Privacy Policy

Privacy policy summary

Allari, Inc. ("Allari", "we", "our") is the data controller for personal data collected through allari.com, working-session requests, and other direct interactions. When we process personal data on behalf of enterprise clients as part of our managed JD Edwards, SAP, Oracle Fusion Cloud, PeopleSoft, or NetSuite operations, we act as a processor and the client's own privacy notice and data-processing agreement govern that processing. This SSR summary mirrors the visible Privacy Policy at /privacy-policy; the published policy is the controlling document.

Personal data we collect

• Contact data — name, business email, company, role, message content submitted through working-session, contact, and case-study forms.
• Site interaction data — pages viewed, referrer, device and browser type, approximate location derived from IP, and cookie-consent state.
• Marketing engagement data — email opens, clicks, and unsubscribe events for recipients of Allari communications.
• Service operations data — for active clients, the operational telemetry needed to deliver the engagement (ticket metadata, OpenBook® ledger entries, environment access logs). Processed under the client master agreement.

Lawful basis under GDPR Article 6

• Contract (Art. 6(1)(b)) — performing engagement scoping, proposal delivery, and contracted services.
• Legitimate interest (Art. 6(1)(f)) — site security, fraud prevention, essential analytics that do not require consent, and direct marketing to existing business contacts.
• Consent (Art. 6(1)(a)) — statistics cookies (Google Analytics 4) and marketing cookies (Apollo.io visitor identification); withdrawable at any time through the cookie banner.
• Legal obligation (Art. 6(1)(c)) — tax, accounting, and regulatory record-keeping.

Named sub-processors

• Supabase, Inc. — application hosting, authentication, and edge-function delivery for allari.com. Data location: United States (us-east-1). Standard Contractual Clauses in place for EU/UK transfers.
• Apollo.io (ZenLeads, Inc.) — website visitor identification and outbound marketing operations. Loaded only after marketing-cookie consent.
• Google LLC — Google Analytics 4 — aggregate web analytics with IP anonymization. Loaded only after statistics-cookie consent.

Cookies and similar technologies

• Necessary — session continuity, security, contact-form submission, and the cookie-consent state itself. Always on. Lawful basis: legitimate interest.
• Statistics (Analytics) — Google Analytics 4. Off by default. Lawful basis: consent.
• Marketing — Apollo.io visitor identification. Off by default. Lawful basis: consent.

You can withdraw cookie consent at any time through the cookie banner or your browser settings. Blocking cookies may affect Site functionality.

Data retention

• Contact and lead data — retained 24 months after last meaningful interaction, then deleted or anonymized.
• Marketing engagement data — retained 24 months after the last open or click event.
• Client engagement records — retained for the contract term plus 7 years for tax, audit, and regulatory purposes.
• Analytics data — retained 14 months in Google Analytics 4 (default).
• Cookie consent records — retained 12 months from the date of the choice, then re-prompted.

Your rights under GDPR (Articles 12–14) and UK GDPR

If you are located in the EU, UK, or Switzerland you are a data subject under GDPR Articles 12–14 and the following rights apply to you. Data subject rights requests can be sent to privacy@allari.com and we respond within 30 days as required by GDPR Article 12.

• Right of access — obtain a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten") — subject to legal-obligation exceptions.
• Right to restriction of processing.
• Right to data portability for data processed under contract or consent.
• Right to object to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint with a supervisory authority (EU/UK data protection regulator).

California (CCPA / CPRA) rights

California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know what categories of personal information we have collected, used, disclosed, or sold/shared in the prior 12 months.
• Right to delete personal information collected from you, subject to statutory exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information, including cross-context behavioral advertising. Allari does not sell personal information for monetary consideration; the cookie-consent banner controls cross-context sharing.
• Right to limit the use and disclosure of sensitive personal information.
• Right to non-discrimination for exercising any CCPA right.

International transfers

Personal data may be transferred to the United States and other jurisdictions where Allari or our sub-processors operate. For transfers from the EU, UK, and Switzerland we rely on Standard Contractual Clauses and the UK International Data Transfer Addendum.

Controller contact

Allari, Inc. — privacy@allari.com. For California residents, the same address handles CCPA verifiable consumer requests. We honor all verified data subject access, rectification, erasure, and portability requests within 30 days (GDPR) or 45 days (CCPA) of receipt.

Read the full Privacy Policy · Terms of Service · Contact