This policy explains what personal data Allyfolio processes on allyfolio.com and app.allyfolio.com, why, and for how long.
Controller
The controller is Xiamen Miaoerduo Trading Co., Ltd. (厦门妙尔多商贸有限公司), Room 907, No. 221 Jiahe Road, Siming District, Xiamen, Fujian, China, represented by its managing director Bai Yukun (see the imprint). Contact: hello@allyfolio.com.
Cookies
We use only essential cookies, so there is no cookie banner. There are no analytics, advertising or tracking cookies or scripts.
af_session(app, HttpOnly): keeps you logged in; up to 30 days.af_csrf(app): protects forms against cross-site request forgery.af_lang: remembers your language choice; 1 year.af_logged_in=1(no personal data): tells the website to show “Dashboard” instead of “Log in”; removed when you log out.
Website visits
When you visit the site, our servers process your IP address, the requested page, date and time and your browser’s user agent to deliver the site and protect it against abuse (Art. 6(1)(f) GDPR). Server logs are kept for up to 14 days.
Waitlist
If you join the waitlist, we store your email address, language, the time you joined and the time you confirmed (double opt-in). We use it only to tell you about the launch and early-bird pricing (Art. 6(1)(a) GDPR, consent). You can withdraw consent at any time via the link in each email or by writing to us; we then delete the entry.
Free scan
For a free scan we process the URL you enter and your IP address (to limit abuse; kept in memory for at most one hour). The scan results are shown to you and not linked to a person.
Accounts
If you create an account we process your email address, name (optional), a password hash (never the password itself), language, team memberships, invitations and login sessions to provide the service (Art. 6(1)(b) GDPR). You can download all of this data as a file in Settings (“Download my data”) and delete your account there at any time.
Scan data
For monitored sites we store the site address, ownership verification, the pages scanned, the issues found (including short HTML snippets of the affected elements) and the reports and statement drafts you create. Scan pages may by chance contain personal data published on your website; you are the controller for that content and we process it on your behalf under our data processing agreement. Scan history is kept for 12 months (Starter) or 24 months (Business, Agency) and deleted afterwards, or earlier when you delete a site or your account.
Billing
Payments are handled by Paddle (Paddle.com Market Ltd, UK), which acts as Merchant of Record: Paddle is the seller of record, collects payment details, issues invoices and handles VAT. Paddle processes your payment and billing data as an independent controller under its own privacy notice. We receive your customer and subscription IDs, plan, status and billing period, not your card details.
Transactional emails (login links, password resets, invitations, alerts, receipts of account changes) are sent via Resend from servers in the EU (Ireland region). Emails you send to hello@allyfolio.com are received through Cloudflare Email Routing and forwarded to our mailbox.
Processors
- Hetzner Online GmbH (Germany): servers and data storage in the EU (Germany/Finland).
- Cloudflare, Inc.: DNS and inbound email routing. Data may be processed outside the EU; covered by the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
- Resend (Plus Five Five, Inc.): sending transactional email; EU region; transfers covered by Standard Contractual Clauses.
- Paddle: payments as Merchant of Record (independent controller, see above).
Backups of our database are encrypted in transit and kept for up to 30 days.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests and to withdraw consent. You can also complain to a data protection supervisory authority. Contact hello@allyfolio.com.