Alma

Privacy Notice

Last updated: 24 July 2026

This notice explains how Alma handles personal data about candidates, agency and recruiter users, people who make access or enterprise enquiries, and people whose professional contact details appear in permissioned contact imports or public-source research.

1. Who is responsible for your data

Switchcase Labs LLC, a Delaware limited liability company, operates Alma and is the controller where it determines why and how the personal data described in this notice is used. Privacy questions and rights requests can be sent to privacy@heyalma.work.

2. What we collect

• Account and security data. Your name, email address, account credentials, sign-in and session records, IP address, and browser or device information. Alma uses strictly necessary browser storage to keep you signed in and to return you to the correct invitation or activation step.
• Access and interest requests. The contact details, request type, organisation, team, role, scope, and free-text context submitted by candidates, agencies, recruiters, or people expressing enterprise interest. An enterprise enquiry does not create an enterprise workspace or live enterprise service.
• Candidate career and profile data. CV details, work history, skills, goals, preferences, constraints, applications, conversation content, corrections, and Alma's derived summaries, facts, rankings, and recommendations.
• Agency and recruiter data. Firm, desk, mandate, client and team information; questions and criteria supplied by an authorised user; candidate context made available under the applicable candidate permission; and the reasons, evidence, actions, and outcomes associated with human-led candidate review.
• Voice sessions. When realtime voice is used, a specialist AI voice service processes the live audio together with the instructions and context needed to conduct the conversation, which may include career profile, role, research, and prior-session context. Alma does not keep an audio recording, but it currently stores full turn-by-turn text, including your words, Alma's replies, and text prepared by the assistant for a voice turn that may not have been played if the turn was interrupted, as well as summaries, timing, and usage information.
• Payment and subscription data. A third-party payment processor handles candidate checkout, payment, and full card details. Alma does not store your full card number, but it stores the customer, subscription, plan, currency, usage, invoice, and transaction records needed to operate and account for the service. Agency and recruiter arrangements may instead be governed by a negotiated subscription, order, or invoice.
• Optional contact imports. Where a connected address-book import is offered and you choose to use it, Alma may receive names, work email addresses, organisations, roles, connection permissions, and import metadata. Alma does not read email bodies or send messages from your account.
• Public professional information. Company and role research can include identifiable professional information about recruiters, hiring managers, and other company representatives, such as their public name, role, and business contact details, together with source and retrieval information.

Alma serves public-page font files from its own application assets. Hosting and security services still receive the standard connection data needed to deliver the site and prevent abuse.

3. Why we process it

• Contract and steps before a contract. To assess access requests, run candidate accounts and authorised agency or recruiter workspaces, provide voice and text advice, research and recommendations, and administer applicable subscriptions and usage limits.
• Legitimate interests. To secure Alma, prevent abuse, review access and enterprise enquiries, operate human-led candidate and role discovery, maintain service quality, and understand whether the service is working, balanced against the rights of the people concerned.
• Consent or another specific permission where required. For an optional contact import or candidate-controlled disclosure where the relevant flow asks for that choice. You can withdraw a consent-based choice without affecting earlier lawful processing.
• Legal obligations and legal claims. To keep required financial records, respond to lawful requests, and establish, exercise, or defend legal rights.

4. Who receives it

We do not sell personal data. Depending on the feature you use, recipients can include:

• Candidates, agencies, and recruiters - only within the applicable account, mandate, permission, and human-review boundary.
• AI and voice service providers - the prompts, live audio, and relevant career, role, research, and conversation context needed to provide the feature you request.
• Payment and fraud-prevention providers - candidate checkout, payment, subscription, invoice, and transaction-risk processing.
• Communications, security, and service-monitoring providers - the account, message, device, request, or diagnostic data needed to deliver communications, prevent abuse, and maintain the service.
• Connected-service and security providers - information needed for an optional address-book connection you choose, or standard connection data needed to secure public access and prevent abuse.
• Hosting and data-storage providers - information needed to host and operate Alma and securely store its records.
• Professional advisers, authorities, or counterparties - where reasonably necessary for legal obligations, claims, security, or a corporate transaction.

These recipients do not all have the same legal role. Providers that process personal data for us are required to protect it and use it only for the agreed service; recipients acting independently remain responsible for their own use of the data.

5. International transfers

Switchcase Labs LLC is a United States controller, so personal data may be processed in the United States as well as in the countries where relevant service providers operate. Where UK or EEA law treats a transfer as restricted, we use the safeguard applicable to that transfer, such as an adequacy decision, approved standard contractual clauses with the UK Addendum, or the UK International Data Transfer Agreement. Contact privacy@heyalma.work for current information about the categories of recipients, destinations, and transfer arrangements relevant to your use of Alma.

6. How long we keep it

Alma currently keeps account, profile, agency or recruiter workspace information, and the full text of voice conversations while the relevant account or service relationship remains active and for as long as needed to operate, secure, and evidence the service. Billing, dispute, security, and legal records may be kept for a different period where required or justified.

Alma does not yet provide an end-to-end self-service deletion tool, and no automatic schedule currently deletes voice-conversation text after seven or thirty days. You can make a rights request now at privacy@heyalma.work. We will assess the request and any lawful exception, address the relevant copies held by Alma and its service providers, and confirm completion only after the outcome has been verified.

7. Your rights

Your applicable privacy and data protection rights depend on where you live and the circumstances and lawful basis of the processing. They may include:

• Access - asking for a copy of personal data we hold about you.
• Rectification - having inaccurate or incomplete data corrected.
• Erasure - asking us to delete data where the right applies.
• Portability - receiving eligible data in a machine-readable format.
• Restriction - asking us to limit eligible processing.
• Objection - objecting to processing based on legitimate interests.
• Withdrawal - withdrawing consent where consent is the basis.

Send a request to privacy@heyalma.work. We respond within the period required by the law that applies to your request, subject to permitted identity checks or extensions. If you are in the United Kingdom, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. Elsewhere, you may also have the right to complain to your local privacy or data protection authority.

8. Security

We use technical and organisational safeguards designed to protect personal data, including access controls appropriate to the service and limits on operational access. No system is perfectly secure. We notify the relevant authority or affected people when the applicable legal risk threshold requires it.

9. Age requirement

Alma is for adults aged 18 or over.

10. Changes to this notice

If we make a material change, we will update this notice and use an appropriate account, email, or product notice where required. The date at the top identifies this version.

11. Contact

Privacy questions and rights requests: privacy@heyalma.work. General support: support@heyalma.work.