Privacy Policy
Thanks for using Aladdyn! Our Privacy Policy details how we handle your info. By using Aladdyn, you agree to these practices.
Last updated: September 29, 2026
Information We Collect
Who This Policy Covers
Aladdyn provides AI assistants ("genies") that businesses place on their website and connect to their messaging, email, calendar and store accounts. This policy covers two groups: (1) businesses and their team members who create an Aladdyn account ("Customers"), and (2) the people who talk to a Customer's genie, such as website visitors, shoppers, and people who message or email the business ("End Users"). For Customer account data, Aladdyn decides how the data is used. For End User data, Aladdyn processes it on behalf of and on the instructions of the Customer whose genie the End User is talking to, and that Customer is responsible for its own notice to End Users.
Account Information
When you sign up we collect your name, email address, password (stored only as a hash) or the identity returned by the sign-in provider you choose (Google, GitHub or Microsoft), your company name, and your settings. If you invite team members, we store their name, email address and role.
Billing Information
Payments are processed by Razorpay. We receive and store your plan, payment status, invoice amounts and Razorpay transaction identifiers. We do not receive or store your full card number, UPI PIN or bank credentials.
Business Content You Provide
To train a genie we crawl the public website address you give us and store the page text, screenshots, logo and brand colours we extract from it, together with any documents, FAQs and instructions you upload. This content is turned into searchable vectors so the genie can answer from it. It is stored in your account and used only for your genies.
Conversations With a Genie
When an End User chats with a genie on a website, on WhatsApp, on Instagram, on Facebook Messenger, or by email, we store the messages exchanged, the genie's replies, timestamps, the channel, and the identifiers needed to continue the conversation (for example a phone number, Instagram or Facebook user ID, or email address). The Customer can read these conversations in their Aladdyn dashboard.
Leads and Contact Details
If an End User gives their name, email address or phone number in a conversation, or books a meeting, we store those details as a lead for the Customer, together with the conversation it came from and the website activity described below.
Website Visitor Activity
The genie widget assigns each browser a random visitor identifier stored in the browser's local storage. We record page views on the Customer's website using Umami, an analytics tool we host ourselves. Page-level actions (such as clicks and product views) are recorded only after the visitor agrees in the widget's consent prompt. If consent is declined, the identifier is kept only for the current page and is not stored. We use this activity to give the genie context about what the visitor is looking at and to show the Customer lead activity.
Usage, Device and Log Data
Our servers log IP address, browser and device type, request paths, timestamps and errors so that we can operate, secure and debug the service. Application errors are reported to Sentry, our error-monitoring provider.
Cookies and Local Storage
The Aladdyn dashboard uses cookies and local storage to keep you signed in and remember your preferences. The genie widget uses local storage for the visitor identifier, the consent choice and the open conversation. We do not use advertising cookies.
How We Use Your Information
To Provide the Service
We use the information above to run the Customer's genies: answering End User questions from the Customer's own content, drafting and sending replies on connected channels, booking meetings, showing products and managing a shopping cart on connected stores, capturing leads, and showing the Customer their conversations, leads and analytics.
Account, Billing and Support
We use account and billing data to create and secure your account, process payments, send service and billing emails, and answer support requests. You can opt out of marketing emails at any time; service emails cannot be turned off while your account is active.
Security and Reliability
We use log and usage data to detect abuse, fraud and security incidents, to keep each Customer's data separate from other Customers' data, and to fix errors.
What We Never Do
We do not sell personal information. We do not use Customer or End User data for advertising, retargeting or interest-based ads, and we do not share it with data brokers or information resellers. We do not use Customer or End User data, including any data received from Google, Meta or Shopify, to train, develop or improve AI or machine-learning models.
AI Processing
How Replies Are Generated
To answer an End User, Aladdyn sends the relevant part of the conversation, together with passages retrieved from the Customer's own content, to an AI model and returns the model's reply. Crawled website text is also sent to the AI model to create the searchable vectors and to summarise the business profile.
Our AI Providers
Conversation content, email content, and business content are processed by third-party AI model providers through their business APIs, only to generate the reply or the searchable vectors and not for any other purpose. Our primary provider is OpenAI (OpenAI API platform). Under OpenAI's API data-usage terms, data sent to the API is not used to train or improve OpenAI's models, and OpenAI may keep API inputs and outputs for up to 30 days only for abuse monitoring. Aladdyn itself does not use this content to train any AI model.
Social Media Content Generation
If a Customer uses Aladdyn to create social media posts, the prompts and brand material the Customer provides are sent to Replicate and DeepAI to generate images and video. End User conversations, email content and data received from Google, Meta or Shopify are not sent to these providers.
Human Review and Automated Replies
Customers can choose to have genie replies held for their review and approval before they are sent. AI replies can be wrong; each reply is generated from the Customer's content and is not a decision with legal or similarly significant effects on the End User.
Google User Data
Google Sign-In
If you sign in with Google we receive your name, email address and profile picture (the openid, email and profile permissions). We use them only to create and sign in to your Aladdyn account.
Google Calendar
If you connect Google Calendar we request the calendar and calendar.events permissions. We query your free and busy times so the genie can offer open slots, and we create the event and send the invitation when an End User books a meeting through the genie. We do not store the content of your other calendar events.
Gmail: What We Access and Why
If you connect a Gmail inbox we request two permissions. gmail.readonly lets us be notified of new messages in the inbox's INBOX (users.watch and users.history.list) and read them (users.messages.get): the sender, subject, message body and thread identifiers. The message body is needed to draft a reply, which the narrower metadata-only permission cannot provide. gmail.send lets us send the reply from your own address in the same email thread; sent replies appear in your Gmail Sent folder. We access only inboxes that the account owner explicitly connects. We do not modify, label, move or delete any email.
How Google User Data Is Used and Shared
Gmail and Calendar data is used only to provide these user-facing features: drafting and sending replies to customer enquiries, showing those email conversations in your dashboard, and booking meetings. To draft a reply, the email text is sent to our AI model provider as described under "AI Processing", only to generate that reply. Aladdyn does not use Google user data to train any AI model. We do not transfer Google user data to anyone else except as necessary to provide these features, to comply with the law, or as part of a merger or acquisition with your prior consent. We never use it for advertising, never sell it, and never use it to assess credit-worthiness or for lending.
Human Access to Google User Data
Aladdyn staff do not read your Gmail or Calendar data unless you give us explicit permission for specific messages (for example, when you ask for support), it is necessary for security purposes such as investigating abuse, or it is required to comply with applicable law. The Customer who connected the inbox can read the email conversations in their own dashboard.
Storage, Disconnection and Deletion
Gmail access and refresh tokens are stored encrypted. You can disconnect Gmail or Calendar at any time in Aladdyn, and you can revoke Aladdyn's access at any time at myaccount.google.com/permissions. When you disconnect Gmail we stop the inbox notifications and delete the stored tokens immediately. Email conversations already processed are deleted automatically 90 days after their last message, or sooner if you delete them, delete the genie, or delete your account; you can also ask us to delete them as described under "How to Delete Your Data".
Limited Use Disclosure
Aladdyn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Meta Platforms: WhatsApp, Instagram and Facebook
What We Access
A Customer can connect a WhatsApp Business account, an Instagram professional account, and a Facebook Page. Depending on what the Customer connects, we request these Meta permissions: whatsapp_business_management and whatsapp_business_messaging (receive and send WhatsApp messages and manage the business number and templates); instagram_basic, instagram_manage_messages, instagram_manage_insights and instagram_content_publish (receive and reply to Instagram direct messages, read account insights, and publish posts the Customer creates); pages_show_list, pages_manage_metadata, pages_messaging and pages_read_engagement (list the Customer's Pages, subscribe to message webhooks, and reply to Messenger conversations); and business_management (find the business assets the Customer chooses to connect).
How We Use Meta Platform Data
We process message content, sender identifiers (phone number, Instagram-scoped or Page-scoped user ID, and profile name), delivery and read status, and account details only to receive End User messages, generate and send the Customer's replies, publish content the Customer asks us to publish, and show conversations and insights to the Customer. We process this data solely on behalf of and at the direction of the Customer who connected the account, and not for our own purposes.
What We Never Do With Meta Platform Data
We do not sell, license or purchase Meta Platform Data; we do not use it to build or augment profiles of individual WhatsApp, Instagram or Facebook users beyond the conversation with the Customer; we do not use it for advertising; and we do not use it to create, develop, train or improve any AI or machine-learning model.
Retention and Deletion of Meta Platform Data
Access credentials for connected Meta accounts are stored in our access-controlled database and used only by our backend. When a Customer disconnects a channel we stop receiving and sending messages on it. Conversations are deleted automatically 90 days after their last message, or sooner if the Customer deletes them, deletes the genie, or deletes their Aladdyn account. Any WhatsApp, Instagram or Facebook user, and any Customer, can request deletion of their data at any time as described under "How to Delete Your Data".
Shopify Stores
What We Access
Aladdyn Commerce creates a dedicated assistant workspace when a merchant installs the app. With authorization we read shop details, products, variants, collections, inventory, locations, Online Store pages and legal policies. Optional order analytics reads the available recent 60 days of orders, purchased products, quantities, sales adjustments, payment amounts and refunds, and accumulates history going forward. It does not request customer names, email addresses, phone numbers, addresses, card details, free-text order notes or customer profiles. Shoppers can ask the assistant to manage their storefront cart and continue to Shopify checkout; payment information stays with Shopify.
How We Use Shopify Data
We use store content to answer product and policy questions and keep each shopper's cart separate. We store shopper conversations, session identifiers and any personal information shoppers include in messages, on behalf of the merchant. Relevant conversation and store content is sent to the AI provider to generate replies as described under AI Processing. Shopify access tokens are encrypted. Optional order analytics reports merchant sales, refunds, product performance and Genie attribution from Shopify financial facts. Order analytics facts are not sent to the reply-generation model. Linking an existing Aladdyn account is optional. Declining analytics permissions does not disable the assistant.
Consent and Genie Attribution
When analytics processing is permitted by Shopify customer privacy settings, the storefront bridge and optional Aladdyn Web Pixel collect allowlisted page, product, cart and checkout event identifiers, product and variant identifiers, quantities and timestamps. Browser identifiers and cart/checkout tokens are hashed on receipt. An opaque random reference links an eligible Genie interaction to purchased products for up to seven days; it contains no message text or customer contact details. Cart lines may carry a private attribution property. Browser checkout events do not establish payment: Shopify orders are the financial authority. Measurement may be incomplete when consent or event delivery is unavailable. We do not sell this data or use it for advertising.
Order Analytics Retention
Behavioral funnel events are deleted after 90 days. Unallocated attribution references are deleted after their seven-day eligibility window plus 60 days; references needed to explain retained financial allocations remain with those records. Minimal order financial facts and their derived reports are retained while the merchant uses analytics, subject to verified erasure requests and store redaction. Erasure removes linked identifiable events and rebuilds derived reports. A keyed suppression fingerprint prevents reconciliation from recreating erased orders. Store redaction removes store-specific analytics data. Recommendation references in the browser expire after seven days and are removed when analytics consent is withdrawn.
Shopify Privacy Requests
Shopify privacy requests appear in the embedded app. The merchant verifies which conversations belong to the person requesting access or deletion. The app prepares a scoped export or erases verified records; the merchant delivers access exports and confirms delivery separately. Unresolved requests remain visible with their deadlines. We help merchants fulfill requests within 30 days, except where law requires specific records to be kept. Uninstall stops the connection; Shopify's shop redaction webhook triggers deletion of store-specific app data and indexed content. Cart-session records and completed job and webhook receipts are cleaned after 30 days; unresolved privacy requests are retained until resolved.
Other Connected Accounts
Microsoft Outlook and Other Email
A Customer can connect a Microsoft Outlook mailbox (through Microsoft Graph) or any mailbox by IMAP and SMTP instead of Gmail. We read new incoming messages and send the genie's replies in the same way as described for Gmail, and the same limits apply: the content is used only to draft and send replies and show the conversation to the Customer, and is never used for advertising or to train AI models. Mailbox credentials and tokens are stored encrypted.
If a Customer connects LinkedIn, we use the permissions granted to publish the posts the Customer creates and schedules in Aladdyn.
Sign-In Providers
If you sign in with GitHub or Microsoft we receive your name and email address from that provider and use them only to create and sign in to your account.
Information Sharing and Service Providers
Service Providers We Use
We share data only with the providers needed to run the service, each for the purpose listed: Railway (application hosting, databases, vector search and file storage); Vercel (hosting of our website and dashboard); AI model providers, primarily OpenAI (AI replies, as described under "AI Processing"); OpenAI, Google Gemini, NVIDIA, Replicate, DeepAI and Hugging Face (social media content and image generation, depending on the configured provider, using Customer prompts and supplied brand logos and images); Razorpay (payments); and Sentry (error monitoring). Our analytics tool, Umami, is hosted by us.
Platforms You Connect
When you connect Google, Meta (WhatsApp, Instagram, Facebook), Shopify, Microsoft or LinkedIn, we send data to that platform only to perform the action you asked for, such as sending a reply, creating a calendar event, or updating a cart. Each platform's own privacy policy governs its handling of that data.
Legal Requirements and Business Transfers
We may disclose information when required by law or court order, or to protect the rights, property or safety of our users, the public or Aladdyn. If Aladdyn is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction; for data received from Google APIs we will obtain your explicit prior consent first.
No Sale of Personal Information
We do not sell personal information and do not share it for cross-context behavioural advertising.
Data Security
How We Protect Data
All traffic to and from Aladdyn uses HTTPS (TLS). Access tokens and passwords for connected mailboxes (Gmail, Outlook and IMAP) and Meta app secrets are encrypted before they are stored; other credentials are kept in our access-controlled database and used only by our backend. Each Customer's data is separated by account, and every request is checked against the signed-in account before data is returned.
Access Controls
Access to production systems is limited to the staff who need it to operate the service, using individual accounts. Staff do not access Customer or End User content except as described in this policy.
Incident Response
If a security incident affects your data, we will investigate, contain it, and notify affected Customers and the relevant authorities as required by applicable law and by the platform terms of Google, Meta and Shopify.
How to Delete Your Data
Customers: Delete Your Account
Sign in to Aladdyn, open the "Account & data" page, and choose Delete account. This permanently deletes your account together with your genies, conversations, leads, connected-account tokens (Google, Meta, Shopify, Microsoft, LinkedIn) and uploaded content. You can also delete individual conversations or genies at any time from the dashboard.
Disconnect a Single Account
To stop Aladdyn accessing one platform without deleting your account, disconnect it in Aladdyn's integration settings, or revoke access from the platform itself: Google at myaccount.google.com/permissions; Facebook and Instagram under Settings > Apps and Websites (Business Integrations); WhatsApp in Meta Business Settings; Shopify by uninstalling the app from your Shopify admin.
End Users and Anyone Else: Request Deletion
If you chatted with, messaged or emailed a business that uses Aladdyn, including on WhatsApp, Instagram or Facebook Messenger, email privacy@aladdyn.io with the subject "Data deletion request". Include the business name and the phone number, username or email address you used, so that we can find your conversation. We will confirm receipt, delete your data, and confirm the deletion to you. You may also ask the business directly.
Timing
We complete deletion requests within 30 days. Deleted data may remain in encrypted backups for up to 90 days before it is overwritten. We keep only the records that the law requires us to keep, such as invoices, and we will tell you if a legal requirement prevents deletion of any specific data.
Retention and Your Rights
How Long We Keep Data
We keep Customer account data while the account is active. Conversations (website chat, WhatsApp, Instagram, Messenger and email) are deleted automatically 90 days after the last message in the conversation, and website visitor activity events are deleted automatically 90 days after they are recorded. Leads are kept while the Customer's account is active. The Customer can delete any of this data sooner, and it is also deleted when the Customer deletes the genie or the account, or when an End User's deletion request is completed. Billing records are kept as long as tax law requires. Server logs are kept only as long as needed for security and debugging.
Your Rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict its processing, and to withdraw consent. Customers can do most of this in their account settings. Anyone can make a request by emailing privacy@aladdyn.io; we respond within 30 days. If you are an End User, we may refer your request to the business whose genie you talked to and help them respond.
Marketing Choices
You can unsubscribe from our marketing emails using the link in any of them or by contacting us.
International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from your country. We take appropriate safeguards to ensure your information is protected in accordance with this Privacy Policy.
Children's Privacy
Our services are not intended for users under the age of 13. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date.
Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us.