Privacy Policy
This policy explains what personal data Allocate collects when you use the service, why we collect it, who we share it with, and the rights you have over it.
1. Who we are
Allocate is a service for booking and managing equipment, used by businesses. It is run by Joakim Svärd, a sole trader (enskild firma) registered in Sweden.
Who is responsible for which data
The law calls the party that decides why and how data is used the controller, and a party that handles data on someone else's instructions the processor.
- We are responsible for your user account and sign-in, billing, support requests, the emails we send for our own purposes (such as account and billing emails) and our security logs. This policy covers that data.
- Your company is responsiblefor the bookings, equipment, team list, roles and invitations inside its workspace. We handle that data on the company's behalf and on its instructions, under our Data Processing Agreement, including sending invitations and notices about team changes for the company. Your company should tell you how it uses that data, and questions about it go to your company first; we help them answer.
Allocate is a tool for businesses. It is not meant for consumers or for children.
2. What we collect
We collect the data described below, for the purposes in section 3.
Card details never reach us.You enter them on Stripe's own checkout page. We never receive full card numbers or security codes, but Stripe sends us payment and subscription details, such as amounts, status and dates.
Free text is up to you. Booking notes, project names, role names and descriptions, and support messages can hold anything you type. Please do not enter sensitive personal data there, such as health information, or information about criminal offences.
Invited people.If a colleague invites you, your company gives us your email address and we send the invitation on the company's behalf. The invitation email tells you who invited you and links to this policy.
3. Why we use it, and on what legal basis
Every use below has a legal basis under Article 6 of the GDPR. Where we rely on legitimate interests, we name the interest, and you have the right to object (section 6). You can contact us for more information about these interests.
We do not sell your data or make automated decisions with legal or similar effects on you.
Customer references. As the Terms of Service allow, we may name a customer company and show its logo as a customer of Allocate (legitimate interests, 6.1 f: showing who uses Allocate). If the customer is a sole trader, its name is personal data. Any customer can ask us to stop at support@allocate.at.
4. Who we share it with
We use five providers to run Allocate. Each has a data processing agreement with us, and none may use your data for its own purposes except where stated. Stripe and Resend are also independent controllers for some data, as described below.
Stripe has two roles.It processes payments for us. It also acts as an independent controller for its own legal duties, such as fraud prevention and anti-money-laundering checks. Stripe's privacy policy covers that part. When you subscribe, you are sent to Stripe's own pages, where Stripe's cookies apply.
Resend is an independent controller for some data.Resend processes our emails on our behalf, but it is itself responsible for a few things, such as delivery data and protecting its service against misuse. This is described in Resend's own data processing terms.
Transfers outside the EU/EEA.Google LLC (including email through Google Workspace), Stripe, LLC and Resend process some data in the United States. These transfers rely on the EU Commission's Standard Contractual Clauses in each provider's data processing agreement, and also on the EU-U.S. Data Privacy Framework for providers certified under it. You can ask us for a copy of the safeguards at privacy@allocate.at.
Inside your company.Only admins can see members' email addresses. Admins, and members who have been given team rights, can see the team list with names. Members who can invite people can also see open invitations, including the invited email addresses. Members can see bookings and equipment, including who made a booking, as far as their role allows. A member without the right to see all bookings sees only their own. A member with no role yet cannot see company data. While an invitation is open (7 days), anyone who has the invitation link can see which email address it was sent to.
Our own access. People we authorise to work on Allocate can see customer accounts, team lists and support requests when needed for support, billing or security, and keep short internal notes about customer companies. They are bound by confidentiality. Attempts to sign in to that operator area are logged.
Authorities and advisers. We disclose data to authorities when Swedish or EU law requires it, and to our accountants and lawyers, who are bound by confidentiality, when needed for our bookkeeping or to establish, exercise or defend legal claims. Our providers may be required by the law that applies to them to disclose data; their data processing terms describe how they handle such requests.
5. How long we keep it
We keep data only as long as it is needed, and most of it is deleted automatically. Automatic deletion is done by scheduled jobs, some of which run once a week, so it normally happens within about a week after the time shown, not at the exact moment. A few records are kept for a fixed time to meet legal duties or to show that a deletion happened.
Your account
Your company's data
If we have agreed a different arrangement with a company, the three periods for an ended or missing subscription (after a paid subscription ends, after a trial ends, and for a company that never started) start on the day that arrangement ends, not before. The period for an ended paid subscription (90 days) then applies from that day, and admins get the locked email and the email 7 days before deletion from then. The other rows do not depend on any arrangement. Deletion can also be postponed while we prepare a copy the company has asked for.
When you leave a company or delete your account, your name is removed from the company's bookings and equipment history. Names typed into free text, such as notes and project names, are not searched for and removed. The entries themselves stay with the company, because they are the company's records.
Billing
Support, emails and logs
6. Your rights
You can export, correct and delete your own data yourself in Account settings. For anything else, email privacy@allocate.at. We answer within one month; if a request is complex we may extend that by up to two more months and tell you why. It is free of charge, unless a request is clearly unfounded or excessive.
Export my data covers your own account, memberships (including your role in broad terms), your own bookings and your support tickets. It does not cover other members' bookings or internal support notes. The company's admin can ask us for a copy of the company's data, and you can ask us for anything else we hold about you under Art. 15.
If you are the last admin. You cannot delete your account while other members depend on you as admin. Make someone else admin first, or delete the company.
Data your company controls. Requests about bookings, equipment, team or role data go to your company, which decides. If you send them to us, we pass them on and help your company answer.
When we cannot delete at once. If you ask us to erase data we must keep by law, such as invoices, we tell you why and when it will be deleted.
We may ask you to confirm your identity before we act on an emailed request.
What you must give us. You need to give us your name and email address to have an account; without them we cannot give you access. To subscribe, Stripe needs billing details. Everything else is up to you.
8. Security, changes and contact
Security.Traffic is encrypted, and passwords are stored only as hashes. Access inside a company follows roles, and each company's data is separated from other companies' data by access rules. Deletion and access to the operator area are logged.
Changes to this policy. Each version has a number. For a significant change we tell you in advance, by email or in the app, and ask you to confirm you have read it. Small corrections, such as new contact details, take effect when published.
If Allocate changes owner. Allocate is planned to move from a sole trader to a limited company. If that happens, or if the business is sold, your data moves with the service under the same protections, and we tell you.
Contact. Email privacy@allocate.at, or write to Joakim Svärd, Oxelvägen 13, 138 31 Älta, Sweden.
Version 1.1