Legal
Privacy Policy
Last updated: 22 June 2026
This policy explains how Ore Foundry Limited ("Alenity", "we", "us") handles your personal data when you use alenity.co.uk and related services. Ore Foundry Limited is the data controller. Our registered address is 181a Worple Road, London SW20 8RF.
For any privacy question, data request, or complaint, email naomi@alenity.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
1. What we collect
- Account data: email, display name, password hash, and OAuth identifiers if you sign in with Google.
- Estate data you enter: details about the person who died, your relationship to them, dates, documents, addresses, and any free-text you share in the chat.
- Communications: messages we send on your behalf to third-party organisations and their replies.
- Payment data: handled by Stripe, we never see your card number. We store the Stripe customer ID and a record that you paid.
- Usage data: pages viewed, anonymised session recordings (with form inputs masked), device and browser metadata via PostHog.
2. Lawful basis
| Feature | Lawful basis |
|---|---|
| Account creation & sign-in | Contract (Art. 6(1)(b)) |
| Triage chat & workspace | Contract / legitimate interests |
| Notifying organisations on your behalf | Your explicit consent (per organisation) |
| Payments | Contract |
| Analytics & session recording | Legitimate interests (improving the service) |
| Transactional email | Contract |
| Special category data (e.g. health, family details you share) | Explicit consent |
3. How we use your data
- To run the service you signed up for.
- To draft, send and track messages to third-party organisations when you ask us to.
- To take payments and provide receipts.
- To improve the product (anonymised analytics).
- To meet legal obligations (tax, accounting, lawful requests).
We do not sell your data. We do not use your estate data to train public AI models.
4. Who we share data with (processors)
We use the following sub-processors. Each has signed a data processing agreement (DPA) with strong security commitments.
| Processor | Purpose | Region |
|---|---|---|
| Supabase (via Lovable Cloud) | Database, auth, file storage, edge functions | EU |
| Lovable | Hosting and AI gateway | EU / US |
| OpenAI & Google (via Lovable AI Gateway) | LLM inference for chat & document understanding | US / EU |
| Stripe | Payment processing | EU / US |
| Resend | Transactional & outbound email | EU / US |
| PostHog | Product analytics & session recording | EU |
| Vapi | Voice calls to organisations on your behalf | US |
| Browserbase | Headless browser automation for provider lookups | US |
| Firecrawl | Public-website data extraction | US |
Where data leaves the UK/EEA, it is transferred under Standard Contractual Clauses or the UK International Data Transfer Addendum.
5. How long we keep it
| Data | Retention |
|---|---|
| Active account & estate data | Until you delete it or close your account |
| Anonymous triage sessions (no account) | 90 days, then deleted |
| Documents you upload | Until you delete them or close your account |
| Messages to organisations & replies | 2 years (so we can show you what was sent) |
| Payment records | 7 years (UK accounting law) |
| Analytics events | 12 months |
| Backups | Rolling 30 days |
6. Your rights
Under UK GDPR you can ask us to:
- Confirm what we hold about you and give you a copy (right of access).
- Correct anything that's wrong.
- Delete your account and personal data ("right to be forgotten"), subject to legal retention obligations.
- Export your data in a portable format.
- Restrict or object to certain processing.
- Withdraw consent at any time.
Email naomi@alenity.co.uk and we'll respond within 30 days. Self-serve export and delete buttons are on our roadmap.
7. Security
- All data is encrypted in transit (TLS 1.2+) and at rest on our infrastructure providers.
- Database access is gated by row-level security so users only see their own estates.
- Admin access is restricted by role and authenticated via Google SSO.
- Secrets and API keys are stored in a dedicated secrets manager, never in our codebase.
- Session recordings mask passwords and other sensitive input fields by default.
No system is 100% secure. If you believe you've found a vulnerability, please email naomi@alenity.co.uk.
8. Children
Alenity is not intended for anyone under 18.
9. Changes
If we make material changes we'll update the date at the top of this page and, where appropriate, notify you by email.
This policy is provided for transparency and is not a substitute for legal advice on your own data processing.
Questions? Email naomi@alenity.co.uk.
