Privacy Policy

Who we are

Alcanca Group OÜ is an Estonian private limited company with registry code 17299925 and registered office at Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia. Alcanca is the controller of account, website, support, security and service-administration data described in this policy.

When Alcanca acts for an organisation

Alcanca provides business software to organisations. For customer, lead, employee and communication data that an organisation places in the platform, that organisation normally decides why and how the data is used and acts as controller. Alcanca processes that data on the organisation's instructions as its processor. Requests about that business data should usually be directed to the organisation that manages the account.

Information we process

• Account details such as name, email address, role, organisation and profile photo.
• CRM content such as contacts, phone numbers, email addresses, notes and opportunities.
• Communications including SMS, WhatsApp, email, attachments, call metadata, voicemail and recordings when the organisation enables those features.
• Device identifiers and notification tokens required to keep a user signed in, deliver alerts and receive calls.
• Security, reliability and diagnostic information needed to prevent abuse and operate the service.

Purposes and legal bases

Information is used to authenticate users, isolate business accounts, provide CRM and communication features, route notifications and calls, maintain security, troubleshoot failures, respond to support requests and comply with legal obligations. Depending on the context, Alcanca relies on performance of a contract, compliance with legal obligations, consent where the law requires it, and legitimate interests in operating, securing and improving a business service. Alcanca does not use CRM content or mobile notification data for cross-company advertising tracking.

Recipients and service providers

Alcanca uses vetted infrastructure and communication providers, including Supabase for authentication and data services, Twilio for enabled phone and messaging services, email delivery providers, Meta for enabled WhatsApp services, Apple Push Notification service and cloud hosting providers. Data may also be disclosed where required by law or to protect the service and its users. Providers are limited by contract and process information only for the function they perform.

International transfers

Some providers may process data outside Estonia or the European Economic Area. Where required, Alcanca uses recognised safeguards such as an adequacy decision or the European Commission's standard contractual clauses, together with appropriate technical and organisational measures.

Retention and security

Information is retained for as long as the relevant organisation uses the service, as needed to provide requested functionality, resolve disputes, maintain security or meet legal obligations. Alcanca applies access controls, tenant isolation, encrypted transport, protected credentials and audit controls. No internet service can eliminate every risk.

Your rights and choices

Notification categories can be changed in the Alcanca App and system notification access can be changed in iPhone Settings. Subject to applicable law, individuals may request access, correction, erasure, restriction or portability of their personal data, object to certain processing, and withdraw consent without affecting earlier lawful processing. Requests about organisation-controlled CRM data should be made to that organisation; other requests can be submitted through our contact page. Alcanca may need to verify the requester and the organisation's authority before acting.

You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority where you live or work.

Children

The service is intended for authorised business users and is not directed to children. We do not knowingly offer public accounts to children.

Changes

This policy may be updated when the service or legal requirements change. The current version and its update date will remain available at this URL.