Privacy Policy

1. Who we are and our role

Aliena ("Aliena", "we", "us") operates a governance intelligence platform from the United Kingdom. Contact: privacy@aliena.co.uk.

For customer-controlled portfolio, programme, project, demand, investment and governance content, Aliena generally acts as a processor on behalf of the customer organisation. The customer organisation determines why that content is processed and is normally the controller for that data.

For account administration, service security, billing, our direct business relationship and our own operational records, Aliena may act as a controller.

2. Data we process

• Account and identity data: name, email address, authentication identifiers, organisation membership, role and account metadata.
• Customer governance content: portfolio, programme, project and small-work records; demand and investment information; business cases; approvals; decisions; RAID; milestones; dependencies; schedules; finance; benefits; resources/capacity; governance artefacts; audit history; files and other content users place in the platform.
• AI interaction data: prompts, selected governed context, generated responses, evidence references, confidence/usage metadata and model-usage records associated with AI features.
• Integration data: connected-account identifiers, tenant/account details, authorised scopes, OAuth access/refresh credentials and data retrieved from an integration where the customer enables that connection.
• Billing data: organisation plan, Stripe customer/subscription identifiers, checkout status, usage/overage records and related billing metadata. Full card details are processed by Stripe rather than stored by Aliena.
• Communication data: invitation details, recipient addresses, operational notifications, email content and delivery-event metadata used to send and troubleshoot service communications.
• Technical and security data: service logs, request/diagnostic information, authentication/session state and security/audit events generated when the service is used.

3. How we obtain data

We receive data from users and customer administrators, from content entered or uploaded into Aliena, from authentication and billing providers, from enabled third-party integrations, and from the normal operation and security monitoring of the service.

If your employer or another organisation gives you access to Aliena, that organisation may provide your work identity, role and governance data to us.

4. Why we use personal data

• Provide, secure, administer and support the Aliena service.
• Authenticate users and enforce organisation, role and approval boundaries.
• Operate governed demand, investment, delivery, assurance, audit and reporting workflows.
• Generate AI-assisted analysis, challenges, summaries, predictions, drafts and decision-ready briefings when those features are used.
• Send invitations, approvals, alerts, governance notifications and other service communications.
• Manage subscriptions, usage limits, AI usage/overage accounting and billing.
• Prevent abuse, diagnose faults, maintain reliability and investigate security events.
• Comply with legal obligations and establish, exercise or defend legal claims where necessary.

Where Aliena is controller, our legal bases may include performance of a contract, legitimate interests in operating and securing a B2B service, compliance with legal obligations and consent where consent is the appropriate basis for an optional activity.

5. AI processing

When an AI feature is used, Aliena may send the prompt and relevant governed context to the AI provider configured for that feature. The current codebase contains integrations with OpenAI and Anthropic.

The application also records AI usage metadata such as organisation, user, feature, provider/model and estimated or reported token usage for service governance, quotas and billing analysis.

Aliena does not use customer content through the product to train a general-purpose Aliena model. AI providers process requests under their applicable service terms and data-processing arrangements.

6. Microsoft and other connected services

Microsoft connectivity is optional and must be authorised. The current Microsoft connection flow requests identity/profile access and Microsoft Graph permissions that can include User.Read, Sites.Read.All, Files.Read.All, Group.Read.All and Directory.Read.All, together with offline access. The exact consent shown by Microsoft controls what Aliena can access.

To maintain an authorised Microsoft connection, Aliena may store the connected account email, tenant identifier, authorised scopes and provider access/refresh credentials. Data obtained from Microsoft is used for the connected Aliena feature and remains subject to the customer organisation's governance and Microsoft's terms.

Other authentication or integration providers may be used where enabled by the customer. You can also revoke provider permissions through the relevant provider account controls.

7. Service providers and sub-processors

We use service providers to operate Aliena. The current application and vendor register include the following providers. A provider only receives the data needed for the service it performs.

Where required, we use appropriate data-protection terms with vendors. We may also disclose data where required by law, to protect rights or security, or as part of a corporate transaction subject to appropriate safeguards.

We do not sell customer data or personal data.

8. Cookies, sessions and analytics

Aliena uses authentication/session technologies required to keep users signed in, maintain security and remember active organisation context. Authentication is implemented through Supabase.

The public landing experience contains optional event hooks for analytics tooling if such tooling is configured. The reviewed landing code does not itself load an advertising tracker. We do not use personal data for third-party behavioural advertising.

If non-essential analytics or similar tracking is enabled in a jurisdiction where consent is required, Aliena will need to apply the appropriate notice/consent controls for that deployment.

9. Retention and deletion

We retain customer content and account data for as long as needed to provide the service and according to the customer's instructions and applicable agreement. Security, audit, billing and legal records may be retained for longer where necessary for legitimate operational, contractual or legal purposes.

Backups and replicated data may persist for a limited period after deletion as part of normal resilience processes. We do not state a universal fixed deletion period in this policy unless that period is supported by the applicable customer agreement and operational process.

Deletion or data-return requests can be sent to privacy@aliena.co.uk. Where your organisation is the controller, we may direct the request to that organisation or assist it in responding.

10. Security

Aliena uses technical and organisational controls including authenticated access, role and organisation scoping, database Row-Level Security, audit/governance records, secret-management controls, encrypted transport and security-focused CI checks. Additional detail is available on our Security page.

No online service can guarantee absolute security. If you believe you have found a security issue, contact security@aliena.co.uk.

11. International transfers

Some service providers may process data outside the United Kingdom. Where UK data-protection law requires a transfer mechanism, we use or rely on appropriate contractual or recognised safeguards applicable to the provider and service.

12. Your UK data-protection rights

Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, portability and objection, and rights relating to consent and certain automated processing.

Send requests to privacy@aliena.co.uk. We will respond within the period required by applicable law. If your data is controlled by your employer or another customer organisation, that organisation may need to handle the request and Aliena will support it as processor.

You may complain to the UK Information Commissioner's Office if you believe your data-protection rights have been infringed.

13. Changes to this policy

We may update this policy when the product, integrations, vendors or legal requirements change. We will change the "Last updated" date and provide additional notice where a material change requires it.

14. Contact

Privacy: privacy@aliena.co.uk
Security: security@aliena.co.uk
General: support@aliena.co.uk