Privacy policy

1. Who we are

aluma is operated by ALUMA FZ-LLC, a company registered in the United Arab Emirates.

UK Representative: to be appointed. Until then, please use the email address below for anything about your data.

For anything about your data, contact us at hello@aluma.app.

2. What this policy covers

This policy explains what personal information aluma collects when you visit our website or use the aluma app, why we collect it, how long we keep it, and what rights you have over it.

It covers two groups of people: the owners and managers who sign up for aluma, and the staff members those businesses invite into the staff portal.

aluma is a staff records tool. It is not built to hold information about the children who attend sessions or their parents, with one exception: the accident and incident book. A business working with children must keep an accident book, so a business can record an accident involving a child there. That record holds the minimum the book needs: the child's name and age, what happened, the injury and treatment, and whether a parent or carer was told. Nothing else in aluma holds children's details, and accident records are never included in inspection links or partner packs.

If you are a staff member, the business you work for decides what information about you goes into aluma and why. Their own privacy policy covers that. This policy covers what aluma itself does with the information once it is in the app.

3. What we collect

• Your email address, when you sign up for early access or create an account.
• Your name, business name and password when you register.
• Your name and message, if you contact us.
• Basic technical and usage data, such as your device type, browser and pages visited, through cookies and analytics (only with your consent).

We do not collect special category data through this website. The aluma product holds staff and business records. The only children's details it can hold are accident book entries, which the business you deal with controls, and which are kept until the child turns 21 and then flagged for deletion.

4. Why we use it, and our lawful basis

• To provide the aluma service and manage your account. Lawful basis: contract.
• To send you service updates and founding-member communications. Lawful basis: your consent, which you can withdraw at any time.
• To respond to your enquiries. Lawful basis: our legitimate interest in answering people who get in touch.
• To keep the site running, secure and improving. Lawful basis: our legitimate interest in a working, safe website.

5. Cookies and analytics

We use a small number of cookies to run the site and understand how it is used. Non-essential cookies only run with your consent. See the cookie policy for details.

6. Who we share your data with

We use trusted providers to run the platform. They only process your data on our instructions:

• Hosting: Vercel (United States)
• Database and authentication: Supabase (United States)
• Email: Resend (United States)
• Bot protection: Cloudflare Turnstile (United States)
• Analytics: Plausible Analytics (European Union, cookie-free)

We do not sell your data. We do not share it for anyone else's marketing.

7. International transfers

Some providers process data outside the UK. Where they do, we rely on appropriate safeguards such as standard contractual clauses or UK approved transfer terms.

8. How long we keep it

• Account data: for as long as your account is active, plus 30 days after closure, then deleted.
• Free trials: if you do not choose a plan, we keep your data for 30 days after the trial ends, then delete it. We email you a week before.
• Enquiry data: messages you send us before you have an account are kept for 12 months, then deleted.
• Analytics data: we use Plausible Analytics, which does not collect or store any personal data.
• Audit records: aluma keeps a tamper-proof log of who viewed, uploaded or signed sensitive records such as DBS certificates and contracts. These records are kept indefinitely for safeguarding accountability and cannot be edited or deleted, even by us. They contain the name of the person acting and the record they acted on, never the contents of the record itself.

9. Your rights

Under UK GDPR you can ask us to:

• see the data we hold about you,
• correct it if it is wrong,
• delete it,
• restrict or object to how we use it,
• receive a copy in a portable format,
• withdraw consent at any time.

To use any of these, email hello@aluma.app. We will respond within one month.

10. Keeping your data safe

We take reasonable technical and organisational steps to protect your data, including encryption in transit and at rest. No method is ever completely secure, but we work to keep it safe and to act quickly if anything goes wrong.

11. Children

This website is aimed at business owners and their staff, not children, and is not directed at anyone under 18. The aluma product holds staff and business records. The one place it can hold a child's details is the accident book, where a business records an accident involving a child as the law expects. Those entries are controlled by that business, kept to the minimum, logged every time they are opened, and kept until the child turns 21.

12. Changes to this policy

We may update this policy as aluma grows. When we do, we will change the date at the top and, for anything significant, let account holders know.

13. Questions about your data?

If you have any questions, contact us at hello@aluma.app.

14. How to complain

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.