Legal · Privacy

Privacy Policy

This Privacy Policy explains how Alatapps ("we", "us", "our") processes personal data when you visit alatapps.com (the "Site") or write to us at an address ending in @alatapps.com. It is written to meet our obligations under the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the Dutch GDPR Implementation Act (Uitvoeringswet AVG, "UAVG") and other applicable Dutch and EU privacy law.

Alatapps is an independent software studio. We publish our own apps, of which Preemie Companion is the first. Each Alatapps product has its own Privacy Notice that supplements this Policy and applies to the processing performed inside that product. This Policy covers the corporate website and direct correspondence with us as a company. For Preemie Companion specifically, see the Preemie Companion Privacy Notice.

At a glance

The summary above is informational. The sections that follow are the binding text of this Policy.

1. Controller and contact

Alatapps is the data controller for the personal data described in this policy.

We are not required to appoint a Data Protection Officer for the processing described in this policy.

Change in version 1.3: we have clarified the retention period for enquiry conversations and the recovery period in Trash.

2. Scope

This Policy applies to:

• your visit to alatapps.com and the static pages served from it;
• email correspondence with us at addresses ending in @alatapps.com; and
• requests, complaints, and rights-exercises you direct to us as a company.

Where you write to us about an Alatapps product, your message arrives in the same corporate inbox covered by this Policy. If we need to involve the team responsible for that product to answer you, we forward the relevant parts of your message internally; from that point the Privacy Notice of the product also applies. We do not share product correspondence outside Alatapps.

This Policy does not cover personal data processed inside an Alatapps product. Each product has its own Privacy Notice that supplements this Policy:

• Preemie Companion Privacy Notice: for the Preemie Companion app and web service.

When you reach a product’s domain, the Privacy Notice of that product governs the processing performed inside it.

3. Categories of personal data we process

The Site provides information about our studio and an enquiry form. Our processing is intentionally limited.

3.1 Server-log data (automatic, when you load any page)

• your IP address;
• the date and time of the request;
• the URL or path requested and the HTTP response code returned;
• the User-Agent string sent by your browser;
• the Referer header, if any, sent by your browser;
• the approximate edge location that served the request.

This is collected by our hosting provider on our behalf as a sub-processor (see Section 6) and used solely for security, abuse prevention, and operating the Site. We do not export, enrich, or combine these logs with any other data set.

3.2 Email correspondence (only if you write to us)

• your email address and display name;
• the content of your message and any attachments;
• the timestamp and routing metadata of the message.

3.3 Enquiry form

When you submit the form, we process your chosen starting point, description, name and email address. Your organisation and a link to an existing application are optional. We use these details to assess and answer your enquiry. Please do not include medical information or other sensitive personal data.

A draft stays only in the open page's memory so you can change direction or close the panel. It is not saved in browser storage. The contents are sent to our server only on submission. To prevent abuse, the server uses a signed form check and a temporary value derived from your IP address; this counter expires after 10 minutes. We do not write form contents to a separate database or application log.

3.4 DNS resolution data

Our DNS provider (see Section 6) processes IP addresses of resolvers and end users as part of resolving the alatapps.com domain. This is intrinsic to how the public DNS system works and is not avoidable for any operator of an internet domain.

We do not collect or process: account credentials, payment information, biometric data, special-category data within the meaning of Article 9 GDPR, advertising or marketing identifiers, behavioural-tracking data, or device fingerprints.

4. Purposes and lawful bases

Scroll the table sideways to read all columns.

You have the right to object to processing based on Article 6(1)(f) on grounds relating to your particular situation. See Section 9.

5. Cookies and similar technologies

The Site sets no cookies. We do not use:

• analytics or measurement cookies (no Google Analytics, no Plausible, no self-hosted equivalent);
• advertising cookies, retargeting pixels, or social-media plugins;
• browser-storage entries (no localStorage, no IndexedDB, no sessionStorage);
• device-fingerprinting techniques;
• third-party fonts or other third-party assets that would expose your IP address to another party while you read the page.

Because no cookies or comparable technologies are placed on your device, no consent banner appears and none is required under Article 11.7a of the Dutch Telecommunications Act.

6. Sub-processors and recipients

We use the service providers below for hosting, DNS and email. Their data processing terms describe the data they process for customers and the applicable security and international transfer arrangements.

Scroll the table sideways to read all columns.

Where a sub-processor maintains certification under the EU-US Data Privacy Framework, we also rely on that certification as recognised by Commission Implementing Decision (EU) 2023/1795.

We do not share personal data with any other recipient, except where compelled by a binding legal order valid under EU or Dutch law. Where lawful, we challenge overly broad orders.

7. International transfers

Personal data processed by the sub-processors listed in Section 6 may be transferred to or accessed from the United States. We rely on Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) as the primary safeguard under Chapter V GDPR, and, where the relevant sub-processor is so certified, on the EU-US Data Privacy Framework. The providers’ data processing terms also describe their technical and organisational security measures. Resend stores message content in the United States; choosing a European sending region does not change that storage location. You may obtain a copy of the relevant safeguards by writing to us.

8. Retention

• Server logs: retained by our hosting sub-processor in accordance with their plan-tier retention policy and then deleted automatically. We do not export, copy, or extend that retention except where strictly necessary to investigate a specific security incident, in which case the relevant excerpts are kept for the duration of that investigation and for no longer than 12 months thereafter.
• Form enquiries and enquiry conversations by email: we retain these while the enquiry remains active. If no new message has been received or sent in the conversation for 3 years, we move it to Trash during cleanup. It remains recoverable there for up to 30 further days before Gmail permanently deletes it. Active matters and correspondence we must legally retain for longer are excluded from this cleanup.
• Other business correspondence: we retain this for as long as needed for the relevant working relationship or our legal obligations. Accounting-relevant correspondence is subject in particular to the 7-year fiscal retention obligation under Article 52 of the Dutch General Tax Act. This correspondence is excluded from automated enquiry cleanup.
• Temporary storage by Resend: in addition to the copy in our company inbox, Resend stores message content and delivery logs. According to Resend’s retention information, Free, Pro and Scale plans retain this data for 30 days; Enterprise may use a different period. Backups persist for 7 days. This provider storage is separate from the retention of our correspondence.
• DNS data: ephemeral. We do not retain DNS query data ourselves. Sub-processor retention is governed by the sub-processor’s own policies.
• Records of rights-exercises and complaints: 3 years after closure, to demonstrate compliance under Article 5(2) GDPR.

9. Your rights

Subject to the conditions and exceptions in the GDPR, you have the right to:

• access: obtain confirmation of whether we process personal data about you and a copy of that data (Article 15);
• rectification: have inaccurate data corrected and incomplete data completed (Article 16);
• erasure: have personal data erased where one of the grounds in Article 17 applies;
• restriction: require us to restrict processing in the situations listed in Article 18;
• data portability: receive personal data you provided to us in a structured, commonly used, machine-readable format and transmit it to another controller, where Article 20 applies;
• object: object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) (Article 21);
• withdraw consent: if any specific processing relies on consent, withdraw that consent at any time, without affecting the lawfulness of processing performed before withdrawal;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Article 22).

To exercise any of these rights, write to privacy@alatapps.com. We respond within one month, free of charge. We may charge a reasonable fee or refuse manifestly unfounded or excessive requests, in which case we will tell you why.

10. Right to lodge a complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

We would appreciate the opportunity to address any concern directly before you escalate.

11. Automated decision-making and profiling

We do not carry out any automated decision-making, profiling, or scoring on visitors to the Site that produces legal effects or similarly significant effects.

12. Children

The Site is not directed at children. We do not knowingly process personal data of children under 16, the digital age of consent under Dutch law (Article 8 GDPR as implemented by Article 5 of the Dutch GDPR Implementation Act). If you become aware that a child has sent us correspondence containing personal data, please notify us at privacy@alatapps.com and we will delete it.

13. Security

We apply technical and organisational measures appropriate to the risk under Article 32 GDPR. For this Site this includes: HTTPS delivery with HTTP Strict Transport Security (HSTS), a strict Content Security Policy that disallows third-party scripts, fonts, and frames, the standard set of hardening response headers, self-hosted assets, no third-party tracking, and a published security.txt for responsible disclosure.

14. Personal data breach notification

We will assess any actual or suspected breach of personal data we process. Where a breach is likely to result in a risk to your rights and freedoms, we notify the Autoriteit Persoonsgegevens without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we also notify you directly without undue delay, in accordance with Article 34 GDPR, unless one of the exceptions in that Article applies.

15. External links

The Site links to other websites operated by Alatapps, including its products. Once you follow such a link, the privacy policy of the destination site applies. We do not control and are not responsible for the privacy practices of websites we do not operate.

16. Changes to this Policy

We may update this Policy to reflect changes in our processing or in the law. The "Last updated" date at the top of the Policy will change accordingly and a version number will be incremented. Material changes will be highlighted on this page for at least 30 days after they take effect. Where the law requires it, we will obtain renewed consent or notify you directly.

You can request a previous version of this Policy at privacy@alatapps.com.

17. Questions

If anything in this Policy is unclear, write to us. We would rather answer a question than have you guess. hello@alatapps.com.