Privacy

Who this policy covers, and our role

The Alliansis platform is a business tool. Everyone who uses it does so in the course of their work, as an employee or representative of a client organization or of an agency or supplier that the client works with. We do not offer the platform to consumers, and it is not intended for personal or household use.

That has an important consequence for how your data is handled. For almost everything you do on the platform, the organization that gave you access is the controller of your personal data, and we act as a processor on its documented instructions. Your organization decides what is collected, why, who inside it can see the results, and how long records are kept. Where you have a question or a request about your personal data, your organization is usually the right place to start, and we will support it in responding to you. You can also contact us directly at [email protected].

We are the controller of a smaller set of data that we determine ourselves: our marketing website, enquiries you send us, billing and subscription records for the organizations we contract with, and the security and system logs we keep to protect and operate the service.

Information We Collect

Account Information: Name, email address, company details, and password.

Usage Data: How you interact with our service, including IP addresses, browser type, device information, and access times.

Survey Data: Questions, responses, evaluations, ratings, and free-text commentary you create or submit in the Relationship Optimizer module.

Scope of Work Data: Scopes of work you create or manage in the Scope Optimizer module, including work items, work streams, assigned resources and their time allocations, deliverables, expenses, production and media costs, currencies, and the commercial values that roll up from them.

Rate Card Data: Supplier and agency rate cards you create or manage in the Ratecard Optimizer module, including roles, grades, rates, currencies, and the conversion rates applied to them.

Payment Information: Processed securely by Stripe and Chargebee. We do not store your payment card details.

Communications: Messages you send us and records of our interactions.

Scope of Work Data and Rate Card Data are primarily commercial records about organizations rather than about individuals. Where an individual is identified within them (for example, by being named as an assigned resource on a scope of work, or by having a rate attached to them personally rather than to a role), that information is personal data and is handled under this policy. Rate, cost, and time-allocation information associated with an identified individual is treated as confidential and is accessible only to authorized users within the organizations concerned.

We do not request, require, or intend to collect or process special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation), criminal offense data, or data concerning children. Please do not enter such information in free-text fields.

Your activity is recorded against you

This section describes how activity on the platform is recorded. People often assume this works differently, so please read it.

The platform is not anonymous. When you submit a survey response, write a comment, create or edit a scope of work, change a rate, or approve something, we record what was done, when it was done, and who did it. Your identity is collected and stored alongside the action. We do not offer anonymous participation, and we do not describe any part of the platform as anonymous.

Your organization may choose to configure reports and shared views so that names and email addresses are not displayed to other participants, for example so that feedback is presented without showing who gave it. That is a setting controlling what other users see. It does not change what is collected. The underlying record of who did what continues to exist, remains available to authorized administrators, and remains available where it is needed for audit purposes or to resolve a dispute.

We record this attribution because the platform is used to make decisions that carry commercial and contractual weight. Someone approving a scope of work is committing their organization to spend. Someone submitting an evaluation is contributing to a judgment about a business relationship. Both your organization and the organization on the other side of that relationship may later need to establish who took an action, and when.

What this means in practice:

– Closing or deactivating an account removes your access. It does not erase the record that you previously submitted, approved, or changed something.
– Records of significant actions (approvals, sign-offs, submissions, changes to commercial values) are kept as part of an audit trail after you stop using the platform, and after you leave your employer.
– Free-text you write may be read by authorized people at your own organization, and depending on how your organization configures the service, at the other organization in the relationship being evaluated.

If you are not comfortable with something being recorded against your name, the right time to raise it is with your own organization, before you submit it.

How We Use Your Information

– Provide our services and maintain your account.
– Evaluate and report on supplier relationships in the Relationship Optimizer module.
– Build, price, convert between currencies, approve, and report on scopes of work in the Scope Optimizer module.
– Maintain and apply supplier rate cards in the Ratecard Optimizer module.
– Provide AI-assisted analysis, summaries, and reporting of the data described above, for review by authorized users.
– Maintain an audit trail of who created, changed, submitted, and approved records.
– Process payments and send transaction confirmations.
Communicate with you about your account, updates, and support.
– Improve our platform through analytics and user feedback.
– Create anonymized benchmarks from aggregated survey data (no personal details included).
– Comply with legal obligations and protect our rights.
– We do not use your personal data to train machine learning models.

Information Sharing

We never sell your personal data. We only share information in these limited circumstances:

Within and between the organizations using the platform: Your data is visible to authorized users of the organization that gave you access, and, where that organization has set the service up to do so, to the counterpart organization in the business relationship being managed. Your organization controls these settings.

Service Providers: We disclose personal data to the following types of service providers, each for the purpose stated:

– Cloud hosting and infrastructure services, which host the platform and store your data
– Authentication and identity management services, which verify your identity and secure your account
– Content delivery and network security services, which deliver the service and protect it from attack
– Infrastructure monitoring and alerting services, which detect faults and security events
– Payment processing (Stripe), which takes payments
– Subscription management and billing (Chargebee), which manages your subscription and issues invoices

Each provider is bound by a data processing agreement and maintains independent security certifications. Enterprise customers may request a detailed list of service providers under a separate agreement.

Legal Requirements: We may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements, or where disclosure is required by law or court order, or is necessary to protect our rights and safety.

Business Transfers: If we’re acquired or merged, your data would transfer under the same privacy protections.

With Your Consent: When you explicitly authorize us to share specific information.

Data Security

We implement security measures including:

– All data in transit is encrypted using TLS 1.2 or higher.
– All data at rest is encrypted using AES-256 or equivalent standards.
– Role-based access controls limiting who can view your data.
– Hosted on a SOC 2-certified cloud platform with enterprise-grade security.
– Regular security assessments and updates.

Alliansis holds SOC 2 Type 1 attestation, independently assessed across the Security, Confidentiality, and Availability trust service criteria. For more details about our security practices, please visit our Security page at https://alliansis.com/security/.

While we work hard to protect your information, no system is 100% secure. We’ll notify you promptly of any security incidents that may affect your data.

Data Retention

Account data: Retained while your account is active.

Survey, scope of work, and rate card data: Retained for the duration of your organization’s active account and for a reasonable period thereafter for legitimate business purposes, or as required by law.

Audit and attribution records: Records of who created, submitted, changed, or approved something are retained as part of the audit trail for as long as they may be needed to evidence what happened, including after the individual concerned has stopped using the platform. Retention is bounded by the period in which a related legal or contractual claim could realistically be brought, and by any applicable statutory record-keeping requirement.

Anonymized data: May be retained indefinitely for benchmarking.

Deleted accounts: Personal data is removed from active systems within 30 days of account closure, except where it forms part of an audit or attribution record as described above, or where retention is required by law. Data in automated backups is overwritten in the normal backup rotation cycle. Some anonymized data may remain.

You may request deletion of your data at any time by contacting [email protected]. Where the organization that gave you access is the controller of that data, we will pass your request to it and assist it in responding. We will process requests for which we are the controller within 30 days.

Your Rights

Depending on your location, you may have these rights:

Access: Request a copy of your personal data.
Correction: Update inaccurate information.
Deletion: Request removal of your data.
Portability: Export your data in a common format.
Objection: Opt out of certain data processing.
Restriction: Limit how we use your data.

You can also ask us to limit how your personal data is used and disclosed. Today, we do not disclose personal data to any third party acting on its own behalf: the service providers listed under Information Sharing act as our agents under contract, and visibility between the organizations using the platform is controlled by the organization that gave you access. If that ever changes, meaning we propose to disclose your personal data to a third party acting on its own behalf or to use it for a purpose materially different from the purposes described in this policy, we will notify you and offer you the opportunity to opt out first.

To exercise any of these rights, please email [email protected]. We will respond within 30 days. There is no charge for exercising these rights. Where the organization that gave you access is the controller of the data concerned, we will refer your request to it and assist it in responding.

These rights are not always absolute. In particular, a request to delete an audit or attribution record may be refused where the record is needed to establish, exercise, or defend a legal claim, or where a law requires it to be kept. Where that happens, you will be told why. Where the law provides for it, we or your organization can instead restrict the record so that it is stored but not otherwise used. Part 2 explains this in more detail for your region.

Cookies & Tracking

We use cookies and similar technologies to:

– Keep you logged in
– Remember your preferences
– Analyze site usage
– Provide security features

You can control cookies through your browser settings, though some features may not work properly if disabled.

Children’s Privacy

Our service is a business tool and is not intended for children under 16. We don’t knowingly collect personal information from children. If we discover we’ve collected such information, we’ll delete it promptly.

Third-Party Links

Our service may contain links to other websites. We’re not responsible for their privacy practices, so please review their policies before sharing information.

Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. When we do, we will update the “Effective” date at the top of this page. Your continued use of our service after changes are posted constitutes acceptance of the updated policy.

Contact Us

Questions about this privacy policy? Contact us at [email protected].