Privacy Policy

Who this covers

This policy describes how Alpyne, Inc. (“Alpyne”, “we”) collects, uses and shares information when you visit getalpyne.com, use the Alpyne platform at app.getalpyne.com, or communicate with us. Alpyne is based in Salt Lake City, Utah.

Alpyne is software for finance professionals. Most of the data in the platform belongs to the firms that use it and to their clients. Where a firm connects a client’s accounting system or other business data to Alpyne, that firm decides what is connected and why; Alpyne processes it on the firm’s instructions. If you are an end client of a firm that uses Alpyne, your relationship is with that firm, and their privacy terms govern how they use your information.

What we collect

We collect the following categories of information.

• Account information. Name, email address, firm name, role, password (stored as a salted hash, never in plain text) and, if you turn it on, a multi-factor authentication secret.
• Billing information. Plan, seat count and billing history. Card details are collected and stored by our payment processor, not by Alpyne. We never see or store a full card number.
• Client financial data. The data you choose to connect: general ledger detail, chart of accounts, balances, transactions, invoices, bills, customers, vendors, bank activity, billing and commerce records, CRM records and marketing metrics, from the systems listed under Connected systems below. We also store the files you upload and the reports, forecasts, models and dashboards you build from that data.
• Email and workspace data, only if you connect it. If you connect a Google account, Alpyne may read the email threads and spreadsheets you authorize so the platform can fold client correspondence into analysis and sync model workbooks. This is optional, per user, and can be disconnected at any time.
• Usage data. Pages viewed, features used, actions taken, timestamps, IP address, browser and device type, and error logs. We use this to run the service, investigate problems and understand what people use.
• Correspondence. Emails you send us, support requests, and notes from calls you book with us.

Connected systems

Alpyne connects to third-party systems only when an authorized user of your firm starts the connection and completes that provider’s own sign-in and consent screen. Alpyne receives a scoped access token, which you can revoke at any time from Alpyne or from the provider.

Systems Alpyne can connect to include QuickBooks Online, Xero, NetSuite, Zoho Books, Sage Intacct, Stripe, Shopify, Chargebee, Salesforce, HubSpot, Copper, Google Analytics, Google Ads, Google Sheets, Gmail, and bank accounts through Plaid (read-only). Some accounting connections include write permission, which Alpyne uses only when an authorized user starts an action or a firm explicitly enables an automation. How that is scoped is described on our security page.

Google user data

If you connect a Google account, Alpyne requests only the scopes needed for the features you enable: reading Gmail messages and threads so Sherpa can reference client correspondence; reading and writing Google Sheets so financial model workbooks stay in sync with Alpyne; and reading Google Analytics and Google Ads reporting data so marketing metrics appear alongside financial data.

Alpyne uses Google user data solely to provide those features to you inside Alpyne. We do not use it for advertising, we do not sell it, we do not share it with third parties except the subprocessors listed below as needed to run the service, and no human at Alpyne reads it except with your permission to resolve a support issue, as required by law, or for security and abuse investigation.

Alpyne’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Alpyne’s access at any time from your Google Account permissions page or by disconnecting the account inside Alpyne. When you disconnect, Alpyne deletes the stored tokens and the Google data it synced for that connection.

How we use information

We use the information above to:

• Run the platform: sync and conform data, build reports, forecasts and dashboards, run the close, and deliver the features you turn on.
• Power AI features. Sherpa and other AI features send the data needed to answer a question or produce an output to Anthropic’s Claude API under Anthropic’s commercial terms, which do not permit customer data to be used for model training. Client data is not sent to any other AI vendor. Firms can turn AI features off per client.
• Bill you, send receipts and manage your subscription.
• Send transactional email: sign-in codes, sync failures, trial and billing notices, and onboarding messages from us during and after your trial. Onboarding messages reference what you have set up in Alpyne, never your clients’ financial figures. You can reply to stop them.
• Provide support and respond to you.
• Keep the service secure: detect abuse, investigate incidents, enforce our terms.
• Improve the product, using aggregated or de-identified usage data.
• Meet legal obligations.

Who we share it with

We do not sell personal information and we do not share client financial data with anyone except the providers that run the service on our behalf, each bound by terms that restrict their use of the data to providing their service to us.

• Render — application hosting, managed PostgreSQL database, Redis and background workers, US East (Virginia).
• Google Cloud Storage — files you upload and documents the platform generates.
• Anthropic — AI processing through the commercial Claude API, as described above.
• Our payment processor — card processing and subscription billing.
• HubSpot — our CRM, meeting scheduling and support correspondence.
• Google — website analytics and advertising measurement on getalpyne.com, as described under Cookies.
• Plaid — bank connections, read-only, when you connect a bank account.
• The third-party systems you connect, which receive data only when an authorized user or an enabled automation writes to them.

Other disclosures

We may disclose information if required by law, subpoena or court order, to protect the rights and safety of Alpyne, our users or others, or in connection with a merger, acquisition or sale of assets, in which case this policy continues to apply to the information transferred and we will notify you before your information becomes subject to a different policy.

Cookies and website tracking

getalpyne.com sets a session cookie when you sign in to the platform and loads the Google Ads measurement tag, which sets cookies used to attribute a booked call or a trial signup to an advertisement you clicked. We do not run third-party advertising networks, retargeting pixels or chat widgets on the site.

The platform at app.getalpyne.com uses cookies strictly necessary to keep you signed in and to protect against request forgery. You can block cookies in your browser; the platform will not work without the session cookie.

How long we keep it

Client financial data stays in Alpyne for as long as the client is connected. When your firm removes a client or disconnects a system, Alpyne deletes that client’s synced data and integration tokens.

When you close your account, we delete your firm’s data from the production database within 30 days. Copies in automated backups expire on the hosting provider’s rotation schedule, after which they cannot be recovered. We keep billing records, invoices and correspondence for as long as tax and accounting law requires, and we may keep de-identified usage statistics indefinitely.

Security

All traffic to Alpyne is encrypted in transit with HTTPS and HTTP Strict Transport Security. Data is stored on managed infrastructure that encrypts at rest, and connection tokens, payment keys and MFA secrets are encrypted again at the application layer. Access to production is limited to one named individual. Alpyne is not SOC 2 certified and does not claim to be. The full description of our controls is on our security page.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify affected firms without undue delay and in any event within the time required by applicable law.

Your choices and rights

You can access and correct your account information inside Alpyne, export your data at any time, disconnect any connected system, turn AI features off per client, and close your account. Firm administrators can do the same for their firm.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or state laws like it: to know what personal information we hold, to have it deleted, to correct it, and not to be discriminated against for exercising those rights. We honor those rights for everyone, regardless of location. To make a request, email us at the address below. We will verify that you are the account holder before acting, and respond within 30 days.

If you are an end client of a firm that uses Alpyne, direct your request to that firm. We will help them fulfil it.

Where data is processed

Alpyne is operated from the United States and all data is stored on US infrastructure. If you use Alpyne from outside the United States, your data will be transferred to and processed in the United States.

Children

Alpyne is a business tool for finance professionals and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has provided us information, email us and we will delete it.

Changes

When this policy changes, we will update the effective date at the top of this page. If a change materially reduces your rights or expands what we collect or share, we will email account holders before it takes effect.

Contact

Alpyne, Inc., Salt Lake City, Utah. Privacy questions and requests: privacy@getalpyne.com. General enquiries: sales@getalpyne.com.