Your privacy matters to us.

Last updated: May 2026

Who we are

Allotly is registered in England and Wales at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are the data controller for personal data processed through this service.

For any privacy-related question, contact us at privacy@allotly.ai.

1. Information We Collect

We collect the minimum information necessary to operate the service:

Account data: name, email address, hashed password
Organisation data: organisation name, plan tier, billing information
Usage data: token counts, estimated costs, timestamps, model names, and status codes
Billing data: Stripe customer ID, subscription status (card details are held by Stripe only)

We do NOT collect or store: prompts, completions, conversation history, or any content sent to AI providers.

2. How We Use Information

Authenticate users and manage team memberships
Track and enforce usage budgets for teams and vouchers
Generate invoices and process payments via Stripe
Send transactional emails (budget alerts, account notifications)
Improve service reliability and security

Legal basis (UK/EU GDPR): We process your data on the following legal bases: contract (to provide the service you signed up for), legitimate interests (security, fraud prevention, service improvement), and legal obligation (tax records, regulatory compliance).

3. Data Storage & Security

All data is stored in PostgreSQL with encryption at rest. API keys stored on behalf of organizations are encrypted using AES-256-GCM. Passwords are hashed with scrypt. All connections use TLS in transit.

4. Third-Party Services

Stripe: payment processing and subscription management
AI providers (OpenAI, Anthropic, Google, Azure): API request forwarding (for vouchers only; Teams connect directly)

International transfers: Some of our third-party processors are based in the United States. Where personal data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place.

5. Data Retention

Usage data retention varies by plan. Account data is retained for the duration of your account; upon deletion, all associated data is permanently removed within 30 days.

6. Your Rights

You have the right to: access your data, correct inaccurate data, request deletion, export your data in a portable format, and object to or restrict certain processing.

To exercise any of these rights, contact us at privacy@allotly.ai.

7. Cookies

We use essential cookies only: a session cookie to keep you logged in and a preference cookie for theme selection. We do not use advertising or tracking cookies.

8. Changes to This Policy

We may update this policy from time to time. Material changes will be notified by email or in-app at least 14 days before they take effect.

9. Contact

For privacy-related inquiries, reach us at privacy@allotly.ai.