Legal · Privacy

Privacy Policy

Last updated: 29 April 2026 · Effective date: 29 April 2026 · Version 1.0

This Privacy Policy explains how Alatapps ("we", "us", "our") processes personal data when you visit alatapps.com (the "Site") or write to us at an address ending in @alatapps.com. It is written to meet our obligations under the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the Dutch GDPR Implementation Act (Uitvoeringswet AVG, "UAVG") and other applicable Dutch and EU privacy law.

Alatapps is an independent software studio. We publish our own apps, of which Preemie Companion is the first. Each Alatapps product has its own Privacy Notice that supplements this Policy and applies to the processing performed inside that product. This Policy covers the corporate website and direct correspondence with us as a company. For Preemie Companion specifically, see the Preemie Companion Privacy Notice.

At a glance

  • This site sets no cookies. There is no analytics, tracking, advertising, fingerprinting, or third-party fonts.
  • When you simply browse, the only personal data we process is what appears in standard server logs.
  • If you write to us, we process the contents of your message to reply and, where it concerns one of our products, to forward it internally.
  • We never sell personal data and never use it for advertising or to train generative AI models.
  • Exercise any GDPR right by writing to privacy@alatapps.com.

The summary above is informational. The sections that follow are the binding text of this Policy.

1. Controller and contact

Alatapps is the data controller for the personal data described in this policy.

Alatapps
Verdunplein 17
5627 SZ Eindhoven, Netherlands
Chamber of Commerce (KVK) number: 42044797
VAT (BTW) number: NL005453160B44
Privacy and data-protection requests: privacy@alatapps.com
General contact: hello@alatapps.com
Security disclosures: security@alatapps.com

We are not required to appoint a Data Protection Officer for the processing described in this policy.

2. Scope

This Policy applies to:

  • your visit to alatapps.com and the static pages served from it;
  • email correspondence with us at addresses ending in @alatapps.com; and
  • requests, complaints, and rights-exercises you direct to us as a company.

Where you write to us about an Alatapps product, your message arrives in the same corporate inbox covered by this Policy. If we need to involve the team responsible for that product to answer you, we forward the relevant parts of your message internally; from that point the Privacy Notice of the product also applies. We do not share product correspondence outside Alatapps.

This Policy does not cover personal data processed inside an Alatapps product. Each product has its own Privacy Notice that supplements this Policy:

When you reach a product’s domain, the Privacy Notice of that product governs the processing performed inside it.

3. Categories of personal data we process

The Site is a static, brochure-style page. Our processing is intentionally limited.

3.1 Server-log data (automatic, when you load any page)

  • your IP address;
  • the date and time of the request;
  • the URL or path requested and the HTTP response code returned;
  • the User-Agent string sent by your browser;
  • the Referer header, if any, sent by your browser;
  • the approximate edge location that served the request.

This is collected by our hosting provider on our behalf as a sub-processor (see Section 6) and used solely for security, abuse prevention, and operating the Site. We do not export, enrich, or combine these logs with any other data set.

3.2 Email correspondence (only if you write to us)

  • your email address and display name;
  • the content of your message and any attachments;
  • the timestamp and routing metadata of the message.

3.3 DNS resolution data

Our DNS provider (see Section 6) processes IP addresses of resolvers and end users as part of resolving the alatapps.com domain. This is intrinsic to how the public DNS system works and is not avoidable for any operator of an internet domain.

We do not collect or process: account credentials, payment information, biometric data, special-category data within the meaning of Article 9 GDPR, advertising or marketing identifiers, behavioural-tracking data, or device fingerprints.

4. Purposes and lawful bases

ProcessingPurposeLawful basis (GDPR)
Server logs Operating the Site, ensuring availability, defending against abuse, debugging, and infrastructure security. Article 6(1)(f): legitimate interest in operating a secure and reliable corporate website.
Email correspondence Reading your message, replying to it, and routing it internally where needed. Article 6(1)(f): legitimate interest in handling business correspondence.
Records of legal or accounting relevance Statutory record-keeping (in particular Article 52 of the Dutch General Tax Act). Article 6(1)(c): compliance with a legal obligation.
DNS resolution Making the alatapps.com domain reachable on the internet. Article 6(1)(f): legitimate interest in operating the corporate website.

You have the right to object to processing based on Article 6(1)(f) on grounds relating to your particular situation. See Section 9.

5. Cookies and similar technologies

The Site sets no cookies. We do not use:

  • analytics or measurement cookies (no Google Analytics, no Plausible, no self-hosted equivalent);
  • advertising cookies, retargeting pixels, or social-media plugins;
  • browser-storage entries (no localStorage, no IndexedDB, no sessionStorage);
  • device-fingerprinting techniques;
  • third-party fonts or other third-party assets that would expose your IP address to another party while you read the page.

Because no cookies or comparable technologies are placed on your device, no consent banner appears and none is required under Article 11.7a of the Dutch Telecommunications Act.

6. Sub-processors and recipients

We engage a small number of carefully selected service providers to operate the Site. We have a written processing agreement with each, as required by Article 28 GDPR.

Sub-processorRoleCountry of establishmentTransfer safeguard
Vercel Inc. Static hosting, edge delivery, server-log processing. United States, with EU edge presence. Standard Contractual Clauses (Module Two), incorporated into Vercel’s Data Processing Addendum.
Cloudflare, Inc. Authoritative DNS for the alatapps.com domain. United States, with global anycast network including EU points of presence. Standard Contractual Clauses (Module Two), incorporated into Cloudflare’s Data Processing Addendum.
Google LLC (Google Workspace) Mail transport and storage for @alatapps.com mailboxes. United States, with EU regional storage available for Workspace data. Standard Contractual Clauses (Module Two), incorporated into Google’s Data Processing Addendum.

Where a sub-processor maintains certification under the EU-US Data Privacy Framework, we also rely on that certification as recognised by Commission Implementing Decision (EU) 2023/1795.

We do not share personal data with any other recipient, except where compelled by a binding legal order valid under EU or Dutch law. Where lawful, we challenge overly broad orders.

7. International transfers

Personal data processed by the sub-processors listed in Section 6 may be transferred to or accessed from the United States. We rely on Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) as the primary safeguard under Chapter V GDPR, and, where the relevant sub-processor is so certified, on the EU-US Data Privacy Framework. We support these safeguards with periodic Transfer Impact Assessments and rely on supplementary technical and organisational measures (encryption in transit, encryption at rest, access controls, key management) implemented by the sub-processors. You may obtain a copy of the relevant safeguards by writing to us.

8. Retention

  • Server logs: retained by our hosting sub-processor in accordance with their plan-tier retention policy and then deleted automatically. We do not export, copy, or extend that retention except where strictly necessary to investigate a specific security incident, in which case the relevant excerpts are kept for the duration of that investigation and for no longer than 12 months thereafter.
  • Email correspondence: retained for as long as the matter remains active and for up to 3 years after our last substantive exchange with you, unless a longer period is required by law (in particular the 7-year fiscal retention obligation under Article 52 of the Dutch General Tax Act for accounting-relevant correspondence).
  • DNS data: ephemeral. We do not retain DNS query data ourselves. Sub-processor retention is governed by the sub-processor’s own policies.
  • Records of rights-exercises and complaints: 3 years after closure, to demonstrate compliance under Article 5(2) GDPR.

9. Your rights

Subject to the conditions and exceptions in the GDPR, you have the right to:

  • access: obtain confirmation of whether we process personal data about you and a copy of that data (Article 15);
  • rectification: have inaccurate data corrected and incomplete data completed (Article 16);
  • erasure: have personal data erased where one of the grounds in Article 17 applies;
  • restriction: require us to restrict processing in the situations listed in Article 18;
  • data portability: receive personal data you provided to us in a structured, commonly used, machine-readable format and transmit it to another controller, where Article 20 applies;
  • object: object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) (Article 21);
  • withdraw consent: if any specific processing relies on consent, withdraw that consent at any time, without affecting the lawfulness of processing performed before withdrawal;
  • not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Article 22).

To exercise any of these rights, write to privacy@alatapps.com. We respond within one month, free of charge. We may charge a reasonable fee or refuse manifestly unfounded or excessive requests, in which case we will tell you why.

10. Right to lodge a complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

The Dutch supervisory authority is:
Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag
autoriteitpersoonsgegevens.nl

We would appreciate the opportunity to address any concern directly before you escalate.

11. Automated decision-making and profiling

We do not carry out any automated decision-making, profiling, or scoring on visitors to the Site that produces legal effects or similarly significant effects.

12. Children

The Site is not directed at children. We do not knowingly process personal data of children under 16, the digital age of consent under Dutch law (Article 8 GDPR as implemented by Article 5 of the Dutch GDPR Implementation Act). If you become aware that a child has sent us correspondence containing personal data, please notify us at privacy@alatapps.com and we will delete it.

13. Security

We apply technical and organisational measures appropriate to the risk under Article 32 GDPR. For this Site this includes: HTTPS-only delivery with HSTS preload, a strict Content Security Policy that disallows third-party scripts, fonts, and frames, the standard set of hardening response headers, self-hosted assets, no third-party tracking, and a published security.txt for responsible disclosure.

14. Personal data breach notification

We will assess any actual or suspected breach of personal data we process. Where a breach is likely to result in a risk to your rights and freedoms, we notify the Autoriteit Persoonsgegevens without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we also notify you directly without undue delay, in accordance with Article 34 GDPR, unless one of the exceptions in that Article applies.

15. External links

The Site links to other websites operated by Alatapps, including its products. Once you follow such a link, the privacy policy of the destination site applies. We do not control and are not responsible for the privacy practices of websites we do not operate.

16. Changes to this Policy

We may update this Policy to reflect changes in our processing or in the law. The "Last updated" date at the top of the Policy will change accordingly and a version number will be incremented. Material changes will be highlighted on this page for at least 30 days after they take effect. Where the law requires it, we will obtain renewed consent or notify you directly.

Previous versions of this Policy will be archived here when superseded. Until then, the current version is the only version we have published.

17. Questions

If anything in this Policy is unclear, write to us. We would rather answer a question than have you guess. hello@alatapps.com.