Privacy policy

Alye (www.alye.ai and the app at alye.onruyl.com) is provided by Onruyl Private Limited, [REGISTERED ADDRESS] (“we”, “us”). This policy explains how we handle personal data when you visit our website, create an account or send us telemetry from your services.

For your account and billing details, we decide how the data is used (we are the controller, or data fiduciary under India's Digital Personal Data Protection Act). For the telemetry your services send, we act on your behalf and on your instructions (we are the processor); your organization is responsible for having the right to send it to us.

Account and organization details. Your name, email address, a hash of your password (never the password itself), your organization's name and settings, the members and invites in it, and your plan.

Security and sign-in records. Sessions, the IP address and browser used to sign in, sign-in attempts, 2-step verification settings (the secret is stored encrypted) and an audit log of changes made in your organization.

Telemetry your services send. For each LLM call: the provider, model, token counts, cost, timing, status, error type, retries, the service and environment names you set, and trace and span identifiers. Optionally: customer or session identifiers you tag requests with, and custom tags. From service heartbeats: host name, process ID, SDK version and library versions.

Prompt and response content, only if you turn it on. When a project enables content capture, the text of prompts and responses is sent, after the SDK has masked emails, phone numbers, card numbers and API keys. Masking is pattern-based, so please don't rely on it for data you must never send; keep content capture off for those workloads.

Alert channel details. Email addresses you add, and Slack or Microsoft Teams webhook URLs, which we store encrypted.

Messages you send us, such as support requests.

• To provide Alye: show your calls, costs, traces and usage, check your alert rules every minute and send alerts where you asked.
• To run your account: sign-in, 2-step verification, invites, roles and the audit log.
• To keep Alye secure: detect abuse, lock accounts after repeated failed sign-ins, and investigate incidents.
• To send service emails: verification, password resets, invites, alerts and usage notices (for example at 80% of your monthly calls). These are only about your account.
• To meter usage for your plan and, when paid plans are billed, to bill you.
• To answer you when you contact us, and to meet legal obligations.

• We don't sell or rent personal data.
• We don't use your data for advertising or build advertising profiles.
• We don't use your telemetry or captured content to train AI models.
• We don't look at your prompts or responses, except when you ask us to for support or when the law requires it.

Where a legal basis is required (for example under the GDPR), we process account data to perform our contract with you, security and abuse records for our legitimate interest in keeping Alye safe, telemetry on your instructions as your processor, and data we must keep by law to meet legal obligations. Under India's DPDP Act, we process personal data for the purposes you give it to us for, and you can withdraw consent by closing your account.

• Call records and traces: for your plan's history, which is 14 days on Free, 90 days on Team and up to 365 days on Enterprise, or less if you set a shorter period. Older records are deleted.
• Prompt and response content: for the content retention period set for your project, at most your plan's history.
• Monthly usage totals: while your account exists, for billing and your usage history.
• Account, organization and audit records: while your account exists. When you ask us to close it, we delete them within 30 days, except what we must keep by law (for example invoices).
• Backups: deleted data can remain in encrypted backups for up to [BACKUP RETENTION] days before it is overwritten.

We share personal data only with service providers that help us run Alye, under contracts that require them to protect it and use it only for us:

• [HOSTING PROVIDER]: hosts the Alye app, API and database ([REGION]).
• Brevo: sends our emails (verification, invites, alerts and usage notices).
• Vercel: hosts this website.
• Slack and Microsoft: receive alert messages, only when you add a Slack or Teams channel.

We may also disclose data when the law requires it, to protect people's safety or our rights, or as part of a merger or acquisition, in which case this policy keeps applying to your data.

Our servers are in [COUNTRY / REGION]. If you use Alye from another country, your data is transferred there. Where the law requires it, for example for transfers out of the European Economic Area or the UK, we rely on safeguards such as the European Commission's standard contractual clauses.

• Encryption in transit (HTTPS) for the website, the app and the API the SDKs send to.
• Passwords are stored as one-way hashes; SDK keys are stored as hashes and shown only once.
• 2-step verification secrets and Slack and Teams webhook URLs are stored encrypted.
• Organizations can require 2-step verification and limit how long sign-ins last; accounts lock after repeated failed attempts.
• Access to production systems is limited to the people who need it.

This website sets no cookies. It remembers your light or dark theme choice in your browser's local storage, which never leaves your device. It has no analytics or advertising trackers.

The Alye app uses only the cookies it needs to work: a session cookie that keeps you signed in and, if you choose to trust a device during 2-step verification, a cookie that remembers that choice.

Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent. You can change your name, password and 2-step verification in the app yourself.

To use your rights, or to close your account and delete your organization, email info@onruyl.com. We answer within 30 days. If your data is in telemetry that an Alye customer sent us (for example, you are one of their end users), please contact that company first; we will help them answer you.

You can also complain to a data protection authority, such as the Data Protection Board of India, or the authority where you live in the EU or UK.

Under Indian law, our grievance officer is [GRIEVANCE OFFICER NAME], Onruyl Private Limited, [REGISTERED ADDRESS], info@onruyl.com. We acknowledge grievances within 72 hours and resolve them within 30 days.

Alye is a tool for businesses and is not meant for anyone under 18. We don't knowingly collect data from children.

When this policy changes, we update the date at the top. For important changes, we email account owners at least 14 days before they take effect. See also our terms of service.

Onruyl Private Limited, [REGISTERED ADDRESS]. Privacy questions: info@onruyl.com.