Privacy Policy — Alaia Advisory

Alaia Advisory LLC ("Alaia," "we," "us") provides AI-assisted operations and growth consulting to small and mid-sized businesses. This Privacy Policy explains what information we collect from clients and prospective clients, how we use and protect it, and the choices you have.

We work primarily with business data — not consumer data. The policy below covers client businesses, their authorized representatives, and visitors to alaiaadvisory.com.

1. Information we collect

From the website

Contact details you submit through forms (name, business name, email, phone).
Standard request logs (IP address, browser, referring page) for security and diagnostics.

From connected systems (e.g. QuickBooks Online)

When a client authorizes Alaia to connect to a system such as QuickBooks Online, we may access:

Chart of accounts, transactions, invoices, bills, vendors, customers, reports, and related metadata needed to perform the agreed work.
OAuth access and refresh tokens that let us make requests on the client's behalf.

We never ask for, and will not accept, direct QuickBooks Online usernames or passwords.

2. How we use information

To deliver the specific consulting or operations work agreed to in a Statement of Work.
To communicate with the client about that work, scheduling, invoicing, and follow-up.
To diagnose and improve our internal tools and workflows.
To meet tax, accounting, and other legal obligations.

We do not use client data to train public AI models. We do not sell, rent, or trade client data. We do not serve advertising based on client data.

3. How long we keep it

OAuth tokens are stored encrypted and kept only while the client engagement is active. Tokens are revoked and deleted when the engagement ends or upon client request.
Client operational data pulled from connected systems (transaction lists, account snapshots, etc.) is not persisted beyond the active working session unless specifically required by the Statement of Work. Working artifacts that are retained (e.g. prepared reports, reconciliations) are kept in the client's own folder structure.
Operational logs (API requests, errors, and timestamps) are retained for up to 30 days for troubleshooting and then automatically deleted.
Business records (invoices, Statements of Work, signed agreements) are retained for the period required by Hawaii law and IRS rules — typically seven years.

4. Sub-processors

We use a small number of third-party services to deliver our work. Each is bound by their own terms and privacy obligations.

Anthropic, PBC — Claude API, used for AI-assisted analysis and drafting during consulting sessions. Data sent to Claude is subject to Anthropic's commercial terms, which prohibit using customer inputs or outputs to train their models.
Intuit Inc. — QuickBooks Online, the source system when a client authorizes that connection. Intuit is the data controller; we act as a processor for operations the client has authorized.
Lovable — website hosting for alaiaadvisory.com.
Google LLC — Workspace (email, calendar, documents) for routine client communication and file storage.

We do not transfer client data to any party outside this list without prior written consent.

5. How we protect information

Credentials and OAuth tokens are stored encrypted at rest.
Access is limited to authorized Alaia personnel on a need-to-know basis.
Connections to client systems use TLS and, where available, industry-standard OAuth 2.0.
We apply the principle of least privilege: we request only the scopes needed to perform the agreed work.

No system is perfectly secure. If we learn of a breach that materially affects client data, we will notify affected clients promptly and in accordance with applicable law.

6. Your choices and rights

Disconnect any integration at any time. For QuickBooks Online, clients can revoke access from their QBO settings (Apps → Manage My Apps). Upon revocation, the corresponding tokens become unusable and are deleted on our side.
Request a copy of the data we hold about your business.
Request deletion of data we hold that is not required for our legal or tax recordkeeping obligations.
Correct inaccurate information.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

7. Cookies

alaiaadvisory.com uses only the cookies strictly needed to operate the site and the authenticated client portal. We do not use third-party advertising or cross-site tracking cookies.

8. Children's privacy

Alaia does not knowingly collect information from anyone under 18. Our services are directed at businesses.

9. Changes to this policy

We may update this Privacy Policy as our practices evolve. Material changes will be communicated to active clients by email. The "Last updated" date at the top reflects the latest revision.

10. Contact

Alaia Advisory LLC
Honolulu, Hawaii
[email protected]