Privacy Policy
This policy explains what personal data Allocate collects when you use the service, why we collect it, who we share it with, and the rights you have over it.
1. Who we are
Allocate is a service for booking and managing equipment, used by businesses. It is run by Joakim Svärd, a sole trader (enskild firma) registered in Sweden.
Who is responsible for which data
The law calls the party that decides why and how data is used the controller, and a party that handles data on someone else's instructions the processor.
- We are responsible for your user account and sign-in, billing, support requests, the emails we send for our own purposes (such as account and billing emails) and our security logs. This policy covers that data.
- Your company is responsiblefor the bookings, equipment, team list and invitations inside its workspace. We handle that data on the company's behalf and on its instructions, under our Data Processing Agreement, including sending invitations and notices about team changes for the company. Your company's own privacy notice explains how it uses that data, and questions about it go to your company first; we will help them answer.
Allocate is a tool for businesses. It is not meant for consumers or for children.
2. What we collect
We collect only what the service needs to work.
Card details never reach us.You enter them on Stripe's own checkout page, and we only receive a reference to the payment.
Free text is up to you. Booking notes, project names and support messages can hold anything you type. Please do not enter sensitive personal data there, such as health information.
Invited people.If a colleague invites you, your company gives us your email address and we send the invitation on the company's behalf. The invitation email tells you who invited you and links to this policy.
3. Why we use it, and on what legal basis
Every use below has a legal basis under Article 6 of the GDPR. Where we rely on legitimate interests, we name the interest, and you have the right to object (section 6). You can ask us for our balancing test.
We do not sell your data or make automated decisions with legal or similar effects on you.
Customer references. As the Terms of Service allow, we may name a customer company and show its logo as a customer of Allocate (legitimate interests, 6.1 f: showing who uses Allocate). If the customer is a sole trader, its name is personal data. Any customer can ask us to stop at support@allocate.at. We do not publish names of individual users without their permission.
4. Who we share it with
We use three providers to run Allocate. Each has a data processing agreement with us, and none may use your data for its own purposes except where stated.
Stripe has two roles.It processes payments for us. It also acts as an independent controller for its own legal duties, such as fraud prevention and anti-money-laundering checks. Stripe's privacy policy covers that part. When you subscribe, you are sent to Stripe's own pages, where Stripe's cookies apply.
Transfers outside the EU/EEA.Google LLC, Stripe, LLC and Resend process some data in the United States. These transfers rely on the EU Commission's Standard Contractual Clauses in each provider's data processing agreement, and also on the EU-U.S. Data Privacy Framework for providers certified under it. You can ask us for a copy of the safeguards at privacy@allocate.at.
Inside your company. Only admins can see the team list with names and email addresses. Members can see bookings and equipment, including who made a booking, as far as their role allows. While an invitation is open (7 days), anyone who has the invitation link can see which email address it was sent to.
Our own access. People we authorise to work on Allocate can see customer accounts, team lists and support requests when needed for support, billing or security, and keep short internal notes about customer companies. They are bound by confidentiality. Attempts to sign in to that operator area are logged.
Authorities. We disclose data to authorities only when Swedish or EU law requires it.
5. How long we keep it
We keep data only as long as it is needed, and most of it is deleted automatically. Automatic deletion normally happens within a few days after the time shown, not at the exact moment. A few records are kept for a fixed time to meet legal duties or to show that a deletion happened.
Your account
Your company's data
If we have agreed a different arrangement with a company, the periods in the rows above start on the day that arrangement ends, not before. The period for an ended paid subscription (90 days) then applies from that day, and admins get the locked email and the email 7 days before deletion from then.
When you leave a company or delete your account, your name is removed from the company's bookings and equipment history. Names typed into free text, such as notes and project names, are not searched for and removed. The entries themselves stay with the company, because they are the company's records.
Billing
Support, emails and logs
6. Your rights
You can use most of your rights yourself in Account settings. For anything else, email privacy@allocate.at. We answer within one month; if a request is complex we may extend that by up to two more months and tell you why. It is free of charge, unless a request is clearly unfounded or excessive.
If you are the last admin. You cannot delete your account while other members depend on you as admin. Make someone else admin first, or delete the company.
Data your company controls. Requests about bookings, equipment or team data go to your company, which decides. If you send them to us, we pass them on and help your company answer.
When we cannot delete at once. If you ask us to erase data we must keep by law, such as invoices, we tell you why and when it will be deleted.
We may ask you to confirm your identity before we act on an emailed request.
What you must give us. You need to give us your name and email address to have an account; without them we cannot give you access. To subscribe, Stripe needs billing details. Everything else is up to you.
8. Security, changes and contact
Security.Traffic is encrypted, and passwords are stored only as hashes. Access inside a company follows roles, and each company's data is separated from other companies' data by access rules. Deletion and access to the operator area are logged.
Changes to this policy. Each version has a number. For a significant change we tell you in advance, by email or in the app, and ask you to confirm you have read it. Small corrections, such as new contact details, take effect when published.
If Allocate changes owner. Allocate is planned to move from a sole trader to a limited company. If that happens, or if the business is sold, your data moves with the service under the same protections, and we tell you in advance.
Contact. Email privacy@allocate.at, or write to Joakim Svärd, Oxelvägen 13, 138 31 Älta, Sweden.
Version 1.0