GDPR Notice

1. Controller and Processor Roles

Alumia, Inc. acts as a controller for account registration, website analytics, support, security, billing records, and direct communications. For Customer Content processed inside an organization workspace, Alumia generally acts as a processor or service provider on behalf of the organization that controls that workspace.

2. Legal Bases

We process personal information under the following legal bases:

• Contract: to create accounts, provide the Services, route AI requests, execute user-authorized tools, and manage organization workspaces.
• Legitimate interests: to secure the Services, prevent abuse, improve reliability, respond to support requests, and understand aggregate product usage.
• Legal obligations: to keep tax, accounting, compliance, and security records when required.
• Consent: where we ask for consent for optional cookies, marketing, or other processing that requires consent.

3. Your GDPR Rights

Subject to applicable law and verification, you may have the right to:

• access personal information we process about you;
• correct inaccurate or incomplete personal information;
• delete personal information;
• restrict or object to certain processing;
• receive a portable copy of certain information;
• withdraw consent where processing is based on consent;
• complain to a data protection authority.

4. International Transfers

Alumia and its providers may process information outside your country of residence, including in the United States. Where GDPR requires transfer safeguards, we use mechanisms such as Standard Contractual Clauses, adequacy decisions, or equivalent safeguards made available under applicable law.

5. Data Processing Addendum

Organizations that need a data processing addendum for processor activities can contact us. We may require additional verification of account ownership and organization authority before entering into a DPA.

6. Contact

To exercise privacy rights or ask GDPR questions, contact [email protected].

Alumia, Inc.