Privacy Policy

Aliena AI is a project management and resource planning platform operated from the United Kingdom. For the purposes of UK GDPR, Aliena AI acts as a data processor for your organisation's project data, and as a data controller for account and usage data. Contact: privacy@aliena.co.uk

We collect: - Account information: name, email address, job title, organisation - Project data: project details, documents, financial plans, schedules, RAID logs - Usage data: feature usage, page views, session duration (anonymised) - Communication data: emails we send you (approval notifications, invites) We do not collect payment card data directly -- payments are handled by Stripe (PCI DSS compliant).

We use your data to: - Provide and operate the Aliena AI platform - Send approval notifications and system alerts - Improve the product through anonymised usage analytics - Comply with legal obligations We do not sell your data. We do not use your project data to train AI models without explicit consent.

We share data with the following sub-processors: - Supabase (database hosting) -- EU/US, SOC 2 Type II certified - Vercel (application hosting) -- US, SOC 2 Type II certified - OpenAI (AI features) -- US, your data is not used to train models under our enterprise agreement - Resend (email delivery) -- US - Stripe (payments) -- US, PCI DSS compliant All sub-processors are subject to data processing agreements.

We retain your data for as long as your account is active. On account deletion: - Project data is deleted within 30 days - Audit logs are retained for 12 months for compliance purposes - Backup data is purged within 90 days You can request immediate deletion by contacting privacy@aliena.co.uk.

You have the right to: - Access: request a copy of your personal data - Rectification: correct inaccurate data - Erasure: request deletion of your data - Portability: receive your data in a machine-readable format - Restriction: limit how we process your data - Objection: object to processing based on legitimate interests Contact privacy@aliena.co.uk. We will respond within 30 days.

We use only essential cookies required for authentication and session management. We do not use advertising cookies or tracking pixels. Session cookies expire when you close your browser. Authentication tokens expire after 7 days of inactivity.

We implement appropriate technical and organisational measures including encryption at rest (AES-256), encryption in transit (TLS 1.2+), and database-level Row-Level Security policies. See our Security page for full details.

Some sub-processors (Vercel, OpenAI, Resend, Stripe) are based in the United States. Transfers are made under Standard Contractual Clauses (SCCs) as approved by the UK ICO.

We will notify you by email and in-app notification if we make material changes to this policy. Continued use of Aliena AI after notification constitutes acceptance of the updated policy.

Data Controller: Aliena AI Email: privacy@aliena.co.uk Security issues: security@aliena.co.uk If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.