Privacy Policy

Last updated 29 October 2026.

1. Who we are

Alibi is provided by Engrow Entropy Growth Ltd, a company registered in Cyprus with number HE470686, at Methonis 1, 5th Floor, Nicosia 1070, Cyprus ("Entropy", "we", "us").

We are the controller of the personal data described in sections 2 and 4: data about the people who use Alibi, pay for it or contact us.

We are a processor for the data Alibi reads from our customers' tools (section 3). For that data, the customer is the controller, its own privacy notice applies, and our Data Processing Agreement governs what we do.

Contact us at info@useentropy.com about anything in this policy.

2. What we collect about the people who use Alibi

  • Account data: name, work email, organization and workspace names, role, time zone

    Why we use it
    To create and run your account
    Legal basis
    Performing our contract with your organization

  • Sign-in data: one-time sign-in links and session tokens (both stored only as hashes), sign-in times

    Why we use it
    To sign you in and keep your account secure
    Legal basis
    Contract; our legitimate interest in security

  • Agent and connection data: agent names, token details (never the token itself), Composio project ids, Composio keys (encrypted)

    Why we use it
    To connect your agents and tools
    Legal basis
    Contract

  • Billing data: plan, invoices, billing contact, billing country, VAT number, Stripe customer and subscription ids

    Why we use it
    To charge for paid plans and keep tax records
    Legal basis
    Contract; legal obligation

  • Technical data: IP addresses (kept only as a keyed hash in our own systems; our host's request logs keep them for 30 days), service logs without secrets or record content

    Why we use it
    To keep the Service working and stop abuse
    Legal basis
    Our legitimate interest in security and reliability

  • Email data: digest settings, unsubscribe status, delivery status

    Why we use it
    To send sign-in links and digests you asked for
    Legal basis
    Contract; our legitimate interest in sending only what you asked for

  • Support messages

    Why we use it
    To answer you
    Legal basis
    Our legitimate interest in answering questions about Alibi

Stripe collects card details directly. We never see or store full card numbers.

You need to give us your email address to use Alibi. Without it we cannot sign you in. If a colleague invites you, we get your address from them.

3. Data we process for our customers

When a customer connects a Composio project, Alibi reads the project's tool execution logs and keeps a record of them for that customer. The record can include:

  • the tool and action used, the time, and whether it succeeded;
  • the records an action touched: their ids, links, and names or titles;
  • the names of the fields written, with fingerprints of the values rather than the values;
  • who acted: agent names and the identifiers of people in the connected tools, with email addresses stored as keyed references;
  • the inputs and outputs of each tool call, after Alibi removes secrets and replaces free text, such as email bodies, documents and notes, with fingerprints. What remains is encrypted with that customer's own key, and personal details such as email addresses get an extra key per person, so they can be erased;
  • the goals agents declare, scrubbed and encrypted with that customer's key, and the questions people save in Ask.

This record can include personal data about the customer's staff and about people in its tools, such as its own customers and contacts. If you are one of those people, contact the organization that uses Alibi first. We help it answer your request.

4. Our website and cookies

We use three cookies, all for the app itself. One keeps you signed in, one remembers the last workspace you opened, and one remembers the theme you chose. The app also saves your keyboard shortcut setting in your browser. We do not use analytics, advertising or tracking cookies.

5. Automated decisions

Alibi makes no decisions about people that have legal or similarly significant effects.

6. Who we share data with

  • Our sub-processors, the companies that host and run Alibi for us. The current list is on our sub-processors page.
  • Professional advisers, such as accountants and lawyers, under a duty of confidentiality.
  • Authorities, when the law requires it.
  • A buyer or successor of the Alibi business, who must keep this policy's protections. We will tell you before that happens.

We do not sell personal data.

7. Where data is stored and transfers

Alibi stores its data in the EU: the database in Frankfurt, Germany, and the services in the Netherlands. The exception is copies of the emails we send, which Resend keeps in the United States for 30 days.

Some providers process data in the United States: Resend for email, Stripe's group for payments, Anthropic only for workspaces that turn on AI answers in Ask, and Voyage AI once we turn on improved search. Railway, Neon and Amazon Web Services are US companies, so the same safeguards cover any access to the data from outside the EU. These transfers rely on the EU Standard Contractual Clauses, or on the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for a copy of these safeguards.

8. How long we keep data

  • Account, agent and connection data

    While the account is open, then deleted within 60 days of closing it

  • Customer records (section 3)

    While the account is open. The plan sets how much history people can see; Alibi keeps the full record until the account closes, then deletes it within 60 days, including from backups

  • Billing records

    As long as Cyprus tax and accounting law requires

  • Service logs, which carry no secrets or record content

    30 days

  • Email delivery records held by Resend

    30 days

  • Support messages

    Up to 2 years after the last message

9. Your rights

You can ask us to give you a copy of your personal data, correct it, delete it, limit how we use it, or send it to you in a portable format. You can object to processing based on our legitimate interests. Email info@useentropy.com, and we will answer within one month.

You can also complain to the Commissioner for Personal Data Protection in Cyprus, or to the data protection authority where you live or work.

10. Security

  • Data is encrypted in transit and at rest.
  • Each customer's tool payloads and goals are encrypted with a key of its own, held in AWS Key Management Service. Composio keys are encrypted with a separate platform key, also held there.
  • The database keeps each customer's data apart at the row level, and the application cannot switch that off.
  • Alibi tests each Composio key when it is added and refuses one that can list connected accounts.
  • The record of actions is hash-chained, so changes to it can be detected.

11. Children

Alibi is a business tool and is not meant for anyone under 18.

12. Changes to this policy

We post changes on this page and update the date at the top. We email account owners about material changes before they take effect.

13. Contact

Engrow Entropy Growth Ltd, Methonis 1, 5th Floor, Nicosia 1070, Cyprus. Email: info@useentropy.com.