Align Tech Ltd – Privacy policy

1. Who we are

Align Tech Ltd

A company registered in the United Kingdom.

Registered office: London, UK.

Email: [email protected]

We build software that helps engineering teams capture, structure, and trace decisions across their SDLC.

2. Information we collect

We collect information in several ways, depending on how you interact with Align.

2.1 Information you provide

• Email address, when you create an account or request updates
• Name, company, and message, if you contact us directly via email
• Account information, when you register to use the Align platform
• Payment information, when you subscribe to a paid plan (processed securely by Stripe; we do not store full card details)
• Decision content, when you capture engineering decisions through Align

2.2 Information from connected platforms

When you connect Align to third-party platforms, we may collect:

• Slack - messages, channel information, and user identifiers when you use Align commands or capture decisions
• Microsoft Teams - messages, conversation data, and meeting transcripts when capturing decisions
• GitHub - pull request information, comments, and repository metadata
• Jira - issue data, comments, and project information
• Confluence - page content when capturing decisions from documentation
• Zoom - meeting transcripts and related metadata when capturing decisions from calls

We only access data necessary to provide decision capture functionality and do not store full message histories.

2.3 Automatically collected information (website analytics)

We may collect non-identifying data about your visit, such as:

• Browser type
• Device type
• Pages visited
• Time spent on pages
• Referring website

This information helps us improve our website and understand interest in Align.

We do not use third-party advertising cookies, and we do not track individuals across sites.

2.4 Product telemetry

When you use the Align platform, we collect telemetry data to improve our services:

• Engagement data - how you interact with decisions (viewing, searching, linking, editing)
• Feature usage - which commands and features you use, and how often
• AI quality metrics - how you interact with AI-generated suggestions (acceptance, edits, rejections)
• Performance metrics - response times and system health indicators
• Session information - session duration and platform used

Telemetry data is associated with your tenant (organisation) and may include user identifiers for feature improvement purposes. We use this data to improve product quality, measure feature adoption, and enhance AI accuracy.

2.5 Command-line tool (CLI) telemetry

The Align command-line tool (align) sends anonymous usage events. It is on by default. The first time it runs, it prints a notice on screen before it sends anything. If you turned telemetry off earlier, it stays off.

The CLI sends only these items:

• Install id - a random id the CLI makes on your machine. It is not linked to your name, email, account or tenant.
• Command name - for example ask. Never the arguments you typed.
• CLI version
• Operating system name - for example linux or darwin. Sent once, on the install event only.
• Setup stage names - which step of setup you reached.
• Agent name - which coding agent align opened or read sessions for, for example claude-code.
• Connector names - which kind of source a sync used, for example github. The name of the kind only.
• Counts - a number of items or decisions for a step. For example, how many sessions were scanned or how many items a sync read.
• Sync result - whether a sync worked, who it was for (yours or your team's), and what started it (connecting, the background, or you).

The CLI never sends code, decision text or titles, file names, repository names, organisation names, prompts, API keys, error messages, or the questions you ask.

Align does not store your IP address with these events. The events table has no column for it, and the IP is not sent to PostHog. We use your IP address only to rate-limit requests. The rate-limit counter expires after one hour.

The events go to Align's gateway. It stores four things in its database: the install id, the event name (which includes the stage), the command name and the CLI version. It deletes those rows after 90 days. We also copy the events to PostHog, our analytics provider, in its EU region. PostHog receives the fields above from an allowlist. It keeps them under our PostHog retention settings.

Telemetry is never sent in CI. To turn it off, use any one of:

• align telemetry off
• set DO_NOT_TRACK=1
• set ALIGN_TELEMETRY=0

This section covers the CLI only. Section 2.4 still applies to the Align platform. Telemetry is separate from the two things below. They happen only when you choose them.

2.6 Work email at the share prompt (CLI)

When you run align share in a terminal against Align's hosted service, and you have not joined a team, the CLI may ask for a work email address. It is optional. You can skip it. We use it to email you about team plans.

The CLI asks once. It asks again only if the address did not get through (a network error, a server error or too many requests), or if we change this consent text. It does not keep the address on your machine. A self-hosted Align does not ask for it or collect it. If Align's hosted service has not switched this on yet, the CLI tells you so, and nothing is stored.

If you give an address, this is what happens:

• We send you one confirmation email. To confirm, open the link in it and press the Confirm button. Opening the link alone confirms nothing. The link works for 7 days.
• We send at most one confirmation email a day to a mailbox, and at most 3 in total, however many times the address is entered.
• We tell the Align team (sales) only after you confirm, by email. They get your address, its domain, the CLI version, your operating system and when you confirmed.
• The confirmation email has an unsubscribe link. Open it and press Unsubscribe. The one-click unsubscribe button in your mail app also works. You can also withdraw by writing to [email protected].
• We treat variants of one mailbox as one address, for these limits and for unsubscribing. We ignore anything after a +, and for Gmail we also ignore dots. Unsubscribing one variant unsubscribes them all. We send to the address as you typed it, in lower case. If you enter a second variant, it replaces the first.
• The email comes from an align.tech address through Resend. It is signed Align and gives our company number and registered office.

We store these items:

• Your email address, as you typed it, in lower case
• The date you gave it, and the consent version you saw. The version is 2026-10-cli-share-1.
• The domain of the address, for example acme.com
• The CLI version and your operating system name
• When we sent confirmation emails and how many, and when you confirmed, when we told the Align team, and when you unsubscribed
• A keyed hash of your IP address (for IPv6, of its network prefix). We use it only to limit abuse. We never store the IP address itself.

The CLI does not send your telemetry install id with the address. We keep this data separate from usage telemetry.

How long we keep it. If you do not confirm, we delete the address 30 days after the last confirmation email we sent (or 30 days after you gave it, if we sent none). We keep a confirmed address until you unsubscribe or ask us to erase it. We delete the whole record 30 days after you unsubscribe. To ask for erasure, write to [email protected].

What we keep after that. After an unsubscribe or an erasure, we keep a keyed hash of the mailbox, so that we do not email you again. When we delete an address you did not confirm, we keep a keyed hash of it with the number of confirmation emails we sent, so that the limit of 3 does not start again. Without our secret key, nobody can tell which address a hash belongs to. With it, we can only check whether a given address matches. We keep these hashes with no end date.

Why we may use it. Consent. You give it at the prompt and again when you confirm. You can withdraw it at any time by unsubscribing.

Who handles it. We send the emails through Resend, an email delivery provider. It acts on our behalf for this purpose. We never sell this data.

2.7 Sharing to a team graph (CLI)

align share sends the decisions you name from your machine to your team's graph. It shows you what it will send first. Nothing readable reaches the team graph until you approve.

The CLI sends, for each decision you share:

• The decision text you saw in the preview: the title and the text.
• Your notes and judgements about that decision, as the preview lists them, each with the time you made it. If an agent recorded one for you, the agent's name goes with it.
• The source URL, the platform it came from, and when it was decided. If the decision has no source URL, the CLI sends an opaque link in its place.
• An opaque key for the decision. It is a hash of a secret on your machine and the local id. We never receive your local ids.

The CLI does not send your git email, file paths, or a judgement about a decision you have not shared. It does not send a judgement you took back. The team graph records which account sent the share. Align then processes the shared text with AI, as it does any captured decision (see section 3 and our subprocessors list).

You approve each share. On Align's hosted service you approve it in your browser, signed in to Align. Where passkeys for approvals are switched on and you have set one up, you are asked for it. You can choose to answer yes in the terminal instead, after the preview, unless the service requires browser approval.

Browser approval sends a little before you approve. To set up the approval, the CLI sends an encrypted copy of the share that we cannot read (the key stays in the link you open), the number of decisions and judgements in it, the agent's name if an agent started it, and your computer's name. We delete the encrypted copy within 25 minutes. We keep the rest with the approval record for 30 days.

What happens after. A shared decision becomes part of your team's record. Who on your team can see it follows your workspace's visibility settings. If you retract it with align share --retract, Align archives it on the team graph. An archived decision stays stored. Retract works from the machine you shared from. You cannot retract a share that attached to a decision your team already held.

If your account is erased. We remove your name and the judgements you made from the team's record. A decision your team could see stays. We delete one that only you could see. Audit records of the share stay, linked to an anonymised account. Erasure does not edit decision text. If the text names a person, you can ask us to remove or change it. Write to [email protected]. We handle these requests by hand, on request.

3. How we use your information

We use the information we collect to:

• Provide and improve our website and platform
• Respond to inquiries
• Email you about team plans, if you gave your work email at the CLI share prompt and confirmed it
• Keep the decisions you choose to share to a team graph
• Send product updates and announcements
• Deliver the Align decision capture service
• Process and extract decisions using AI
• Detect conflicts and relationships between decisions
• Improve AI extraction accuracy based on user feedback
• Analyse usage patterns to improve features
• Process payments and manage subscriptions
• Monitor system performance and reliability
• Generate aggregated, anonymised analytics for product development

We do not sell or rent your personal data.

4. Legal basis (UK/EU GDPR)

For visitors in the UK/EU, we process personal data under one or more of the following legal bases:

• Consent - e.g. when you create an account, subscribe to updates, or confirm your work email after the CLI share prompt
• Legitimate interest - analytics, site functionality, security, product improvement, and AI quality enhancement
• Contractual necessity - when providing the Align service, processing decisions, and delivering platform features you have requested

5. How we store and protect your information

We use reputable cloud providers with industry-standard security practices.

We take steps to protect your information, including:

• Encryption in transit (TLS/HTTPS)
• Encryption at rest
• Restricted internal access controls
• Tenant isolation - your organisation's data is logically separated from other customers
• Row-level security in our database ensuring data access is scoped to your organisation

5.1 Data retention

We retain different types of data for different periods:

• Decision content - retained for the duration of your subscription, plus 30 days after termination to allow for data export
• Telemetry events (raw) - retained for 90 days, then deleted
• Aggregated metrics (hourly) - retained for 1 year
• Aggregated metrics (daily) - retained for 2 years
• Marketing and communications data - retained until you unsubscribe or request deletion
• Work email from the CLI share prompt - if you do not confirm it, deleted 30 days after the last confirmation email (or after you gave it, if we sent none). If you confirm, kept until you unsubscribe or ask for erasure, and deleted 30 days after you unsubscribe. Afterwards we keep only keyed hashes, so that we do not email you again (see section 2.6).

Aggregated metrics are anonymised summaries that do not contain individual decision content.

6. Sharing your information

We may share information with trusted third-party providers such as:

• Payment processors (Stripe) for billing and subscription management
• Email delivery services
• Cloud hosting providers (for infrastructure)
• AI/LLM providers (for decision extraction and analysis)
• Analytics tools

These providers process information only on our behalf and are bound by data processing agreements.

We do not sell or share your information with advertisers.

We may disclose information if required by law.

7. International transfers

As a UK-based company using global cloud services, your information may be processed outside the UK/EU. We ensure appropriate safeguards are in place for international transfers.

8. AI processing

Align uses artificial intelligence to help extract and analyse engineering decisions. This includes:

• Decision extraction - AI analyses messages and documents to identify and structure decisions
• Relationship detection - AI suggests connections between related decisions
• Conflict detection - AI identifies potentially conflicting decisions
• Ambiguity detection - AI flags vague language that may need clarification

AI-generated suggestions are always presented for your review. You can accept, edit, or reject any AI suggestion. We use your feedback (acceptances, edits, rejections) to improve AI accuracy over time.

Decision content may be processed by third-party AI providers. We select providers with appropriate data protection commitments and do not permit them to use your data to train their models, as specified in our data processing agreements.

9. Your rights (UK/EU users)

You have the right to:

• Access your data
• Correct inaccurate data
• Request deletion
• Object to processing
• Withdraw consent (for email updates), including with the unsubscribe link in any email we send
• Ask us to remove or change text in a shared decision that names you
• Request a copy of your decisions in a portable format

To exercise any rights, contact [email protected].

10. Children's privacy

Our website and services are not intended for individuals under 16.

We do not knowingly collect information from children.

11. Links to other websites

Our website may contain links to third-party resources (e.g., the Align whitepaper). We are not responsible for the privacy practices of those websites.

12. Changes to this policy

We may update this Privacy Policy from time to time.

The "Last updated" date at the top reflects the latest version.

Your continued use of the website or services constitutes acceptance of any changes.

13. Contact us

If you have questions about this Privacy Policy or how we use your data, contact:

[email protected]