1. Who we are

Alignex is operated by Alignex Ltd, a company registered in England and Wales. We provide organisational alignment diagnostic services to businesses. Our registered address and contact details are available on request at privacy@alignex.app.

2. What data we collect

We collect the following categories of personal data:

• Account data: name, email address, job role
• Diagnostic response data: answers to alignment diagnostic questions
• Usage data: pages visited, features used, login timestamps
• Organisation data: company name, business unit structure

We do not collect special category data (as defined under GDPR Article 9) and do not require it for our service.

3. Anonymity and diagnostic responses

Your organisation sees diagnostic results for groups of people, not for you. What you write in your own words is never shown to your organisation, your manager, or any other person — it is summarised with others' answers, never quoted. Scores are shown only for groups of at least 5 people by default; an organisation may change that number, but never below 3.

Aggregated, anonymised scores are shared with the organisation that commissioned the diagnostic as part of the service.

4. Legal basis for processing

We process personal data on the following legal bases:

• Contract — processing necessary to provide the service you or your organisation has subscribed to
• Legitimate interests — improving our service, security monitoring, fraud prevention
• Consent — where you have explicitly consented, such as for marketing communications

5. Where your data is stored

All data is stored within the European Union. Our infrastructure uses Supabase (hosted on AWS eu-west-1, Ireland) and Vercel (EU region). We do not transfer personal data outside the EEA without appropriate safeguards in place.

6. How long we keep your data

We retain account data for the duration of your subscription plus 12 months. Diagnostic response data is retained for 36 months to enable longitudinal comparison. You may request deletion of your data at any time by contacting privacy@alignex.app.

7. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access — obtain a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to restriction — limit how we process your data
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, contact privacy@alignex.app. We will respond within 30 days.

8. Cookies

Essential cookies. Required for authentication and security. You cannot opt out of these without losing access to the service.

Product analytics. Where product analytics is enabled, PostHog sets first-party cookies so we can understand how the product is used. It is deliberately configured not to capture form values or page content, not to record sessions, and to create a profile only for signed-in users.

We do not use advertising cookies, and we do not sell or share your data with advertisers.

9. Third-party processors

We use the following third-party processors, each subject to appropriate data processing agreements:

• Supabase — database and authentication (EU hosted)
• Vercel — application hosting (EU region)
• Resend — transactional email delivery
• Stripe — payment processing
• Anthropic — AI narrative generation (data is not used for training)
• PostHog — product analytics, where enabled (no form values, page content or session recording)
• Sentry — error monitoring (identifiers only; no request bodies, headers or IPs)

10. Contact and complaints

For any privacy-related queries, contact privacy@alignex.app. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.