Privacy policy
This policy explains what personal data Alignd processes, why, where it lives, and what you can ask us to do with it. It covers both this website and the Alignd product used during a pilot or subscription.
Who we are
Alignd is operated by Vasco Machado de Oliveira, as a sole trader based in Portugal. For any privacy question or request, contact vasco.ammo92@gmail.com. We are the controller for website and account data, and the processor for the engagement data your organisation puts into the product.
What we collect
- Contact details you give us — name, work email, company, role, and anything you write in a pilot enquiry form.
- Account data — email address and authentication identifiers when you create an account in the product. We use the address to send invitations and, once a week while a pulse is open and unanswered, a reminder to answer it (at most two a week). Every reminder has a link that stops them.
- Engagement data — project names, the two sides involved, signal values and notes, and — as they are introduced in pilots — weekly pulse answers, review notes and agreed actions.
- Delivery evidence — figures you or your counterparty log about delivery (scope changes, items delivered against plan, releases, days a decision has waited). If you connect GitHub, we also record a weekly count of merged pull requests in the repositories you choose to share. We read nothing else from GitHub: no code, titles or people. If you connect Jira, we record weekly counts of issues resolved and created in your Jira projects, and nothing else: no issue titles, descriptions or people. You can disconnect at any time. Uninstalling the app from GitHub, or removing Alignd from your Atlassian account's connected apps, also stops access.
- Basic technical data — server logs containing IP address, user agent and requested path, kept for security and abuse prevention.
- Product usage events — page views and clicks on this site, only if you accept analytics in the cookie banner. Declining is the default.
We do not sell data, we do not run advertising trackers, and we do not use your engagement data to train models.
The demo on this site
The demo at /onboarding and /dashboard runs entirely in your browser. What you type is stored in your browser's local storage and is never transmitted to us. Clearing your browser storage deletes it. Optional analytics (only if you accept them) and the pilot form are separate and are described below.
Legal basis
- Contract — providing the product to you and your counterparty during a pilot or subscription.
- Legitimate interests — responding to enquiries, keeping the service secure, and preventing abuse.
- Consent — non-essential analytics cookies, and marketing email if you ask for it. You can withdraw consent at any time.
- Legal obligation — accounting and tax records.
Where your data is hosted
Product and website data is stored in a managed PostgreSQL database hosted in the European Union, encrypted in transit (TLS) and at rest. Application hosting is provided on an edge network with EU processing for our origin. We do not routinely transfer personal data outside the EEA; where a sub-processor requires it, the transfer relies on Standard Contractual Clauses.
Retention
- Enquiries and leads — 24 months from last contact, then deleted.
- Engagement data — for the life of the engagement plus 12 months, unless your contract says otherwise or you ask for earlier deletion.
- Analytics events — 14 months.
- Server logs — 30 days.
- Accounting records — as required by law, typically 7 years.
On written request we delete an engagement and all of its history within 30 days, and confirm when it is done.
Sub-processors
- Supabase — managed PostgreSQL database and authentication, EU region.
- Lovable / Cloudflare — application hosting and content delivery.
- Email delivery provider — transactional email such as invitations and pulse reminders.
- GitHub — only if you connect it: a read-only GitHub App that returns the number of pull requests merged in the repositories you share. We keep the installation number and repository names, and no access tokens.
- Atlassian (Jira) — only if you connect it: a read-only connection that returns the number of issues resolved and created in your projects. We keep the site name, project keys and a refresh token, stored encrypted, so the weekly count can run without you signing in again. Disconnecting deletes the token.
- Sentry — error reporting. When the server hits an unexpected error it sends the error message, a stack trace and the page path. We remove email addresses, tokens and URL query strings before sending, and never send engagement data or form contents.
- Anthropic (AI provider) — writes the weekly review when it is switched on for an engagement. It receives only that week's per-side averages, the confirmed scope and phase plan, the engagement name, any signal notes and weekly totals of the delivery evidence you log (counts such as scope changes or items delivered, never the notes on an entry) — never individual answers, names or email addresses. We ask for it not to be used to train models. Reviews are stored with the engagement and deleted with it.
The current list, with entity details, is issued with the data-processing agreement at pilot start. We tell you before adding a new sub-processor that touches engagement data.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or provide it in a portable format. You can also withdraw consent where processing relies on it. Email vasco.ammo92@gmail.com and we will respond within 30 days at the latest. If you are unhappy with our response, you can complain to your national data protection authority.
Cookies
We set no advertising or profiling cookies. A single session identifier is kept in your browser to group analytics events, and it is only created after you accept analytics. Declining leaves the site fully functional.
Changes
If we change this policy materially we will update the date above and, for active customers, tell you by email.