Privacy Policy

This policy explains how Alpgency processes personal data when you visit alpgency.xyz, fill in our contact form, or use the demo applications at demo.alpgency.xyz and inbox.alpgency.xyz. We've written it in plain language; if anything is unclear, write to build@alpgency.xyz.

1. Who is responsible

Alpgency is the data controller. We are a European AI agency with partners in Zürich (Switzerland) and Madrid (Spain).

• Email: build@alpgency.xyz
• Postal address: available on request.

For Swiss matters, the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC / EDÖB). For matters under Spanish law, the Agencia Española de Protección de Datos (AEPD) is competent. EU users may also lodge complaints with their own national data protection authority.

2. What we collect

Server access logs

Every visit to our sites produces a log entry containing your IP address, the URL requested, the time, your browser identifier, and (where applicable) the referring page. These are processed by our hosting provider Hetzner Online GmbH (Falkenstein, Germany) and our reverse proxy Caddy on the same infrastructure.

Retention: 30 days. Legal basis: Art. 6(1)(f) GDPR, legitimate interest (security, abuse prevention).

Contact form submissions

If you write to us via the contact form on alpgency.xyz, we receive the information you provided: typically your name, email address, optional company name, and the body of your message. This is stored in a Postgres database that we operate on the same Hetzner instance.

Retention: 24 months, unless you ask us to delete sooner. Legal basis: Art. 6(1)(b) GDPR, pre-contractual measures at your request.

Calendly bookings

If you book a call through the Calendly widget on our site, Calendly LLC (Atlanta, US) processes the data you provide (name, email, chosen time, optional message) on our behalf. We receive a notification with this information. See the Calendly Privacy Policy.

Retention: until the engagement is concluded or you ask us to delete the record. Legal basis: Art. 6(1)(b) GDPR.

Demo applications (demo.alpgency.xyz · inbox.alpgency.xyz)

These applications are gated demos for evaluation partners. If you receive credentials and submit a pitch deck through demo.alpgency.xyz, we process:

• The PDF you upload and the form fields you fill in (founder name, company URL, LinkedIn, etc.)
• Outputs we derive: PDF text, public LinkedIn and GitHub summaries, news mentions
• The score and notes our agent produces

We process this data through our self-hosted n8n workflow engine and the Anthropic Claude API (Anthropic PBC, San Francisco, US) for extraction and scoring. We do not auto-send any outbound email; outreach drafts are surfaced for human review only.

Retention: 90 days after the end of the evaluation period, then deleted. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in evaluating the use case).

Cookies and local storage

This site does not set first-party tracking cookies. The Calendly widget sets its own functional cookies when it loads. You can block them in your browser if you do not intend to use Calendly. Our font files currently load from Google's fonts.googleapis.com CDN; we are migrating to self-hosting to remove this dependency.

3. Who else processes your data (subprocessors)

International transfers to US providers are covered by Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework.

4. Your rights

You have the right to:

• Access the personal data we hold about you (Art. 15 GDPR)
• Correct inaccurate data (Art. 16)
• Delete your data, subject to lawful retention requirements (Art. 17)
• Restrict processing (Art. 18)
• Receive a portable copy of your data (Art. 20)
• Object to processing based on our legitimate interest (Art. 21)
• Withdraw consent, where consent is the legal basis
• Lodge a complaint with a data protection authority

To exercise any of these, email build@alpgency.xyz. We aim to respond within 30 days.

5. Children

Our services are intended for businesses. We do not knowingly collect data from individuals under 16.

6. Updates

We may revise this policy as our processing changes. The "Last updated" date at the top reflects the most recent version. Material changes are noted in the change log below.

Change log

• 25 May 2026: initial version.