Privacy policy

Overview

Alabric (“we”, “us”, or “our”) is based in California, United States of America. We are responsible for the personal information we use to operate alabric.com, our customer panel at panel.alabric.com, and our business relationships.

Information processed inside customer applications or containers is subject to the relevant service agreement and, where applicable, a data processing agreement. If your information is controlled by one of our customers, direct your privacy request to that customer.

Information we collect

Inquiries and correspondence. When you contact us, we may receive your name, email address, company, project requirements, and the contents of your messages. Only share information needed for your inquiry; do not include passwords, private keys, or sensitive personal information.

When you submit the website inquiry form, the information you enter is sent to Alabric so we can respond. Information you send through other communication channels is also handled under this policy.

Accounts. When you create an account in our customer panel, including by accepting a quote, we collect your name, email address, and password, which we store only in hashed form. You may also provide a billing address, phone number, team members you invite, your language and display preferences, and two-factor authentication settings such as passkeys.

Quotes, orders, and billing. We keep records of quotes, orders, subscriptions, invoices, credit notes, and account credit. When you accept a quote online, we record who accepted it, when, and the IP address and browser used, as evidence of the agreement.

Payment information. Stripe processes card and bank payments. Stripe holds your full card or bank details; we receive and keep only limited details such as the card brand, last four digits, and expiry date, along with payment status and transaction references. Payment processing is subject to Stripe’s applicable privacy terms.

Support. If you open a support ticket or use live chat, we keep your messages, any files you attach, and your contact details.

Technical information. Requests to our website and customer panel may generate server logs containing IP addresses, request times, requested pages, browser information, referring pages, and response status. The customer panel also records sign-ins and account activity, including the IP address used. We derive your approximate country from your IP address using a database hosted on our own servers, and use it to show prices in your local currency and to help detect fraud. These records help us operate and troubleshoot our services and identify misuse.

Security and fraud prevention. Our forms use Cloudflare Turnstile to tell people from automated bots; it processes information about your browser and device to do so. We also run automated checks, such as whether an email domain is used for throwaway addresses or whether a connection comes from a known anonymizing network. To protect our services, we may block IP addresses, email addresses or domains, and payment cards linked to fraud or abuse; for cards we keep Stripe’s card fingerprint, not the card number, and may add it to Stripe’s fraud-prevention block list. If an automated check blocks you, contact us and a person will review it.

How we use information

• Operate the website and customer panel, and provide services you request.
• Create and secure your account, and send service emails such as verification messages, receipts, and invoices in your chosen language.
• Respond to questions, discuss projects, and provide support.
• Manage quotes, payments, and related business records, including showing prices in your local currency.
• Investigate errors, security incidents, fraud, and abuse, and keep automated bots out of our forms.
• Meet legal obligations and establish or defend legal claims.

Where GDPR applies, we rely on contractual necessity for requested services and pre-contract steps, legitimate interests for website operation, security, and routine business communications, and legal obligations for required records and disclosures. When a particular use requires consent, we seek it and allow it to be withdrawn.

How we share information

We use external providers for infrastructure, network protection, email delivery, development, and payment processing. The information involved depends on the provider’s role and the service you use; not every provider receives information about every visitor. We do not sell personal information.

Information may also be disclosed when required by law, in response to valid legal process, to investigate misuse or protect rights and safety, or as part of a merger, acquisition, or other business transfer, subject to applicable law.

Service providers and subprocessors

The following providers support our operations. Their role as a processor or independent controller depends on the information and service involved.

Cookies and external sites

The website does not set its own cookies, use local storage, or include advertising or analytics trackers. Your browser may cache website files. The contact form loads Cloudflare Turnstile, which may use cookies or similar technologies to check that you are not a bot; see Cloudflare’s privacy policy.

The customer panel uses only cookies needed for it to work: keeping you signed in, protecting forms against cross-site requests, remembering your language, remembering a browser you chose to trust for two-factor authentication, and identifying your live chat session. It stores display preferences, such as light or dark mode, in your browser’s local storage. The panel does not use advertising or analytics trackers.

Our fonts load from Google Fonts. This requires your browser to send requests to Google, including your IP address and request headers. See Google’s privacy policy for more information.

External websites and services, including payment services, may use their own cookies and technologies. Their privacy policies explain those practices. This policy does not govern websites you reach through external links.

Data retention

Retention depends on the purpose and type of information. We consider whether an inquiry remains open, whether information is needed to provide a service, security investigations, applicable recordkeeping duties, and legal claims.

As a guide: account information is kept while your account is open; invoices, payments, and quote acceptance records are kept as long as tax and accounting rules require; general activity logs are kept for 30 days and security audit records for one year; live chat transcripts are kept for one year; automatic IP blocks expire after 24 hours, while blocks and bans that we set ourselves last until we lift them.

Information is retained for as long as needed for those purposes. A deletion request may be subject to legal exceptions and the expiry of backup copies under the applicable backup cycle. Contact us for information about retention that applies to your records.

Security

Protecting personal information requires safeguards appropriate to the information and the risks involved. No website, network, or storage system can guarantee complete security. Please avoid sending sensitive information through general inquiries and contact us if you believe your information has been exposed through our services.

International processing

Alabric operates from the United States. Our providers may process information in the United States or other countries where they operate. Privacy laws can differ between countries.

Where a transfer is subject to GDPR or similar restrictions, applicable law requires an appropriate transfer basis, such as an adequacy decision or contractual safeguards. Contact privacy@alabric.com for details of the locations and safeguards relevant to your information.

Your privacy choices

You can ask about the information we hold about you or request a correction or deletion by emailing privacy@alabric.com. Include enough detail for us to locate the relevant records, without sending sensitive identity documents unless requested through an appropriate channel.

We may need to verify your identity or an authorized representative’s authority before disclosing or changing personal information. Rights depend on applicable law and may have exceptions. If we cannot fulfill a request, we will explain the reason where required.

GDPR rights

Where the EU General Data Protection Regulation or UK GDPR applies to our processing, you may have the following rights, subject to the conditions in those laws:

• Access your personal data and information about its use.
• Correct inaccurate data or complete missing information.
• Request erasure or restriction of processing.
• Object to processing based on legitimate interests, and to direct marketing.
• Receive a portable copy of eligible data.
• Withdraw consent without affecting earlier lawful processing.
• Receive applicable protections concerning solely automated decisions with legal or similarly significant effects.

Send requests to privacy@alabric.com. We respond without undue delay and generally within one month, subject to permitted extensions and applicable rules. If an extension is needed, we will explain why. You may complain to your local data protection authority, including the UK Information Commissioner where relevant.

California privacy rights

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, California residents may have rights to:

• Know and access personal information collected about them, including its sources, purposes, and recipients.
• Request deletion or correction, subject to legal exceptions.
• Opt out of a sale or sharing for cross-context behavioral advertising, where applicable.
• Limit certain uses or disclosures of sensitive personal information.
• Exercise privacy rights without unlawful discrimination.

Email privacy@alabric.com to submit a request, including through an authorized agent. Requests to know, delete, or correct generally receive a response within 45 calendar days; a permitted extension may add 45 days with notice. Different deadlines apply to opt-out and limitation requests.

The information categories, sources, purposes, and providers relevant to our website and customer panel are described above. Neither has advertising trackers or integrations for cross-context behavioral advertising, and we do not sell or share personal information for that purpose. Global Privacy Control signals must be honored where legally required for applicable sale or sharing activities.

Children’s information

If you believe a child has provided personal information to Alabric without appropriate authorization, contact us. We will review the report and take action as required by applicable law, including deletion where appropriate.

Policy updates

We may revise this policy as our services, practices, or legal requirements change. The effective date will identify the current version. We will provide additional notice of changes when required by law.

Contact us