Privacy Policy

Account information. When you sign in, our authentication provider (Clerk) processes your name, email address, and organization membership so we can create and secure your account.

Firm and vendor data. The information your firm enters into the product, including vendor names, categories, contract and financial details, the flag for whether a vendor touches client nonpublic personal information (NPI), diligence attestations, notes, and any links you add.

Usage and log data. Standard technical logs (IP address, browser, timestamps, error data) used to operate and secure the service.

To provide, secure, and improve the service, authenticate users, maintain your firm's workspace, respond to support requests, and meet legal obligations. We do not sell your data, and we do not use your firm or vendor data to train third-party AI models.

We use a small set of vendors to run the service: Clerk for authentication, and Railway for application hosting and the database. These providers process data on our behalf under their own security and privacy commitments. We will keep a current list available and provide reasonable notice of material changes.

Data is hosted in the United States. We use encryption in transit, access controls, and tenant isolation so that one firm's data is not accessible to another. No method of transmission or storage is perfectly secure, but we work to protect your information using measures appropriate to its sensitivity.

Vendor Advisor is designed to record vendor metadata and oversight documentation, not to store your clients' underlying NPI. Your firm controls what it enters and remains the data controller for that information. You are responsible for ensuring that what you enter is appropriate and permitted under your own client agreements and regulatory obligations.

We retain your data for as long as your workspace is active. On request, or when an account is closed, we will delete or return your firm's data within a reasonable period, except where retention is required by law.

You may access, correct, export, or request deletion of your data by contacting us at privacy@allestechnology.com. We will respond within a reasonable timeframe.

We may update this policy as the product evolves, including as it moves from a free tool for Alles clients to a paid offering. Material changes will be posted here with an updated date.