1. The one-line answer
The assistant on your card page cannot access your private data. Its context contains only public information and the current conversation.
2. What it knows
The assistant can use:
- the public introduction, links and avatar on your card page;
- your published intents ("what I'm looking for");
- your declared contact boundaries (which request types you accept, what they must include);
- what the visitor themselves said in the current conversation.
All of this comes from the public page or the visitor.
3. What it does not know
The assistant cannot access your inbox, past requests, private conversations, relationship records, email address, visitor statistics, or detailed filtering rules. The product exposes no read path for these data.
4. Why this design matters
Telling a model to keep data secret is not enough. alink limits the data path first: private account data is not placed in the visitor assistant's context, so prompt injection cannot extract it from that context.
5. Other safeguards
- Output checks: replies are checked against the public-field list. A confirmed violation reduces that card's conversation capability and triggers an alert;
- AI disclosure: every reply carries a non-removable AI label and a "this is not a commitment by the person" footer;
- Visitor privacy: the owner cannot see the transcript. Only a structured request confirmed by the visitor reaches the inbox. Transcripts are encrypted and cleared within 30 days.
6. Full details
The full data-handling commitments are in the Privacy Policy, service boundaries in the Terms of Service; for anything else see the Support page or write to [email protected].