Privacy Policy

Allera Technologies, Inc. · Effective July 28, 2026 · Last updated July 28, 2026

‍

1. Introduction

Allera Technologies, Inc. ("Allera," "we," "us") provides a multi-tenant SaaS platform for compliance and food-safety document and form management. This Privacy Policy explains how we collect, use, share, and protect personal data.

This policy covers personal data for which Allera is the controller: visitors to our website, prospects, and the business contacts who administer or use accounts. Where Allera processes personal data on behalf of a business customer (data our customers submit into the platform), the customer is the controller of that data and their agreement with us, including any Data Processing Addendum, governs that processing. See Section 11.

‍

2. Personal data we collect

• Identity data: name, username, and professional profile information.
• Contact data: email address, phone number, and business address.
• Technical data: IP address, login data, browser type and version, operating system, and device information.
• Usage data: information about how you interact with our website and services.

We do not intentionally collect special categories of personal data (such as health or biometric data) about website visitors.

‍

3. How we collect personal data

We collect personal data directly from you (for example, when you register, contact us, or use the services), automatically as you interact with our website and services (see Section 5), and from business customers who provision users on their account.

‍

4. How we use personal data and legal bases

We use personal data to: create and administer accounts; provide, maintain, and secure the services; respond to requests and provide support; communicate about the services; conduct business administration; and carry out marketing where permitted. Where the GDPR or UK GDPR applies, our legal bases are performance of a contract, our legitimate interests (operating and securing the services), compliance with legal obligations, and consent where required.

‍

5. Cookies, analytics, and session replay

We use cookies and similar technologies as follows:

• On our public website (alleratech.com): strictly necessary cookies to operate the site, and product-analytics to understand visits. We do not record session replays on our public website.
• In our application (dashboard.alleratech.com): product-analytics tooling to understand how the services are used and to improve them, including session replay, which records interactions with the application interface. We configure session replay to mask sensitive on-screen input so that personal data entered into forms is not captured in recordings.

You can control non-essential cookies through your browser settings or any cookie controls we provide.

‍

6. Artificial intelligence and automated processing

The platform uses AI and large language model (LLM) inference to evaluate and assist with compliance content submitted to the services. Content submitted by a business customer is processed to provide the customer's requested functionality and is handled in accordance with the customer's agreement. Our AI processing providers are bound by confidentiality obligations and by contractual terms that prohibit using customer content to train their models. We do not use this processing to make decisions that produce legal or similarly significant effects about individuals without a lawful basis.

‍

7. How we share personal data

We share personal data only as needed to operate the services:

• Service providers (subprocessors): we use vetted third parties for hosting and cloud infrastructure, AI inference, analytics, collaboration and communication, and business operations. These providers may process personal data only on our instructions and under confidentiality and data-protection obligations. We maintain a current list of subprocessors at our Trust Center (https://trust.alleratech.com).
• Legal and safety: where required by law, legal process, or to protect our rights, users, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell your personal data, and we do not allow our service providers to use it for their own purposes.

‍

8. International data transfers

Our services are hosted in the United States (Amazon Web Services, US region). If you access the services from outside the United States, your personal data will be transferred to and processed in the United States. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses.

‍

9. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy and to meet legal, accounting, or reporting requirements. Personal data that a business customer submits into the platform is retained for the term of that customer's agreement and is not deleted below the customer's own regulatory retention obligations (for example, FSMA/FDA recordkeeping), which remain the customer's responsibility. Security and system logs are retained for approximately one year.

‍

10. How we protect personal data

We maintain administrative, technical, and physical safeguards designed to protect personal data, including:

• Encryption of data in transit (TLS) and at rest.
• Access controls: least-privilege access, single sign-on, and multi-factor authentication for administrative access; access is reviewed on a recurring basis and revoked promptly on personnel changes.
• Network protection and monitoring: production systems run in isolated private networks with managed threat detection and audit logging.
• Personnel safeguards: background checks, confidentiality agreements, and recurring security-awareness training.

Allera maintains a formal information security program and is undergoing a SOC 2 Type 2 examination covering the Security and Confidentiality criteria. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

‍

11. Personal data processed on behalf of business customers

Where Allera processes personal data that a business customer submits into the platform, the customer is the controller of that data. If you are an end user of a customer's account and wish to exercise your rights or have questions about that data, please contact the relevant customer (the controller). We will assist our customers in responding to such requests as required by our agreement and applicable law.

‍

12. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data; to data portability; and to withdraw consent. If you are a California resident, you may have the right to know what personal data we collect, to request deletion or correction, and to opt out of the "sale" or "sharing" of personal data (we do not sell or share personal data as those terms are defined). We will not discriminate against you for exercising these rights.

To exercise any right, contact us at trust@alleratech.com. We will respond as required by applicable law and may need to verify your identity.

‍

13. Children's privacy

The services are intended for business use and are not directed to children. We do not knowingly collect personal data from children under 16 (or the age defined by applicable local law). If you believe a child has provided us personal data, contact us and we will delete it.

‍

14. Changes to this policy

We review this policy at least annually and update it when our practices or applicable law change. Material changes will be posted here with an updated effective date.

‍

15. Contact us

Allera Technologies, Inc. 917 E 16th St, Chattanooga, TN 37408 Email: contact@alleratech.com (privacy inquiries: trust@alleratech.com)

‍