Privacy Policy | Alumbra AI

Alumbra Solutions LLC

Last Updated: October 20, 2026

Alumbra Solutions LLC ("Alumbra," "we," "us," or "our"), a North Carolina limited liability company with offices at 101 S Tryon Street, Suite 2700, Charlotte, NC 28280, respects your privacy. This Privacy Policy (the "Policy") explains how we collect, use, disclose, and safeguard personal information when you use our websites, mobile and desktop applications, APIs, and related products and services (collectively, the "Services"), including our text-message and WhatsApp-based scam prevention product, Inkling ("Inkling"), and our enterprise AI offering, GuideCode ("GuideCode"), including interactive learning content we deliver through the TalentLMS learning platform ("GuideCode Learning").

By accessing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use the Services.

1. Scope of This Policy

This Policy applies to personal information we collect from or about individuals who interact with the Services. It does not apply to information collected by any third party, including any third-party website, application, or service that you access through the Services or that you connect to the Services. We encourage you to review the privacy policies of any third parties before providing them with personal information.

The Services are intended for users located in the United States. If you access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with local laws.

Information we process for business customers. When we provide GuideCode to an organization under a separate agreement (a "Customer Agreement"), we may process personal information contained in that organization's data, systems, and AI environments on its behalf and at its direction, as its service provider or processor. That processing is governed by the Customer Agreement, and the organization's own privacy notice explains how it handles that information; if your information is in an organization's data, please direct privacy questions and requests to that organization. This Policy covers how we handle GuideCode Learning account and activity information and information about our business contacts. If you enroll in GuideCode Learning on your own, rather than through an organization, we handle your information as described in this Policy, and no organization receives it.

2. Information We Collect

We collect the categories of personal information described below. The specific information we collect depends on how you interact with the Services.

2.1 Information You Provide Directly

Account Information. When you enroll in GuideCode Learning, we collect your name, email address, password (stored in hashed form by our learning platform provider), and optional profile details such as a photo, language, and time zone; if an organization sponsors your access, it or we may provide your name, email address, and group to create your account. When you activate Inkling using a passcode provided by your financial institution, we collect your mobile phone number or WhatsApp identifier, the issuing financial institution's identifier, and timestamps associated with your activation. If we make account creation or paid features available for Inkling in the future, we will collect the information described in this Section and in the Payment Information bullet, and we will update this Policy as required.
Payment Information. When you purchase a paid subscription or feature, we collect billing details necessary to process your payment, including your name, billing address, and the last four digits of your payment card. Full payment card numbers and related financial credentials are collected and processed directly by our third-party payment processor (such as Stripe) and are not stored on our systems.
Messages You Submit to Inkling. To analyze potential scams, you may submit text messages, WhatsApp messages, or screenshots of suspicious messages to Inkling. When you submit content, our systems are designed to remove your personal information (such as names, account numbers, email addresses, and other personally identifiable information) from the content. We do not durably store your submissions in a form that identifies you. Submitted content may be processed transiently, including any identifying details it contains, only as necessary to perform the analysis you requested, after which we do not retain it in identifiable form. Only de-identified content is used to generate your scam analysis, and only aggregated, de-identified data is retained for service improvement and model training. You should only submit messages or screenshots that you are authorized to share with us.
Scam Reporting Portal Activity. Inkling provides a link to a web portal where you may report suspected scams in greater detail and access educational resources. When you use the portal, we collect the information you choose to submit through the reporting forms (which should not include unnecessary personal information about you or third parties) and information about your interactions with the educational content.
GuideCode Learning Activity. When you use GuideCode Learning, we collect your course and module enrollments, progress, time spent, completion status, assessment answers and scores, assignment and survey submissions, certificates, and login dates and times.
Business Contact Information. If you represent a current or prospective GuideCode customer or partner, or sign up for GuideCode updates or a pilot program, we collect your name, title, organization, email address, and the content of your communications with us.
Communications. If you contact us for support, provide feedback, or otherwise communicate with us, we collect the content of those communications and any information you choose to include.

2.2 Information Collected Automatically

When you use the Services, we and our service providers automatically collect certain information about your device and your interactions with the Services. We use minimal tracking technologies and do not use third-party advertising, marketing, or social media tracking pixels. The information we collect automatically includes:

Device and Technical Information. IP address, device type and identifier, operating system, browser type, language preferences, and similar technical information.
Usage Information. Information about how you use the Services, such as the pages or screens you view, the features you use, the dates and times of your access, and your interactions with content.

2.3 Cookies and Similar Technologies

We use a limited set of cookies that are strictly necessary to operate the Services. These cookies are placed by our website hosting platform and support core functions such as maintaining your authenticated session, protecting against fraud and unauthorized access, ensuring site security and stability, remembering your preferences, and measuring basic site performance (such as page load reliability). These cookies do not identify you individually for marketing purposes, and we do not use them, or any other cookies, for advertising, behavioral profiling, or cross-site tracking. Our GuideCode Learning platform, TalentLMS, sets its own cookies needed for login and session functionality; please see the TalentLMS privacy policy for details.

2.4 Information from Third Parties

We may receive information about you from third parties, such as our payment processor (to confirm transactions), identity verification providers, anti-fraud and security providers, and any third-party service you choose to connect to your account (for example, an AI model provider or data source connected to a GuideCode tool). If an organization sponsors your GuideCode Learning access, we may also receive your name, email address, and group from that organization so we can enroll you.

3. How We Use Personal Information

We use personal information for the following purposes:

Providing the Services. To create and maintain your account, deliver Inkling and GuideCode, administer GuideCode Learning and report learning progress to sponsoring organizations, process transactions, and provide customer support.
Scam Detection and Analysis. To analyze messages and metadata you submit to Inkling in order to identify potential scams, phishing attempts, fraudulent links, and similar threats, and to return detection results and recommendations to you.
Security and Fraud Prevention. To monitor for, detect, investigate, prevent, and respond to security incidents, fraud, abuse, misuse of the Services, and violations of our terms or applicable law.
Improving and Developing the Services. To understand how the Services are used, troubleshoot issues, evaluate the effectiveness of our scam detection models and other features, and improve and develop new products, features, and functionality. Where we use information for these purposes, we rely on aggregated, de-identified, or anonymized data wherever practical.
Communications. To send you transactional messages relating to your account, security alerts, scam detection results, service announcements, and responses to your inquiries. We may also send you marketing communications about our products, from which you can opt out at any time.
Legal and Compliance. To comply with our legal obligations, respond to lawful requests from public authorities, enforce our terms, and establish, exercise, or defend legal claims.
AI Model Training. We do not use the content of submissions you make to Inkling, GuideCode customer data or your individual GuideCode Learning responses, or the personal information in your account to train large language models or other AI systems for purposes unrelated to providing and improving the Services to you. We train and improve our scam-prevention and platform models using aggregated, de-identified, or anonymized data, or with appropriate safeguards consistent with this Policy. Where third-party AI models are used to power features of the Services, we contractually require those providers not to use your inputs or outputs to train their own general-purpose models.

4. How We Disclose Personal Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We also do not share mobile opt-in data or consent with any third parties for marketing or promotional purposes (see Section 5.3). We disclose personal information only in the following circumstances:

Service Providers. We share personal information with vendors and service providers who perform functions on our behalf, such as cloud hosting, infrastructure, payment processing (e.g., Stripe), learning management (TalentLMS, operated by Epignosis), customer support, email delivery, security monitoring, analytics for our internal use, and AI model providers that power Service features. These providers are bound by contract to use personal information only to provide services to us and to protect the information appropriately.
Your Sponsoring Organization. If an organization sponsors your GuideCode Learning access, we share your enrollment, progress, completion status, assessment scores, and certificates with that organization, as described in Section 7. If you enroll on your own, we do not share your learning activity with your employer or any other organization, even if you register with a work email address.
At Your Direction. When you direct us to share information with a third party, such as connecting a third-party service or data source to a GuideCode tool, we share personal information as needed to fulfill your request.
Legal Process and Safety. We may disclose personal information when we believe in good faith that disclosure is necessary to (i) comply with applicable law, regulation, legal process, subpoena, or governmental request; (ii) enforce our terms of service or other agreements; (iii) protect the security, integrity, or availability of the Services; or (iv) protect the rights, property, or safety of Alumbra, our users, or others, including in connection with investigating fraud or scams.
Business Transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, personal information may be transferred as part of that transaction, subject to customary confidentiality arrangements.
Aggregated or De-Identified Information. We may share aggregated, de-identified, or anonymized information that cannot reasonably be used to identify you for any lawful purpose.

5. SMS and WhatsApp Messaging

This section describes how text-message (SMS/MMS/RCS) and WhatsApp communications work in connection with the Services. It applies in addition to the other sections of this Policy.

5.1 Consent to Receive Messages

You activate Inkling through an opt-in step: your financial institution provides you with our messaging number, +1 (855) 313-9946, and a passcode, and you send that passcode to the number (by SMS) or to our WhatsApp identifier to activate the Service. Activation enrolls you in the Service and confirms you are authorized to use it through your financial institution.

Each time you send a suspicious message or other content to Inkling, you are requesting a scam analysis and consenting to receive that analysis, and related service notices, by reply message. By activating and using Inkling, you expressly consent to receive these messages from Alumbra at the mobile number or WhatsApp identifier you use.

5.2 Types of Messages

Depending on the Services you use and the consents you provide, you may receive: (i) Inkling messages, including the results of scam analyses you have requested and related service notifications; (ii) transactional or account messages, such as verification codes, security alerts, service updates, and, where applicable, billing notifications relating to a paid Service; and (iii) where you have separately opted in through a distinct action, informational or marketing messages about Alumbra products and features. Consent to receive Inkling messages does not constitute consent to receive marketing messages.

5.3 Mobile Opt-In Data and Consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and consent (including your mobile phone number, WhatsApp identifier, and the fact of your opt-in) are excluded from the categories of personal information that we may disclose to third parties under this Policy. This information will not be shared with any third parties for marketing or promotional purposes, will not be sold or rented, and will not be shared with lead generators. We may share mobile opt-in data only with service providers acting on our behalf and under contract (for example, our messaging platform provider, such as Twilio) solely to deliver messages you have requested, with carriers and platform operators as necessary to transmit messages, and as otherwise required by law.

We do not share your phone number, WhatsApp identifier, or the individual messages you submit to Inkling with your financial institution. Information we provide to financial institutions is limited to the activation and aggregated, de-identified information described in Section 6.

5.4 Message and Data Rates

Message and data rates may apply to any messages sent to you from us and to us from you. The actual rates depend on your wireless carrier or messaging service plan. If you have questions about your text or data plan, please contact your wireless provider. Carriers and messaging platforms are not liable for delayed or undelivered messages.

5.5 How to Opt Out (STOP) and Get Help (HELP)

You can opt out of receiving messages from us at any time. To opt out by SMS, reply STOP, END, QUIT, CANCEL, UNSUBSCRIBE, REVOKE, or OPT OUT to any text message you receive from us. After you opt out, we may send you one final message confirming that your opt-out has been processed, and we will not send you further messages unless you re-activate the Service or re-subscribe. For WhatsApp, you may opt out by following the in-message instructions, by blocking our WhatsApp number, or by contacting us at the address in Section 14. You may continue to receive transactional or service-related messages necessary to provide the Services (such as security alerts) where required to operate your account.

For help with our messaging programs, reply HELP to any text message you receive from us, or contact us at info@alumbraai.com.

5.6 Messages You Forward or Submit to Inkling

Messages that you forward, share, or otherwise submit to Inkling for analysis are treated separately from the outbound messages we send to you. As described in Section 6, our systems are designed to remove your personal information from submitted content, and we do not durably store submissions in a form that identifies you. The processing, use, sharing, and retention of submitted content are described in Section 6.

6. Additional Information About Inkling

Inkling is made available to consumers through their financial institution. Because Inkling involves the submission and automated analysis of suspicious messages, we want to be especially clear about how it works:

How activation works. Your financial institution provides you with our messaging number, +1 (855) 313-9946, and a passcode that you text to activate Inkling. We use the passcode solely to verify that you are authorized to use the Service through that financial institution's program, and your completion of this step is your opt-in to receive messages. We do not receive your account information from the financial institution beyond what is necessary to activate and provide the Service.
The Service is provided through your financial institution. Inkling is currently made available to you at no charge through your financial institution. Using Inkling is not contingent on any purchase, on signing up for alerts or other messages, or on the use of any other Alumbra or financial institution product or service. If we introduce paid features, accounts, or other changes to how the Service is offered, we will describe them and update this Policy as required, and your consent to receive messages will remain separate from, and will not be a condition of, any purchase.
Please minimize personal information in your submissions. Inkling is designed to analyze the structure and content of suspicious messages, not to process your personal information. You should not include your own personal information (such as your full name, account numbers, Social Security number, passwords, login credentials, payment card information, or other sensitive identifiers) in messages or screenshots you submit. Although our systems are designed to remove personal information before retention, the safest approach is not to submit it in the first place. Where practical, you should redact or crop sensitive details from screenshots before sending them to us.
What you can submit and how we handle it. You can text or send screenshots of suspicious messages you have received. Our systems are designed to remove your personally identifiable information (such as names, phone numbers, account numbers, email addresses, addresses, and other identifying details) from the submitted content. We do not durably store your submissions in a form that identifies you. Submitted content, including any identifying details it contains, may be processed transiently only as necessary to perform the analysis you requested, after which we do not retain it in identifiable form. We do not retain the personally identifiable information removed from your submissions.
What we analyze. To assess whether a message is a scam, our systems analyze the characteristics of the suspicious message itself, such as sender patterns, links, and the structure and wording of the message. Some of these characteristics may include identifying details (for example, a sender's number or a link). We analyze these characteristics to generate your result and do not retain them in a form that identifies you after your analysis is complete.
What we return to you. After analysis, we return to you an assessment indicating whether the submitted content is a known scam or exhibits scam indicators or red flags, together with a link to a web portal where you can report the scam in more detail and access educational resources to help you protect yourself from future scams.
Improving the Service and training our models. We use only aggregated, de-identified, and anonymized data (from which personally identifiable information has been removed) to improve Inkling and to train and improve our scam-detection models. We do not use your personally identifiable information for these purposes.
Information shared with your financial institution. We provide your financial institution with information necessary to activate and administer the Service and with anonymized, aggregated information about submissions and scam trends (for example, the volume and categories of scams reported and patterns over time). This information does not identify you, is not tied to your phone number or WhatsApp identifier, and does not include the individual content you submitted. We do not share your individual submissions with your financial institution.
Third parties referenced in your submissions. Submissions may contain information about other individuals, such as the sender of a suspicious message. As described above, our PII-removal process is designed to strip identifying information from submissions, and we do not retain such information in identifiable form after your analysis is complete.
Detection is not a guarantee. Inkling provides automated risk assessments and is not a substitute for your own judgment, your financial institution's fraud-prevention processes, or advice from law enforcement. We do not guarantee that Inkling will identify every scam or that every flagged message is in fact a scam.

7. Additional Information About GuideCode

GuideCode is our offering of governance-first AI agents, tools, training, and support. Most GuideCode services are provided to organizations under a separate Customer Agreement; individuals may also enroll in GuideCode Learning on their own ("Individual Learners"). Individuals whose GuideCode Learning access is provided by an organization are "Sponsored Users."

Customer data. Personal information we access while building, configuring, supporting, or operating GuideCode tools for an organization is processed on that organization's behalf under its Customer Agreement, as described in Section 1.
Customer environments. Many GuideCode tools run in the organization's own AI and cloud accounts. Our personnel may access those environments as administrators, acting only on the organization's instructions. The organization's agreements with its providers govern how those providers handle that data.
Underlying AI providers. Where GuideCode tools run under our own accounts with third-party AI model providers, we contractually require those providers not to use your inputs or outputs to train their own models, except as needed to provide the underlying service to us.
GuideCode Learning platform. We deliver interactive learning content through TalentLMS, a learning management system operated by Epignosis, in a portal we administer. TalentLMS processes learner information as our service provider; its privacy policy describes platform-level practices such as security and cookies.
Sponsored Users. We share with the sponsoring organization your enrollment, progress, completion status, assessment scores, and certificates, so it can track and document training. We do not share your written assignment or survey responses with the organization unless you direct us to do so.
Individual Learners. If you enroll on your own, your learning activity is used only to provide and support your courses, process your purchases, and improve our content (using aggregated, de-identified data). It is not shared with any organization, even if you register with a work email address.
No employment decisions by us. Assessments may be scored automatically. We do not use learning data to make employment or similar decisions about anyone; a sponsoring organization decides how it uses the results it receives.

8. Data Retention

We retain personal information for as long as necessary to provide the Services, fulfill the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. The actual retention period depends on the type of information, the context in which we collected it, and applicable legal requirements.

In general, we retain account information for as long as your account is active and for a reasonable period afterward. For GuideCode Learning, we retain an Individual Learner's account and learning records while the account is active and for 12 months after it is closed, and transaction records for as long as required for tax and accounting purposes; we retain a Sponsored User's records for the duration of the applicable Customer Agreement and then delete or return them as that agreement provides, unless a longer period is required by law. For Inkling, your personally identifiable information contained within messages or screenshots you submit is removed during processing and is not retained. We do not durably store your submissions in a form that identifies you, and we do not retain a record linking your phone number or WhatsApp identifier to the content you submitted. Submitted content may be processed transiently only as necessary to perform your analysis, after which we do not retain it in identifiable form. We retain de-identified content and aggregated scam-trend data for as long as it is useful for scam detection, model training, and trend analysis. We retain records of your consent and any opt-out request for as long as necessary to comply with our legal obligations and carrier requirements and to maintain proof of consent. When personal information collected through other Services is no longer needed, we will delete, de-identify, or anonymize it in accordance with our retention policies.

9. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, and loss. These measures include encryption in transit, access controls, authentication requirements, logging and monitoring, and personnel training. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

10. Your Privacy Rights

Although the Services are offered in the United States, we extend the following privacy rights, modeled on the California Consumer Privacy Act (as amended by the California Privacy Rights Act), to all of our users, regardless of where you reside:

Right to Know / Access. You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclosed it.
Right to Delete. You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (for example, where we are required to retain information for legal or security reasons).
Right to Correct. You have the right to request that we correct inaccurate personal information we maintain about you.
Right to Opt Out of Sales and Sharing. You have the right to opt out of the sale or sharing of personal information. As noted above, we do not sell personal information and we do not share personal information for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information. To the extent we collect sensitive personal information, you have the right to direct us to limit our use of that information to purposes specified by applicable law.
Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.
Right to Appeal. If we deny your request, you may appeal our decision by contacting us at the address below.

How to exercise your rights. You may exercise these rights by emailing us at info@alumbraai.com or by writing to us at the address in Section 14. We will verify your identity before responding to your request, which may require us to ask you to provide information that can be reasonably matched against information we maintain. You may also use an authorized agent to submit a request on your behalf, subject to verification. We will respond within the time frames required by applicable law. Individual Learners in GuideCode may submit requests directly to us. Sponsored Users may submit requests to us or to their sponsoring organization, and we will assist that organization in responding.

Automated decision-making. Inkling uses automated processing, including AI models, to generate risk assessments about messages you submit. These assessments are advisory in nature, and we do not use them to make decisions that produce legal or similarly significant effects on you without human involvement. You may contact us to ask questions about how an automated assessment was generated.

11. Children's Privacy

The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are under 13, please do not use the Services or provide any personal information to us. If we learn that we have collected personal information from a child under 13, we will delete that information promptly. If you believe that a child under 13 has provided personal information to us, please contact us at the address in Section 14.

If you are between the ages of 13 and 17, you may use the Services only with the involvement and consent of a parent or legal guardian.

12. Third-Party Links and Services

The Services may contain links to, or otherwise integrate with, third-party websites, applications, or services that we do not own or control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third parties whose services you use.

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make material changes, we will notify you by posting the updated Policy on our website and updating the "Last Updated" date above, and, where appropriate, by providing additional notice (such as by email or in-Service notification). Your continued use of the Services after the effective date of any updated Policy constitutes your acceptance of the changes.

14. How to Contact Us

If you have any questions, comments, or requests regarding this Policy or our privacy practices, please contact us at:

Alumbra Solutions LLC

101 S Tryon Street, Suite 2700

Charlotte, NC 28280

Email: info@alumbraai.com