01. Who we are
Mustard Seed Credo Limited Company, a Wyoming limited liability company ("Alfre", "we", "us" or "our"), is the data controller for personal data we collect about visitors, account holders and users of the Alfre website, web application and related services (the "Service"). Contact: legal@tesserac.ai.
This Privacy Policy is governed by the laws of the State of Wyoming, USA.
02. What we collect
- Account data — name, email address, organization, role and login credentials, including multi-factor authentication settings.
- Usage data — log, device and interaction data needed to run and secure the Service, and model usage counts for billing and limits.
- Content you provide — messages, instructions, files and documents you upload, memories the agent saves for you, skills, routines, and project knowledge bases.
- Connected-account data — when you choose to connect a third-party account (such as Google, Microsoft 365, GitHub, Slack, Teams or Telegram), the OAuth tokens or credentials for that account and the data the agent retrieves from it at your request. Google data is described in section 3.
- Billing data — plan, transactions and, where applicable, payment details processed by our payment provider. The Service is not Payment Card Industry (PCI) compliant — you must not use it to process or store cardholder data.
03. Google user data
Alfre lets you connect your Google account so the agent can work in Gmail, Google Drive, Google Calendar and Google Contacts on your behalf. This section explains exactly how we handle data received from Google APIs ("Google user data").
Data accessed
- Gmail — messages, threads, labels and drafts, so the agent can search, read, summarize, draft, send, reply to, label and trash email when you ask it to.
- Google Drive — file names, metadata and contents, so the agent can find, read, export, create and trash files when you ask it to.
- Google Calendar — events and their details, so the agent can list, create and delete events when you ask it to.
- Google Contacts — names, email addresses and related contact details, so the agent can look people up when you ask it to.
How we use it
We access Google user data only to provide the user-facing features you request: when you ask the agent to do something in your Google account, or when a routine you created runs. The relevant data is passed to the AI model you have selected only to generate the response or perform the action you asked for. Actions that send, create or delete data — such as sending email or creating calendar events — require your explicit approval in the Service by default.
We do not use Google user data for advertising, to build user profiles for advertising, or to train, fine-tune or improve generalized or third-party AI or machine-learning models. We do not sell Google user data. Humans at Alfre do not read your Google user data unless you give us explicit permission for specific messages or files, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and anonymized for internal operations.
Sharing
We transfer Google user data only (a) to the AI model provider you have chosen, to process your request; (b) to service providers that host and operate the Service on our behalf under confidentiality and security obligations; (c) when you direct the agent to send it somewhere, such as replying to an email or posting a summary to a channel you connected; or (d) where required by law or as part of a merger or acquisition with notice to you.
Storage and protection
Your Google OAuth tokens are stored encrypted in our database and are used only for your account. Content retrieved from Google is processed in an isolated sandbox for the conversation that requested it and is not stored outside your conversation history unless you ask the agent to save it (for example as a memory or a file).
Revoking access and deletion
You can revoke Alfre's access to your Google account at any time from your Google Account permissions page ; once revoked, the stored tokens can no longer be used. Deleting your Alfre account deletes the stored tokens. To have Google user data contained in your conversations, memories or files deleted, delete them in the Service or email privacy@tesserac.ai and we will delete it within 30 days, except where we must keep it to comply with law.
Limited Use disclosure
Alfre's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements.
04. How and why we use it
We process personal data to provide, secure, support and improve the Service, to manage accounts and billing, to communicate with you, and to comply with legal obligations. Our legal bases are your consent and/or performance of our contract with you, and our legitimate interests in running the Service, consistent with Malaysia's Personal Data Protection Act (PDPA) and applicable US law.
We do not use your personal data or content to train, fine-tune or improve any general or third-party AI model. We may use aggregated or de-identified data that does not identify you or your organization for service analytics, capacity planning and improvement.
05. Disclosure
We share personal data only with vetted service providers (sub-processors) who process it on our behalf under confidentiality and security obligations, with the AI model provider you select to process your requests, and where required by law. We do NOT sell your personal data.
Sub-processors, except for cloud storage providers, will not retain or log your personal data or content for human review.
06. International transfers
The Service may store or process data on infrastructure located outside your country. Where data crosses borders, we use appropriate safeguards consistent with the PDPA and applicable law.
07. Retention and deletion
We keep personal data while your account is active and as needed for the purposes above or to meet legal obligations, then delete or anonymize it. When you delete your account, we delete your conversations, memories, files, connected-account tokens and other content within 30 days, except where we must retain it by law.
08. Security
We apply technical and organizational measures including encryption in transit and at rest, access controls and least-privilege access. Each conversation runs in its own isolated sandbox, every agent tool call is authenticated to the acting user, and sensitive actions are held for your approval.
09. Your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal data, withdraw consent, or object to certain processing. Depending on your location you may have additional rights (e.g. under Malaysia's PDPA, or California's CCPA/CPRA — including the right to know what we collect and to opt out of any sale, which we do not do). To exercise these rights, contact legal@tesserac.ai.
10. Children
The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. For material changes we will give reasonable advance notice before they take effect, and will not weaken our commitments on confidentiality, content or security without your consent.
12. Contact
Mustard Seed Credo Limited Company, 1309 Coffeen Ave Ste 1200, Sheridan, WY 82801, USA · privacy@tesserac.ai.
Questions about this Privacy Policy: legal@tesserac.ai.