Privacy Policy

Last updated: October 8, 2026

Introduction

Alpacca, operated by Happy Cactus Solutions, LLC ("we," "our," or "us"), describes its information handling practices through this policy when you use our mobile and web applications and related services, including booking pages and the shared time clock.

Information We Collect

Account Information

• Email for account creation and authentication
• If you sign in with Google or Apple, we receive your email address and basic account details from that provider to create and sign you in to your account. Your provider password is never shared with us. Apple lets you share a private relay email address instead of your real one; if you do, that relay address is the email we receive.
• Name and profile information
• Organization and team membership details
• User preferences and settings

Calendar and Activity Data

• Events and activities created in the app
• Calendar entries and scheduling information
• Data synced across devices and accessible to team members as configured

Time Clock (if your organization uses it)

• When you clock in and out, your breaks, and which device recorded each entry. These records are shared with your organization's administrators.
• The PIN you use at a shared time clock is stored encrypted, and in the app only you and the people who manage time cards in your organization can see it.
• When an administrator pairs a shared time clock device, we record that device's IP address for security.
• If your organization lets you clock in from your phone, the app checks your location once each time you clock in, clock out, or start or end a break, and saves it with that entry: where you were, the street and neighborhood your phone names for that spot, how accurate the reading was, and whether your phone reported the location as simulated. To name the street, your phone sends the reading to its own location service (Apple on iPhone, Google on Android). Your organization's administrators can see it. The app never tracks your location in between. Clocking in from your phone needs your location; if you turn it off, you can still clock out or take a break, and that entry is marked as having no location.
• A shared time clock does not collect anyone's location.
• When a manager approves someone's hours for a pay period, we record who approved them, when, and the hours they approved.

Pay (if your organization turns on Labor costs)

• Your organization's owners and admins can record each member's pay: an hourly or daily rate and its history, rates for particular skills, overtime rules, a start date, and an employee number the business assigns.
• We never ask for a government ID number, such as a tax or social security number. The employee number field refuses values shaped like a Mexican RFC, CURP or NSS.
• Pay amounts are stored encrypted. Only people with pay access in your organization, its owners and admins, can see pay, and only while Labor costs is on. Other members don't see it in the app, including their own.
• We keep a record of each time someone views or changes pay, and who did it.
• Labor cost figures are worked out on the device from hours and pay. We don't store them.

Reports and exports

• Reports show data already described in this policy. When you export a report to a spreadsheet, the file is made on your device. Time card and schedule exports are made on our servers and sent to your device. Either way, the file goes wherever you choose to save or send it.

Purchases

• When you buy a plan, we keep a record of the purchase, including the IP address and browser used, to prevent fraud and answer billing questions.

Technical Information

• Device type and operating system version
• App version and performance data
• IP address for security purposes
• Crash logs and error reports
• A device push-notification token, used to deliver notifications you have enabled

Photos and Images (optional)

• You can add a profile photo and photos for your organization and its teams. When you do, we access only the image you select from your photo library or capture with your camera — we do not scan or upload your photo library. The image (as you crop it) is stored on our servers and shown to members of your organization wherever your profile, organization, or team appears.
• You can remove or replace these photos at any time; a removed image immediately stops being shown in the app.

Device Contacts (optional)

• When you choose to add a contact from your device, we access only the specific entries you select. We do not upload or store your entire address book.

Connected Services (optional)

• If you connect a Google Calendar, Alpacca creates its own calendar in your Google account and adds your events to it. We can see and change only the calendars Alpacca creates; we cannot read your other calendars or events. This happens only with your authorization, and you can disconnect it at any time.
• If you create a calendar subscription link, anyone who has that private link can see the events it includes. You can revoke a link at any time.

Information About Other People

Your organization may keep information in Alpacca about people who don't use it: contact details for clients and vendors, roster entries for team members who haven't joined yet, and notes. Guests who book through a booking page give their name and email address, and optionally a phone number and a note; we use these to email them about their booking. A guest booking for several people may also give the other people's names, which we show to the business so it knows who is coming. We don't ask for those people's contact details. The business can mark whether a guest came, and we keep the price of what they booked as it was when they booked.

We handle this information on behalf of the organization that entered or collected it. That organization decides what to keep and is responsible for having the right to share it with us. If you are one of these people and want your information corrected or deleted, contact the organization, or contact us and we will help.

How We Use Your Information

We use collected data to provide app functionality, enable collaboration features, sync data across devices, send notifications you have enabled, process purchases, improve performance, provide customer support, and prevent fraud.

Data Storage and Security

Data is stored on secure cloud servers with industry-standard encryption. Information is encrypted both in transit (HTTPS/TLS) and at rest. We do not sell your personal information to third parties. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Data Sharing

Information is shared within your organization based on your settings, with service providers that support app operations, and when legally required. We do not sell personal data for marketing purposes.

Third-Party Services

We rely on the following third-party providers, each governed by its own privacy policy:

• Google Firebase — authentication (including email/password and sign-in with Google or Apple), analytics, crash and performance reporting, push notifications, remote configuration, and app-integrity checks. On the web, app-integrity checks use Google reCAPTCHA, which collects hardware and software information, such as device and browser data, and sends it to Google for analysis. Google's Privacy Policy and Terms of Service apply to reCAPTCHA.
• Google and Apple sign-in — optional sign-in methods. If you use one, Google or Apple authenticates you under its own privacy policy and shares your email address and basic account details with us.
• Apple App Store and Google Play — process in-app purchases. Your payment details are handled by these stores, not by us; we receive only confirmation of a purchase.
• Paddle — merchant of record for purchases made on our website. Paddle receives your name, email address, billing address, and payment details in order to take the order, calculate any tax, and send your receipt. Your card details are handled by Paddle, not by us.
• Amazon Web Services — sends the app's emails, such as account verification, password resets, and booking confirmations.
• Cloud hosting and monitoring providers, including DigitalOcean — store and serve your data, and help us keep the service running.

Cookies and Local Storage

On the web, we store data in your browser (such as local storage) to keep you signed in and remember your preferences. The web app also uses Google reCAPTCHA, which may set its own cookies to protect sign-in from automated abuse. The web app and our marketing website both use Google Analytics cookies to measure how they are used — which screens and pages people visit, and whether visitors go on to create an account — so we can improve them. In the web app, this is linked to your account ID. We do not use any of this for advertising, and we do not sell it or share it with advertisers.

Your Rights and Choices

You can view and update your profile in the app, and delete your account at any time from the app's settings. You can also ask us for a copy of your personal data, or ask us to correct or delete it, by emailing support@alpacca.app. Your organization's administrators control what members of the organization can see.

Data Retention

• Your account. We keep your account while it is active. When you delete it, your profile and profile photo are deleted permanently right away. Each organization you belonged to keeps your name with its records, so its time cards and pay history still show whose they are.
• Organization content. Content you create inside an organization, such as tasks, messages, and bookings, belongs to that organization and stays with it after you leave or delete your account.
• Pay records. Pay, time card approvals and the record of who viewed or changed pay belong to the organization. They stay after you leave it or delete your account, and are deleted only with the organization.
• Time clock records. Kept for five years, then deleted automatically, because employers often need them under labor law.
• Deleted organizations. When an organization is deleted, its members lose access immediately. Its data is kept until the owner asks us to delete it permanently.
• Some records, such as purchase records, may be kept longer where the law or security requires it.

International Data Transfers

We store and process data in the United States. If you use Alpacca from another country, your data is transferred to the United States. The providers listed above may also process it in other countries.

Children's Privacy

The app is not intended for children under 13.

Changes to This Policy

We may update this policy from time to time. When we make material changes, we will revise the "Last updated" date above and post the new version here. Your continued use of the app after changes take effect constitutes acceptance of the updated policy.

Contact

If you have questions about this policy, contact us:

Email: support@alpacca.app