Privacy policy
This describes what the Alimenta app and service do with personal data. It describes what actually happens rather than everything we might one day be permitted to do.
Who is responsible
Alimenta is responsible for the personal data described here. Write to privacy@alimenta.top about anything on this page.
There is an important split. For your own account — your email address, your name, your sessions — we decide what happens and we are the controller. For what a shop records about its own customers — a name against a debt, for instance — the business that entered it decides, and we only hold and process it on their instruction.
What we collect
Your identity. Your email address, which is also how you sign in, and a display name if you give one.
Your sessions. Each device you sign in from, with enough about it to show you a list you can revoke: the device as it describes itself, and when it was last used.
What you record. Products, stock, suppliers, deliveries, write-offs, stocktakes, cash movements, tasks and notes. This is business data, and it is personal data only where you put a person in it.
Your shop's customers, if you record them. A name, and what they owe. You put this there; see the split above.
Photographs you take in the app. A barcode scan is read on the phone and not sent anywhere. An invoice you photograph is sent to our server to be read into delivery lines.
Technical records. Our servers log requests — an address, a time, a path, a result — to run the service and investigate faults.
What we do not collect
No password, because there isn't one.
No payment card details. Where payment exists, it is handled by the app store or a payment provider, not by us.
No advertising identifiers, no third-party analytics or advertising SDKs, and no location tracking.
No access to your contacts, your photo library, or anything else the app has not asked you for.
Why we are allowed to
To provide the service you asked for: signing you in, keeping your records, showing them to the people you have authorised. That is the performance of our contract with you.
To keep the service working and secure — logs, backups, investigating abuse. That is our legitimate interest, and yours.
To meet obligations the law places on us, for as long as it does.
Who else sees it
The people you invited into your business, as far as their role allows.
The staff who run and support the service, when they need to — to investigate a fault you reported, or to keep the service running.
The providers we depend on to operate: the servers the service runs on, and the mail relay that delivers your sign-in codes and invitations. They act on our instructions and may not use the data for their own purposes.
Anyone the law compels us to disclose to, where we are satisfied the demand is lawful.
Nobody else. We do not sell personal data, and we do not hand it to anyone for their advertising.
How long we keep it
Your account and what it can reach: until you ask for it to be deleted, or the business it belongs to is deleted.
Financial records: kept as records, because a journal that can be rewritten is not one. Where you are named in one, deletion replaces your name rather than removing the entry.
Web server logs: 14 days, after which they are removed on rotation.
Backups: there is no automated database backup at present, so a deletion reaches everything we hold as soon as it is applied to the live service. If backups are introduced, their retention period will be stated here.
Where it is kept
On servers in Frankfurt, Germany (European Union), at the hosting provider OVH. Where any provider we use processes data outside the EU, we use the safeguards the law requires.
What you can ask for
A copy of the personal data we hold about you.
A correction, where something is wrong.
Deletion — see the account deletion page for what that covers and what has to survive it.
That we stop a particular use, where your rights outweigh our reason for it.
To complain to the data protection authority in your country if you think we have got this wrong.
Children
This is a tool for running a business. It is not meant for children and we do not knowingly collect their data.
Changes
When this policy changes, the date below changes with it, and we will say so in the app where the change is material.