data against unauthorized access, misuse, alteration or loss. Controls vary by service and may include password hashing, token-based authentication, tenant isolation, API-key hashing, access controls, security-event monitoring and controlled secret management.

No internet service can guarantee absolute security. Additional information about our security approach is available on ourSecurity page.

13. Your privacy rights

Depending on your location and applicable law, you may have rights to request access to, correction of, deletion of, restriction of, or portability of certain personal information, or to object to certain processing.

We may need to verify your identity and authority before acting on a request. Some information may need to be retained where required for legal, security, contractual or financial purposes.

14. International processing

Our services and service providers may process information in countries other than the country where you are located. Where required, appropriate contractual or legal safeguards may be used for international transfers of personal information.

15. Changes to this Privacy Policy

We may update this Privacy Policy when our services, processing activities, providers or legal requirements change. The updated version will be published on this page with a revised "Last updated" date.

16. Contact

Questions or privacy requests may be sent to:

Alleria AI, Inc.
Email:hello@priorityengineai.com