Privacy policy.

1. Information We Collect

1.1 Personal Information

We collect information that you provide directly to us, including:

• Account information: name, email address, phone number, job title
• Organisation details: company name, business address, company registration number
• Payment information: billing address, payment card details (processed by our payment provider)
• Communications: correspondence with our support team

1.2 Business and Environmental Data

To provide our sustainability analytics services, we collect:

• Facility information: locations, energy consumption, operational data
• Production data: raw ingredients, fermentation data, packaging specifications
• Supply chain information: supplier details, transportation data, sourcing origins
• Environmental metrics: carbon emissions, water usage, waste diversion rates
• Product information: SKU details, lifecycle assessment data
• Certification and compliance data: B Corp assessments, sustainability certifications

1.3 Automatically Collected Information

When you access our platform, we automatically collect:

• Device information: IP address, browser type, operating system
• Usage data: pages visited, features used, time spent on platform
• Cookies and similar technologies: see our Cookie Policy for details

1.4 Product Usage Measurement

While you are signed in, we record which parts of the platform you open, in what order, and how long you spend there. We use this to find where the product is confusing or slow and to decide what to build next.

This measurement never records your business data. It stores the name of the area you opened and how long you were there. It does not store your recipes, suppliers, volumes, documents, footprint figures, or any value you have typed into the platform.

It is first-party and does not use cookies. Our lawful basis is legitimate interest: improving a service you pay for. You can object at any time and we will switch it off for your organisation, with no effect on how alkatera works for you. Ask us, or an owner or admin of your organisation can turn it off under Settings › Profile, in the section headed ‘Your data’.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our sustainability platform
• Calculate and track environmental impact metrics (carbon footprint, water footprint, circularity scores)
• Generate sustainability reports and analytics
• Process payments and manage subscriptions
• Send service-related communications and updates
• Respond to your enquiries and provide customer support
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and regulatory requirements
• Develop new features and services

3. Legal Basis for Processing (GDPR)

Under the UK and EU General Data Protection Regulation, we process your data based on:

• Contract Performance: Processing necessary to provide our services to you
• Legitimate Interests: Improving our services, fraud prevention, security, and measuring how the platform is used (see 1.4) — you can object to the last of these and we will switch it off for your organisation
• Legal Obligation: Compliance with applicable laws and regulations
• Consent: Where you have given explicit consent for specific processing activities

3.1 Do you have to give us this data?

Yes, for the parts that make an account work. Giving us your name, email address and your organisation’s details is a requirement of our contract with you, because we cannot create an account, tell your colleagues apart, sign you in or bill you without them. If you do not provide them, we cannot run an account for you. There is no legal obligation on you to hand any of it over; the consequence is simply that the service cannot be provided.

Everything else is optional and the platform will tell you so at the point of asking. You can leave out any piece of production, supplier or facility data; the effect is that the figures we can calculate for you are less complete, not that you lose your account.

4. Our Own Staff’s Access to Your Data

alkatera staff cannot see the data in your account. Not your recipes, suppliers, volumes, documents or footprint figures. This is enforced by the platform itself, not by policy alone.

If you want help with something, you can let us in. An owner or admin of your organisation grants access from your settings, choosing whether we may look only or also fix things, and for how long. We can ask for access, but only you can give it.

• Access always expires. You choose the window, and it can never exceed 72 hours.
• You can end it at any moment, and it ends immediately rather than at our next sign-in.
• While it is open, everyone in your organisation sees a banner saying so.
• Everything we open is written down and shown back to you in your own settings, with who came in, when, why, and what they looked at.
• Anything we change while helping is recorded against the alkatera member of staff who changed it, never disguised as one of your own team.

Our own staff-facing tools are built to work from counts and account details rather than your data, so that helping you is a deliberate act you agreed to rather than a side effect of us doing our jobs.

5. Data Sharing and Disclosure

We share your information with the following categories of recipients:

• Sub-processors: Vetted third parties who process data on our behalf to operate the platform (listed below)
• Business Partners: With your consent, partners who provide complementary sustainability services
• Legal Requirements: When required by law, court order, or governmental authority
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties.

Our sub-processors

These are the companies that handle data on our behalf to make the platform work. We require each of them to be bound by a data-processing agreement and to process data only on our instructions. A few of them, such as Companies House, are public sources we look information up from rather than processors acting for us; they are listed anyway, because you should know where your data goes either way.

• Supabase: database, sign-in and file storage
• Netlify and Vercel: application hosting. We are part way through moving from one to the other, so while the move is under way both are live: Netlify serves the current site and Vercel serves the new one.
• Upstash: rate limiting, which is how we stop our public pages being hammered. It receives the IP address of visitors who are not signed in.
• Inngest: running our background jobs. It stores the inputs and outputs of each step of a job, so anything a job works on passes through it.
• Infomaniak (Switzerland): booking demo calls in our calendar, our business email, and the hosted calculation server we use for lifecycle assessment
• Stripe: subscription and payment processing
• Resend and Sender: transactional and marketing email. Amazon SES (Ireland) is the sending infrastructure underneath Resend.
• Google Analytics and PostHog: optional product and website analytics (only with your cookie consent)
• Google (Gemini) and Anthropic (Claude): the AI models behind Rosa and our report and data-extraction features
• PDFShift: turning reports into PDFs
• Google Maps and Nominatim (OpenStreetMap): mapping and geocoding of facility locations, which receive the addresses you type
• Xero and Unleashed: accounting and inventory imports, if you connect them. These bring supplier contact names into your account. Unleashed is hosted in New Zealand.
• Companies House: looking up UK company details
• Breww: brewery production data, if you connect it
• Square: hospitality point of sale, if you connect it

Processing by AI providers

Some features (our sustainability partner Rosa, automated report drafting, and document and website data extraction) send content to the AI providers named above so they can generate a response. It is worth being plain about how much is sent.

• When you upload a document, the whole document is transmitted to the model that reads it, not an extract. If your invoice, bill or delivery note carries a supplier’s contact name, a signature or a phone number, that goes with it.
• When you talk to Rosa, the conversation history is transmitted to the model provider on each turn, along with limited account context, because that is what lets her follow the thread.

These providers act as our processors: they work on our instructions and return the generated output to us. We do not send special-category personal data to them.

Automated decisions

We do not make decisions about you by automated means alone where those decisions would have a legal effect on you, or affect you in a similarly significant way. We do not profile you for that purpose either.

The AI features draft and suggest. Rosa proposes an answer, the document reader proposes what it thinks it found on your invoice, the calculator proposes a figure. A person decides what to do with the suggestion. None of it decides anything about you as an individual: not whether you get an account, not what you pay, not whether you keep access. If that ever changes we will tell you here first, and you would have the right to ask for a human to look at the decision, to say what you think about it, and to challenge it.

6. International Data Transfers

Some of the suppliers listed above are based outside the UK, so your information is transferred to and processed in other countries. The main destinations are the United States, where most of our software suppliers are, Switzerland (Infomaniak), Ireland (Amazon SES, underneath Resend) and New Zealand (Unleashed).

Ireland is in the European Economic Area. Switzerland and New Zealand are both covered by UK adequacy regulations, which is the UK government’s finding that a country protects personal data to a standard comparable to our own. Transfers to those places need no further paperwork.

The United States is not covered by a UK adequacy finding. For it, and for any other country without one, we require our suppliers to be bound by either the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum. That is what we ask for as a condition of using a supplier. If you want to know which of the two applies to a particular supplier on the list, ask us and we will tell you.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. We retain certain information as necessary to comply with legal obligations, resolve disputes, and enforce agreements. Environmental and sustainability data may be retained longer for historical analysis and reporting purposes.

Two specifics worth naming. The usage measurement described in 1.4 keeps individual records for 90 days, after which only daily totals per area remain and the individual records are deleted. The record of alkatera staff access described in 4 is kept for the life of your account and cannot be edited or deleted by us, because a record we could quietly change would be worth nothing to you.

8. Your Rights

Under applicable data protection laws, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Restriction: Request limitation of processing
• Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Where processing is based on consent

To exercise these rights, contact us at hello@alkatera.com

9. Data Security

We implement appropriate technical and organisational measures to protect your information, including encryption, access controls, secure hosting infrastructure, and regular security assessments. However, no method of transmission over the Internet is 100% secure.

10. Children's Privacy

Our platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on our platform and updating the ‘Last Updated’ date.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Avallen Solutions Ltd trading as alkatera
Email: hello@alkatera.com
Website: https://alkatera.com

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you are concerned about how we handle your data.