Privacy Notice

Alframe is operated by HIVE DYNAMICS DOO, Bulevar oslobođenja 30a, 4th floor, 21000 Novi Sad, Serbia(“we”). We are the controller for the personal data described in this notice. Contact: [email protected].

For the content our customers store in Alframe — their AI register, assessments, and evidence — the customer is the controller and we act as processor under our Data Processing Agreement.

Account data (name, work email, password hash, role, language preference) to provide the service — legal basis: contract performance (Art. 6(1)(b) GDPR). Usage and security logs (IP address, session identifiers, audit events) to keep the service secure and multi-tenant isolation verifiable — legal basis: legitimate interest (Art. 6(1)(f)). Email addresses for operational notifications such as review reminders — legal basis: contract performance; reminder digests can be disabled at any time via the unsubscribe link in each email.

Waitlist data, if you sign up for early access before you have an account: your work email, the language you used, and how you reached our site (the campaign tag in the link you followed, or the website that referred you). If you answer the optional questions, also your name, company, company size and what you tell us about the AI tools your team uses. We use it to tell you when your access is ready, to prepare your account if you go ahead, and to learn which of our channels reach people — legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to [email protected]. We send you a confirmation when you sign up and nothing else until your access is ready; it is not a newsletter.

Website analytics: on our public pages we count visits with Umami, an open-source analytics tool we run ourselves on our own servers with Hetzner Online GmbH in Germany, so no analytics company receives your data. It sets no cookies and does not store your IP address: your IP address and browser details are used only to derive your country and an anonymous visitor identifier that changes every month. Pages inside the signed-in app are not measured — legal basis: legitimate interest in understanding how our website is used (Art. 6(1)(f)).

Security and delivery: every request to our website and app passes through Cloudflare, Inc., which protects the service against attacks and abusive traffic and encrypts the connection. It processes your IP address and the technical details of each request for that purpose only, and does not store the content of the service — legal basis: legitimate interest in keeping the service available and secure (Art. 6(1)(f)).

We do not sell personal data and we do not use it for advertising.

All service data is hosted in the European Union, with Hetzner Online GmbH in Germany. Requests on their way to it pass through Cloudflare, Inc.’s global network, which may handle them outside the EU; the safeguard for that is listed on the Subprocessors page.

We are established in Serbia, which is outside the EEA and is not the subject of a European Commission adequacy decision under Art. 45 GDPR. Administering the service from there is therefore a transfer to a third country, and we rely on the Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) as the Art. 46 safeguard. Our full list of vendors, with the safeguard relied on for each, is on the Subprocessors page.

Account data is kept while your organisation has an account. Closing an account deactivates it immediately and schedules the irreversible purge for one year later, so a closure made in error can still be reversed; if you ask for immediate erasure instead, the purge runs without that window. Security and audit logs are kept for 12 months. Customer register content is deleted on the customer’s instruction per the DPA. Waitlist data is deleted twelve months after you sign up, or sooner if you ask us to remove you; the copy of each signup we receive by email is deleted on the same schedule.

You have the rights of access, rectification, erasure, restriction, portability, and objection under Arts. 15–21 GDPR. Write to [email protected]. You may also lodge a complaint with the data protection supervisory authority of the EU or EEA country where you live, where you work, or where the matter arose.

We use only strictly necessary cookies: a session cookie for signed-in users and a language preference. No analytics or advertising cookies are set: our website analytics is cookieless, and we store nothing on your device for marketing. Our network provider, Cloudflare, Inc., may set a short-lived security cookie to tell people apart from automated traffic.