Compliance

1. Our approach

1.1 algn is designed to meet its legal obligations by architecture wherever it can. The most personal data (your memory, your conversation history, your voice) is never held on our servers, so it can’t be breached there, disclosed from there or misused there. The design is set out on the Privacy Architecture page.

1.2 Privacy by design and by default (UK and EU GDPR Article 25). Features collect the minimum by default. Optional processing, such as tone and energy, matching on faith and research, is off until you choose it.

1.3 Impact assessments. We carry out data protection impact assessments before launching processing likely to be high risk. We have done so for Sera’s conversation processing, matching in Us, and tone and energy, and we review them when those features change.

2. Data protection

2.1 Laws. UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations as amended by the Data (Use and Access) Act 2025, EU GDPR and the ePrivacy Directive.

2.2 Controller. algn technologies, Whitchurch, RG28 7FA, is the controller of personal data processed through algn. Our lead regulator is the UK Information Commissioner’s Office.

2.3 Privacy contact. Questions about how we handle personal data, and requests to use your rights, go to hi@algn.io with “Privacy” in the subject.

2.4 Records and accountability. We keep a record of processing activities, document the legal basis for each use of data (see the Privacy Policy, section 4), and train everyone with access to personal data.

2.5 Special category data. Conversations with Sera can reveal health and other special category data. We process it only with explicit consent, only in transit, and never for matching.

2.6 Processors. Every provider that processes personal data for us does so under a written contract meeting UK and EU GDPR Article 28. Every provider that handles members’ words or voice works under zero data retention, with no training and no human review.

2.7 International transfers. Transfers outside the UK and EEA are protected by adequacy decisions, the UK International Data Transfer Agreement or Addendum, or EU Standard Contractual Clauses, with transfer risk assessments where required.

2.8 Breaches. We have a documented breach response procedure. We notify the ICO (and other regulators where required) within 72 hours of becoming aware of a reportable breach, and notify affected people without undue delay when there is a high risk to them.

2.9 Rights. Access, correction, deletion, restriction, portability and objection are supported, many of them directly in the app. We respond within one month.

2.10 Cookies and device storage. The website sets no cookies and does no cross-site tracking or fingerprinting. Its analytics store nothing on your device, collect statistics only, and honour Global Privacy Control and Do Not Track. The only things the website keeps in your browser are strictly necessary for features you use, such as your sound setting (see the Privacy Policy, section 14). The app stores data on your device only where strictly necessary for the service you asked for.

3. AI regulation

3.1 EU AI Act.

• Transparency (Article 50). Sera discloses that it is an AI before first use. Synthetic audio carries a machine-readable marker where technically feasible. We inform people before tone and energy, an emotion recognition feature, is used. These duties apply from 2 August 2026.
• Prohibited practices (Article 5). We have assessed algn against every prohibited practice. algn does not use manipulative or deceptive techniques, exploit vulnerabilities, carry out social scoring, or use emotion recognition in workplaces or education.
• Risk classification. algn is not a high-risk AI system under Annex III. We keep that assessment under review.
• AI literacy (Article 4). Everyone who builds or operates algn’s AI systems is trained in how they work and their limits.

3.2 US AI companion laws. Where they apply, we meet California’s SB 243 and New York’s AI companion law: AI disclosure and reminders, a published crisis protocol (see the AI & Safety Notice), crisis referrals, and reporting to state authorities.

4. Online safety

4.1 UK Online Safety Act 2023. Sera on its own falls outside the Act. Us, where members interact, is a user-to-user service. For Us, the social platform, we have:

• carried out an illegal content risk assessment and put proportionate measures in place;
• carried out a children’s access assessment. algn is for adults only and uses age checks at sign-up to prevent children accessing it;
• published clear terms and Community Standards, including safety guidance for meeting in person;
• provided easy ways to report content and complain, and an appeals process; and
• kept records as Ofcom’s codes require.

4.2 EU Digital Services Act. algn is a hosting service and online platform. We provide a single point of contact for authorities and users (hi@algn.io, in English), notice-and-action for illegal content, a statement of reasons for moderation decisions, an internal complaints process and information about out-of-court dispute settlement. Obligations reserved for larger platforms do not currently apply to us.

4.3 Privacy and moderation. Member messages, including in cells, are end-to-end encrypted, and we don’t scan private content. Moderation relies on reports, on content that members choose to share with us, and on content visible to other members.

4.4 Transparency. Each year we publish a transparency report covering reports received, moderation actions taken, appeals and their outcomes, and requests from authorities for member data, with how we responded. The EU Digital Services Act exempts small companies from this duty; we do it anyway.

4.5 Copyright. We run a notice-and-takedown process with counter-notices, set out in the Terms, section 13.4, and close the accounts of repeat infringers.

5. Consumer protection

5.1 In the UK: the Consumer Rights Act 2015, the Consumer Contracts Regulations 2013, and the Digital Markets, Competition and Consumers Act 2024. There are no subscriptions, nothing renews automatically, prices are shown in full before you pay, and our Terms keep your statutory rights intact. EU consumers keep the protection of their national law.

6. United States

6.1 State privacy laws. Whatever our size, we give everyone in the US the rights described in state privacy laws such as the California Consumer Privacy Act: to know, access, correct and delete, and not to be discriminated against. We do not sell or share personal information for cross-context behavioural advertising, and we honour Global Privacy Control.

6.2 Consumer health data. We meet Washington’s My Health My Data Act, Nevada’s SB 370 and similar laws. See the Consumer Health Data Privacy Notice.

6.3 Children. algn is for adults only and is not directed to children. We do not knowingly collect data from anyone under 18, which also covers the under-13 protections of the Children’s Online Privacy Protection Act.

7. Canada and Australia

7.1 Canada. We handle personal information in line with PIPEDA and, for Quebec residents, Law 25, including a named privacy contact, privacy impact assessments before cross-border transfers, and privacy-protective defaults.

7.2 Australia. We handle personal information in line with the Privacy Act 1988 and the Australian Privacy Principles, including APP 8 for overseas disclosure. For Us, the social platform, we take account of the Basic Online Safety Expectations under the Online Safety Act 2021.

8. Security

8.1 Standards. algn uses standard, widely reviewed cryptography only:

• AES-256-GCM encryption for the memory vault on your device, using the browser’s built-in Web Crypto;
• PBKDF2 with SHA-256 to derive backup keys from your passphrase, with AES-256-GCM encryption of the backup file;
• AES-256-GCM with RSA-OAEP key exchange for end-to-end encrypted member messages and voice notes;
• TLS for every connection between your device and our servers, and between our servers and our providers; and
• passkey or device biometric sign-in.

8.2 Operational security. Access to production systems is limited to the people who need it and protected with strong authentication. Data on our servers is encrypted at rest. We monitor our systems continuously, keep dependencies up to date and review code changes before release.

8.3 Open code. The code that holds your vault, manages its keys and deletes your data is published as an open repository, with a data-flow manifest listing every process, the data it receives, the kind of server it goes to and how long anything is kept.

8.4 Certifications. algn does not currently hold SOC 2, ISO 27001 or similar certifications, and we won’t claim otherwise. We describe our actual controls here and on the Privacy Architecture page instead.

8.5 Responsible disclosure. If you find a vulnerability, email hi@algn.io with “Security” in the subject. Please give us reasonable time to fix it before disclosing it, don’t access or change other people’s data beyond what’s needed to show the problem, and don’t disrupt the service. We will acknowledge your report, keep you informed, and credit you if you’d like. We won’t take legal action against good-faith research that follows these guidelines.

9. Accessibility

9.1 We design the website and app to meet WCAG 2.2 at level AA, including colour contrast, keyboard access and screen reader support. If something isn’t accessible to you, tell us at hi@algn.io and we’ll fix it or provide what you need another way.

10. At a glance

11. Contact

11.1 algn technologies, Whitchurch, RG28 7FA. The quickest way to reach us is Report an issue. You can also email hi@algn.io.