Privacy Policy

This explains what personal data Alongpad collects, why, who else handles it, and what you can do about it. If you have a question, email me at hello@alongpad.com.

1. Who I am

Alongpad is run by me, James Graham, trading as Alongpad (part of AutomatedPanda). It's a one-person business, not a registered company.

• Email: hello@alongpad.com

2. Two roles, depending on the data

Where I'm the controller. For the data I need to run Alongpad as a business (your account, billing, the marketing site, logs and security), I decide how it's used, so this policy applies directly.

Where your agency is the controller. If you're a client of an agency that uses Alongpad, the agency decides what goes into your workspace and who can see it. For that content I'm the agency's processor, and I only handle it to run Alongpad for them. The agency's own privacy notice covers what they do with it, so requests about it go to them, and I'll help them answer. If you contact me about it, I'll pass your request on.

Your own account. Everyone, clients included, controls their own account (name, email and password). You can change it yourself or ask me about it directly at hello@alongpad.com.

3. What I collect

• Account details: your name, email address and password. Passwords are stored hashed by Supabase Auth, never in plain text.
• Organisation details: your organisation's name and its branding (logos and colours).
• Workspace content: priorities, notes, comments and files that you, your team and your clients upload.
• Billing: Stripe handles payments as the reseller (see section 5). From Stripe I get your customer and subscription status, plan, seat count, billing period dates and the email used. I never see your full card details.
• Logs: hosting and database logs, such as when requests happen and errors occur. These may include IP addresses.
• Cookies: see section 7.

4. Why I use it, and the legal basis

I don't sell personal data.

Emails. At launch I only send service emails (the ones in the table above). Later, I might send occasional emails about Alongpad, and only Alongpad, to people who started signing up but didn't finish and to customers who've cancelled. That's allowed under the soft opt-in rule in PECR (the UK's electronic marketing rules). You can tick "Don't send me occasional emails" when you sign up, and every one of these emails has an unsubscribe link.

5. Who else handles it

I use these services to run Alongpad (my sub-processors):

Stripe also acts as a controller for the payment data it collects at checkout, under its own privacy policy. You can read Stripe's privacy policy and Link's privacy policy.

If I add or replace a sub-processor, I'll email organisation owners at least 30 days before.

I might also share data if the law requires it, or with someone who takes over Alongpad, in which case I'll tell you.

6. Data outside the UK

Some of these services store or access data outside the UK. Where they do, the transfer is covered by the safeguards UK law requires, such as UK adequacy regulations or the UK International Data Transfer Addendum. Your workspace data is stored in the United States (Supabase, East US). That transfer is covered by Supabase's data processing agreement, which includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

7. Cookies

• In the app: I only use the cookies needed to keep you signed in. You can't turn these off and still use Alongpad. There's no analytics in the app.
• On the marketing site (alongpad.com): I use Google Analytics with Google's Consent Mode in basic mode. That means nothing is sent to Google unless you accept. You can change your mind at any time from the "Cookie settings" link in the site footer.

8. How long I keep it

• While your organisation is active: for as long as you have an account.
• After you cancel: your organisation goes read-only for 30 days so you can export it, then it's deleted. You can also choose to delete it straight away.
• Backups: I take daily database backups and keep them for 7 days. Deleted accounts are removed from the live database when they're deleted and age out of the backups within 7 days.
• Billing records: 6 years, because HMRC requires it.
• Logs: up to 30 days, for security and fault-finding.

9. Your rights

Under UK data protection law you can ask me to:

• give you a copy of your personal data;
• correct it if it's wrong;
• delete it;
• restrict or object to how I use it;
• give it to you, or another service, in a portable format.

Where I rely on consent (analytics cookies), you can withdraw it at any time.

To use any of these rights, email hello@alongpad.com. I'll reply within one month. If the request is about content in an agency's workspace, I'll pass it to that agency, since they control it, and help them answer.

If you're not happy with how I've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. I'd appreciate the chance to put it right first.

10. Security

These are the measures I have in place:

• all traffic goes over HTTPS;
• passwords are stored hashed by Supabase Auth, never in plain text;
• the database uses row-level security so one organisation can't read another's data, and that's tested automatically;
• secret keys are kept on the server only;
• the database is backed up daily;
• a bot check (Cloudflare Turnstile) runs on sign-up;
• only I have access to production.

No system is perfect. If a breach affects an organisation's data, I'll tell its owner without undue delay and within 48 hours of finding out, and I'll tell you and the ICO where the law requires it.

11. Children

Alongpad is for businesses and isn't meant for children. You need to be at least 18 to use it.

12. Changes

If I change this policy in a way that matters, I'll email organisation owners at least 30 days before it takes effect and update the date at the top.