Privacy Policy

Last updated: 9 September 2026

1. Who we are

Alito is operated by Lenox Tech 541 LLC, DBA Alito ("Alito", "we", "us"). This policy explains what personal data we collect, why, how long we keep it, who it is shared with, and how you can have it removed. It covers the Alito web application at app.alito.co.

2. Data we collect

Category	What it includes	Why we need it
Account data	Email address, display name, and any profile details you enter	To identify your account and sign you in
Google Workspace data	See section 3	To provide calendar features you explicitly connect
Content you create	Notes, tasks, bookmarks, files and similar items you add	To store and display them back to you
Technical data	IP address, browser and operating system, timestamps of requests	Security, abuse prevention, and diagnosing faults

We do not knowingly collect data from children under 13.

3. Google user data

Alito can connect to your Google Account only after you grant permission on Google's own consent screen. You can decline, and you can revoke access at any time (section 7). We request the narrowest scopes that make the features work:

Scope	What it permits	What Alito does with it
`calendar.readonly`	Read calendars and events	Displays your existing events so scheduling features can show real availability (requested only in full-access mode)
`calendar.events`	Read and write events on all your calendars	Creates and updates events you ask Alito to create, such as a confirmed booking (requested only in full-access mode)
`calendar.freebusy`	Read free/busy times only	Determines when you are free, without reading event details
`calendar.app.created`	Create secondary calendars, and see and change events only on calendars Alito created	Creates one calendar named "Alito bookings" and puts confirmed bookings on it (requested only in privacy mode)
`gmail.send`	Send mail as you. It cannot read your mail.	Sends only messages you explicitly ask Alito to send on your behalf

How Google data is stored

OAuth tokens are encrypted at rest. Calendar data is cached only to render the features above and is refreshed from Google rather than treated as a permanent archive. Google data is never used to build advertising profiles, and it is never sold.

Limited Use disclosure

Alito's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we do not use Google user data for advertising, we do not sell it, we do not transfer it except as necessary to provide or improve the features you requested, to comply with applicable law, or as part of a merger or acquisition, and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.

4. How we use your data

To provide the features you asked for and keep your account working
To send service messages such as sign-in links and notifications you enabled
To keep the service secure and investigate abuse
To diagnose faults and improve reliability

We do not sell personal data, and we do not use it for advertising.

5. Sharing

We share data only in these cases:

Infrastructure providers who operate the service on our behalf — hosting, database and email delivery — under contract and only to run Alito
When you direct us to, such as sending a message or creating a calendar event
When legally required, or to protect the rights and safety of users

6. Retention

We keep your account and the content you create for as long as your account is open. Ask us to delete it and we will.

Google OAuth tokens are deleted when you disconnect the integration — the stored credential row is removed, not merely marked inactive.

We are deliberately not publishing specific retention periods for logs and backups yet. We would rather say nothing than commit to a number we have not verified we meet. When those periods are settled and enforced, they will appear here.

7. Your choices and rights

You can, at any time:

Disconnect Google inside Alito, or revoke access directly at myaccount.google.com/permissions. Revoking at Google immediately stops all further access.
Access, correct, export or delete your personal data.
Object to processing, where that right applies to you.

To exercise any of these, email privacy@alito.co. Depending on where you live, you may also have the right to complain to your local data protection authority.

8. Security

Data is transmitted over TLS. Sensitive fields, including OAuth tokens and personal identifiers, are encrypted at rest. Administrative access to production is restricted to an allow-list of network addresses. No system is perfectly secure, and we do not claim otherwise.

9. Cookies

We use cookies to keep you signed in and to remember basic preferences. We do not use third-party advertising cookies. Blocking cookies will prevent sign-in from working.

10. International transfers

Alito is operated from the United States. If you use the service from elsewhere, your data is processed in the United States.

11. Changes

We may update this policy. Material changes will be reflected in the "last updated" date above, and significant changes affecting how Google user data is handled will be notified to affected users.

12. Contact

Questions about this policy or about your data: privacy@alito.co

Lenox Tech 541 LLC, DBA Alito — United States