Privacy policy.

This website is run by Alora Create Ltd, a company registered in England and Wales (company number 17541129). Our registered office is 10 Union Street, Barnet, England, EN5 4HZ. This is a registered address only, so please contact us by email.

We are the controller of the personal information described here. For any privacy question or request, email hello@aloracreate.com.

We only collect what you choose to send us through our two forms.

• Demo requests: your name, email address, organisation, type of organisation, and, if you give them, your role, phone number and what you would like the system to do. We email you a 6-digit code to confirm your address, and keep a record of when it was confirmed.
• Project enquiries: your name, email address, organisation, type of organisation, your message, your phone number if you give it, and which page you sent it from.

We don't use advertising or tracking cookies, and we don't run visitor analytics that identify you. Like any website, our hosting provider keeps short-lived technical logs (such as IP address and browser type) to keep the site secure and working.

• To reply to your enquiry, send you demo access and talk to you about your project.
• To prepare a proposal and, if you go ahead, to start working with you.
• To protect the forms from spam and misuse.

Our legal basis is legitimate interests: responding to people who ask about our services, and keeping the website secure. Where you go on to become a client, we also rely on the steps needed to enter into a contract with you.

We will not add you to a marketing mailing list from these forms, and we never sell or rent your information.

We use a small number of trusted service providers who process information on our behalf and only as we instruct:

• Our secure database provider, for the information you send through our forms and our internal client portal. This is stored on servers in the European Union.
• Resend (email delivery), to send our emails, such as your confirmation code.
• Google Fonts (font delivery), to load the typefaces on this site. Google receives your IP address when your browser requests the fonts.
• Our website hosting provider, to serve this website to your browser.

If you become a client, we also use:

• Stripe (payments), to take payments by card or bank transfer and send invoices and receipts. We never see or store your full card details.
• Twilio (text messages), to send sign-in codes and service texts to your mobile.

Each provider is bound by a contract that requires them to keep your information secure and confidential. Your enquiry is passed into our own client portal so our team can follow it up. We don't share your details with anyone else unless the law requires it.

The information you send us is stored in a secure database in the European Union. Some of our providers, such as Resend, Google, Stripe and Twilio, are based in the United States, so limited information (such as your email address or IP address) may be handled there. When that happens, it is protected by UK adequacy regulations (including the UK–US data bridge) or by the standard contractual clauses approved by the Information Commissioner.

• Enquiries and demo requests that don't lead to work: up to 2 years from our last contact, then deleted.
• If you become a client: for as long as we work together and then up to 6 years, to meet our legal and accounting duties.
• Confirmation codes expire after 15 minutes.

You can ask us to delete your details sooner at any time.

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct or delete it;
• object to, or ask us to limit, how we use it;
• ask us to move it to another organisation.

Email hello@aloracreate.com and we will reply within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put things right first.

When we build and run software for a client, the personal data of that client's members, patients or customers belongs to the client. We handle it only on their instructions, under a data processing agreement, and it is covered by the client's own privacy notice rather than this one. We never contact our clients' customers.

We may update this policy from time to time. The date at the top shows when it last changed.