Privacy Policy

Last updated: September 20, 2026

At Aluma (aluma.lat), we respect your privacy. This Policy explains what personal data we process, why we process it, who we share it with, and what rights you have. By using the Platform, you accept the practices described here.

1. Data controller

The data controller is the owner of Aluma. If you have any questions about your data, email us at hola@aluma.lat.

2. What data we collect

Registration and account data: your name, email address, password (encrypted) and your academy’s details.
Payment data: the data needed to process payments is handled by the payment provider (for example, Mercado Pago). Aluma does not store full card numbers.
Usage data: your activity within the Platform (courses, progress, community messages) and technical data such as your IP address, device and browser.
Contacts and leads: the data that Creators upload or collect from their prospects (name, email, phone number). The Creator is responsible for having obtained that data lawfully.
Cookies: we use technical cookies that are necessary for the Platform to work and to keep your session.

3. How we use your data

To provide and maintain the service (creating your academy, your courses and your community).
To process payments and subscriptions.
To send operational communications (account and security notices) and, if you opt in, news and updates.
To improve the Platform, prevent fraud and comply with legal obligations.

4. AI features

Some features use artificial intelligence from third-party providers (for example, Google) to generate text, summaries and quizzes, or to answer questions within a course. To do this, the content needed (for example, the text of a lesson or your question) is sent to the AI provider to obtain the response. We do not use that data for any purpose other than providing the feature you requested.

4.1. Instagram (Meta) data

If a Creator connects their Instagram professional account to AluChat using “Connect with Instagram” (Instagram Login; labeled “Conectar con Instagram” in the app), Aluma accesses the following, with the Creator’s authorization and only for the features they turn on:

Profile of the connected account (instagram_business_basic permission): account ID, username and profile name. We use them to show which account is connected and to associate messages with the right community.
Direct messages (instagram_business_manage_messages permission): the text and date of the messages people send to that account, the ID and display name of the sender, and the replies sent.

We use this data only to show the messages in the Creator’s AluChat inbox, let them reply and, if they turn on the “The agent replies on its own” switch (labeled “El agente contesta solo” in the app), send an automatic reply drafted by an artificial intelligence assistant. In that case, the text of the conversation needed to reply is sent to Google (Gemini) to generate the response, subject to Google’s terms. The Creator can ask that the first automatic reply in each conversation state that it is automated, and can take over any conversation and reply manually at any time (the assistant then stops replying).

We only reply to people who wrote to the account first, and within the 24-hour window set by Meta. We do not send unsolicited messages or advertising, we do not sell or transfer Instagram data, we do not use it for advertising or to train our own models, and we do not share it with third parties other than the providers listed in section 5. We do not store images, videos or file URLs from Instagram.

Retention and deletion. Conversations are kept in the Creator’s inbox for as long as their community exists, unless deletion is requested. The Creator can disconnect their account at any time from AluChat → Channels → “Disconnect” (labeled “Canales” and “Desconectar” in the app), which deletes the stored access token. Anyone can request deletion of their Instagram data by following the instructions at aluma.lat/eliminar-datos; we also automatically process the deletion requests and “remove app” notices that Instagram sends us.

5. Who we share data with

We do not sell your personal data. We share it only with providers that help us operate the service, acting as data processors, including:

Supabase — database and authentication.
Vercel — application hosting.
Mercado Pago — payment processing.
Backblaze B2 — hosting of course videos.
Cloudflare — delivery of those videos (content delivery network).
Google (Gemini) — artificial intelligence features.
Resend — email delivery.

We may also share data when required by law or to protect legitimate rights.

6. International transfers

Some of these providers host data outside Argentina. In those cases, we seek to ensure that adequate safeguards are in place, in accordance with applicable law.

7. Retention

We keep your data while your account is active and for as long as necessary to meet legal, accounting or dispute-resolution purposes. After that, we delete or anonymize it.

8. Security

We apply reasonable technical and organizational measures to protect your data (password encryption, database-level access control, secure connections). No system is 100% infallible, but we work to minimize risks.

9. Your rights

Under Argentina’s Personal Data Protection Law No. 25,326 (Ley 25.326), you have the right to access, rectify, update and delete your data, and to object to certain processing. You can exercise these rights by emailing hola@aluma.lat. The Agency for Access to Public Information (Agencia de Acceso a la Información Pública, AAIP) is the supervisory authority in Argentina.

How to delete your account yourself: sign in, go to Settings (“Ajustes” in the app) and select “Delete my account” (“Borrar mi cuenta” in the app). You will be asked to confirm by typing “BORRAR”, and to enter the 2-step verification code if you have it turned on. Once you confirm, we immediately delete your access, your community posts and comments, your enrollments and memberships, your progress, your chat and your notifications. We keep only your email and name in our internal contact records, marked as “unsubscribed,” to comply with accounting and legal obligations and to avoid contacting you again by mistake — they are never used for any other purpose. If your account owns an academy with courses (you are a Creator), we delete that account ourselves at your request: email hola@aluma.lat so that we can close it first.

9.1. California residents (CCPA / CPRA)

If you are a California (U.S.) resident, you have the right to: (a) know what personal information we collect and why; (b) request its deletion; (c) request its correction; and (d) not be discriminated against for exercising these rights. We do not sell your personal information or share it for third-party advertising purposes, so we do not offer a “Do Not Sell/Share” option, because we do not engage in those practices. To exercise your rights, email us at hola@aluma.lat.

9.2. Emails and communications

You may receive operational emails (necessary for your account) and, if you have opted in, marketing communications. Every marketing email includes an unsubscribe link, and you can stop receiving them at any time. We comply with applicable anti-spam rules (including the U.S. CAN-SPAM Act).

10. Minors

The Platform is intended for adults. If we detect data from minors without proper authorization, we will delete it.

11. Changes to this Policy

We may update this Policy. We will publish the current version with its date. Continued use of the Platform means you accept the changes.

12. Contact

If you have any questions about your data, email us at hola@aluma.lat.