How Allocyn handles personal data.
This notice explains data handling for website visitors, business contacts, account users, and people whose information is managed in a customer workspace.
1. Who operates Allocyn
Allocyn is a product of Innovative Logix, which operates this website and service. The full contracting-entity name, registered address, registration number, and jurisdiction are still being confirmed. Contact us for the details relevant to your order.
2. Contact details
Use the privacy-request form to ask about your personal data or exercise a privacy right. Use the contact form for account or legal questions, and select Security to report a security concern. A dedicated privacy email address is not yet available.
3. EU representative
Whether Allocyn needs an EU representative under GDPR Article 27 is still under review. No EU representative is currently identified on this page. Use the privacy-request form for a privacy question.
4. Scope of this notice
This notice covers visitors to allocyn.com, people who request a demo or trial, billing and business contacts, account users, and people whose information is placed in a customer workspace.
5. Our role and the customer organization role
Innovative Logix may act as controller for website inquiries, trial administration, billing contacts, security records, service administration, and its own permitted communications.
For project, workforce, client, timesheet, and related workspace information entered or connected by a customer organization, Allocyn typically acts as processor under that customer's documented instructions. The customer normally determines the purpose, lawful basis, notices, access, and retention for that workspace information. The final role map remains subject to legal review.
6. Categories of personal data
- ✓Identity, business contact, account, organization, and sign-in information
- ✓Project, portfolio, client, work-item, skill, role, allocation, availability, and timesheet information
- ✓Rates, expenses, approvals, billing contacts, tax identifiers, and transaction records where used
- ✓Support requests, form submissions, marketing preferences, audit history, device, session, security, and diagnostic information
- ✓Integration identifiers and synchronized content chosen by a customer
- ✓AI prompts, supporting workspace context, outputs, feedback, and governance records where an AI feature is used
7. Sources of personal data
Information may come directly from the person, an authorized customer administrator or colleague, a connected service selected by the customer, a browser or device, and payment or service providers used for an agreed purpose.
8. Purposes and legal bases
The table separates each main purpose from the information normally involved and the legal basis relied on. The applicable basis can depend on the relationship, activity, and law of the relevant country.
| Purpose | Information normally involved | Legal basis |
|---|---|---|
| Trial setup, account administration, service delivery, support, and billing | Business contact, account, workspace, support, subscription, and payment records needed for the requested service | Contract performance or steps requested before a business contract |
| Business inquiries and relevant service administration | Contact details, inquiry content, service communications, and limited service-use information | Legitimate interests in responding, operating the business, and improving the service, balanced against individual rights |
| Fraud prevention, service security, audit records, and rights protection | Account identifiers, session information, security events, audit records, and relevant communications | Legitimate interests, legal obligation, or the establishment and defence of legal claims, depending on the activity |
| Tax, accounting, regulatory, and lawful-authority records | Company, billing, transaction, invoice, tax, and legally required correspondence records | Compliance with applicable legal obligations |
| Optional product and educational messages | Business email, communication preferences, campaign source, and delivery or suppression records | Consent or another lawful basis confirmed for the recipient and country; an objection always stops direct marketing |
| Optional analytics, preferences, and advertising technologies | Browser identifiers, preference choices, referral information, and permitted website-use events | Consent where required; optional storage remains off until the visitor makes a choice |
9. Customer-controlled workspace processing
Where Allocyn acts as processor, it handles personal data under the customer organization’s documented instructions and the approved Data Processing Agreement. The customer decides and documents the purpose and lawful basis, provides required notices, and configures access and retention. Allocyn may process limited records as controller where needed for its own security, billing, legal, or service-administration responsibilities.
10. Recipients and subprocessors
Authorized customer users receive information according to organization permissions. Approved providers may process only the information needed for hosting, communications, identity, payment, support, integrations, or AI assistance. Deployment-specific provider information and the items awaiting verification are described on the Subprocessors and Data Transfers pages.
11. International transfers
Hosting, backups, support access, email, payments, integrations, and AI may involve different processing locations. Allocyn does not promise that information always stays in Europe. The locations, transfer arrangements, and safeguards for the live service are still being confirmed.
12. AI-assisted processing
When you use an enabled AI feature, Allocyn may use your prompt and relevant workspace information you can access to produce a summary, explanation, suggestion, estimate, or draft. The AI provider, processing location, retention period, and terms covering model training are still being confirmed.
13. Automated decision-making and human review
Allocyn does not market its AI as making hiring, promotion, dismissal, disciplinary, performance-ranking, or other significant workforce decisions. AI provides suggestions and explanations. People remain responsible for project, staffing, financial, and client decisions.
14. Retention periods and criteria
Current product defaults retain website inquiries for 730 days, incomplete trial requests for 30 days, public analytics events for 395 days, lifecycle email records for 90 days, billing-operation records for 180 days, closed privacy-rights requests for 730 days after their last update, generated export links for up to 30 days, generated reports for 365 days, and integration and notification records for 90 days. These periods are configuration defaults and require production confirmation.
Workspace data remains during the customer relationship and the agreed recovery period. Ending a subscription does not immediately erase the workspace. Permanent deletion is handled by an authorized administrator after the recovery period. Billing, security, legal, dispute, and backup records may have different retention periods. The AI retention period is still being confirmed.
15. Security overview
Allocyn enforces customer-workspace separation in the service, checks roles and permissions, uses protected sign-in cookies, protects stored connection secrets, applies request safeguards, and records supported audit activity. Backup recovery and independent assessment status are stated separately and are not implied by this summary.
16. Individual rights
Depending on the circumstances and applicable law, a person may request access, correction, deletion, restriction, portability, objection, or withdrawal of consent. A person can object to direct marketing at any time.
17. How to submit a rights request
Use the privacy request route and describe the relationship with Allocyn. Identity and authority may need to be verified. For customer-controlled workspace data, the customer organization may need to handle or authorize the request.
18. Right to complain
A person may raise a concern with Allocyn and may also complain to the data-protection supervisory authority in the Member State of their habitual residence, place of work, or place of the alleged infringement. Contacting Allocyn first is welcomed but is not required.
19. Marketing communications
Product and educational emails are optional and are not required for a trial, demo, account, or contract. You can unsubscribe or object at any time. We keep a record of your choice so marketing emails to that address stop. Applicable country rules also apply.
20. Cookies and tracking
Necessary storage operates the website. Preferences, analytics, and advertising technologies require the applicable choice. Rejecting optional technologies does not block normal website access, and settings can be changed from every public-page footer.
21. Children and business-only use
Allocyn is offered for business and professional use and is not directed to children or consumer subscriptions. Customer organizations are responsible for lawful and transparent use of workforce and client information.
22. Changes to this notice
Material changes will be identified through the version and update date. Where a change requires a separate notice or choice, Allocyn will provide it through an appropriate business or account channel.
23. Version history
Version 0.9 · 4 September 2026 · Draft for review.