Privacy Policy — Local AI Signal

This Privacy Policy explains how Jack Alla ("we", "us", "our"), operating the Local AI Signal service (the "Service"), collects, uses, shares, and protects personal data about you when you visit our website or use the Service. Jack Alla is the data controller responsible for your personal data.

1. Who we are

The Service is operated by Jack Alla (trading as Local AI Signal). If you have questions about this policy or wish to exercise your rights, contact us at privacy@localaisignal.com.

2. Personal data we collect

Account data: name, email address, password (hashed), and login credentials.
Business profile data: business name, services, locations, competitors, and other information you enter.
Content and usage data: AI prompt checks you run, saved reports, alerts, and features used.
Support data: messages you send to us and their metadata.
Technical data: IP address, device identifiers, browser type, log data, and cookies.
Payment-related data: handled by Paddle (see section 5). We receive limited transaction metadata (plan, status, last 4 digits, billing country) but not full card details.

3. Purposes and legal bases

To provide the Service (create your account, run checks, deliver reports) — legal basis: performance of a contract.
To operate and improve the Service, prevent fraud and abuse, and secure our systems — legal basis: legitimate interests.
To process payments and manage subscriptions through Paddle — legal basis: performance of a contract and legal obligation (tax/invoicing).
To send transactional email (receipts, alerts, password resets) — legal basis: performance of a contract.
To send product updates or marketing where permitted — legal basis: consent, which you can withdraw at any time.
To comply with legal obligations — legal basis: legal obligation.

4. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to secure the Service. We may also use limited analytics cookies to understand aggregate usage. You can manage cookies through your browser settings; disabling essential cookies may break parts of the Service.

5. How we share your data

We share personal data only with the following categories of recipients:

Paddle — our Merchant of Record and payment processor. Paddle.com Market Limited handles checkout, billing, tax collection, invoicing, subscription management, and refunds. When you purchase, Paddle collects your payment and billing information directly and processes it under its own privacy notice at paddle.com/legal/privacy.
Infrastructure and hosting providers that host the Service and its database.
Email delivery providers for transactional and support messages.
Analytics and error-monitoring providers that help us keep the Service reliable.
Professional advisers (legal, accounting, tax) where reasonably necessary.
Public authorities where we are required to disclose by law.

We do not sell your personal data.

6. International transfers

Some of our providers may process personal data outside your country, including outside the UK and EEA. Where this happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. Data retention

We keep account and business profile data for as long as your account is active. If you delete your account, we delete or anonymise associated data within 90 days, except where we must keep records for legal, tax, or accounting reasons (typically up to 7 years). Backups containing your data are overwritten on a rolling basis.

8. Your rights

Depending on your location, you have the right to access, correct, delete, restrict, or object to processing of your personal data, to request portability, and to withdraw consent. UK and EEA users also have the right to lodge a complaint with a supervisory authority. We aim to respond within one month. To exercise your rights, email privacy@localaisignal.com or use Settings → Data and privacy in the app.

9. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), encryption at rest for the database, access controls, and regular review of who can access production data. No system is perfectly secure, and we cannot guarantee absolute security.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy from time to time. Material changes will be highlighted in the Service or by email.

12. Contact

Jack Alla — privacy@localaisignal.com