Legal · privacy notice

Privacy notice

Version 2026.08 · in force from 1 August 2026

1. Who is the data controller

AllyHub Ltd, a UK limited company registered at Companies House under number 15 619 428 with its registered office at 27 Old Gloucester Street, London WC1N 3AX, United Kingdom, is the data controller for personal data processed in the course of operating the Ally cabinet online mentorship suite. Our Data Protection Officer may be reached at dpo@allyhub.org. We are registered with the UK Information Commissioner's Office (ICO) under reference ZA 947 218.

2. What we collect

To provision your Ally cabinet and deliver mentorship sessions we collect:

Account identifiers — your email address (required for magic-link sign-in) and an optional display name.
Session data — the sessions you book, join, cancel or reschedule; the mentor matched to you; session timestamps and duration.
Cabinet content — shared session notes, homework entries, message threads, uploads you attach. This is your content; we store it on your behalf and do not read it except in the narrow situations described in section 4.
Video call metadata — call start and end timestamps, room ID, connection quality summaries. The media stream itself is end-to-end encrypted and is not stored server-side unless both parties click Record inside the room.
Sign-in security data — a hash of the magic-link token (never the plain link), the IP address of the sign-in request, the user agent string, and the resulting session cookie identifier. Used to display the sessions & devices list and to detect suspicious sign-in patterns.
Billing data — plan, price, VAT status, invoice reference. Payment card details are handled by our processor and are never stored on Ally infrastructure.
Support correspondence — emails you send the support desk, held for 24 months for audit unless you request earlier deletion.

3. Why we collect it (legal bases)

Contract (UK GDPR Art. 6(1)(b)) — for account identifiers, session data, cabinet content and billing. Without these we cannot deliver the service you signed up for.
Legitimate interest (UK GDPR Art. 6(1)(f)) — for sign-in security data (defence against account takeover) and aggregate service-improvement metrics.
Legal obligation (UK GDPR Art. 6(1)(c)) — for invoice records, retained six years under HMRC rules.
Consent (UK GDPR Art. 6(1)(a)) — for optional analytics cookies and for opt-in call recording.

4. Who sees your data

Your matched mentor sees: your display name, the sessions you have booked with them, the shared session notes you both edit, the homework items you both agreed on, and the message threads you send them. Your mentor does not see: your email address, your billing details, your other mentors (if you have any), your private homework note field.

AllyHub staff do not access individual cabinet content except: (a) where you explicitly request support that requires it, and only for the minimum time necessary, logged in a support ticket; (b) where required by lawful order (a court order or a valid regulator request under UK law); (c) in response to a suspected security incident where evidence needs to be preserved.

5. Processors we use

We rely on a small number of processors, each bound by a contract meeting UK GDPR Article 28 requirements:

Hosting — Hetzner Online GmbH (Falkenstein, Germany) for application servers; data resides in the EU. UK-EU adequacy under the UK Adequacy Regulations 2021.
Object storage — Cloudflare R2 (London) for uploads and PDF exports.
Email — Postmark (Wildbit LLC, US) for transactional magic-link and notification emails; UK-US data transfer under the UK Extension to the EU-US Data Privacy Framework.
Payments — Stripe Payments UK Ltd (London) and GoCardless Ltd (London) for card and Direct Debit; both are UK-established, no cross-border transfer.
Analytics — Plausible Analytics (EU-hosted), cookie-less, aggregate only.
Video — LiveKit (self-hosted on our Hetzner infrastructure) for the video-room signalling. Media is end-to-end encrypted between browsers.

6. How long we keep it

Cabinet content — for as long as your Ally account exists; you may delete individual items at any time.
Sign-in security data — 90 days rolling for IP and user agent; the session cookie identifier lives as long as the session.
Invoice records — six years, as required by HMRC.
Support correspondence — 24 months, or less on request.
Backups — encrypted, held for 35 days rolling, then destroyed.

7. Your rights under UK GDPR

You have the right to: access your data (Article 15); rectify inaccurate data (Article 16); erase your data (Article 17) — see the one-click account deletion; restrict processing (Article 18); portable export of your data (Article 20) — see account settings → data export; object to processing based on legitimate interest (Article 21); withdraw consent at any time for consent-based processing. To exercise any of these rights, email dpo@allyhub.org. We respond within one month.

8. International transfers

Where personal data leaves the UK we rely on the UK Adequacy Regulations 2021 (for EU/EEA processors) or the UK International Data Transfer Agreement (IDTA) with additional safeguards for other jurisdictions. Detail of the specific transfers is available on request from the DPO.

9. Security

We follow industry practice: TLS 1.3 for all transport; AES-256 encryption at rest; magic-link tokens hashed with Argon2id server-side; principle of least privilege for staff access with all admin actions logged and reviewed monthly. Full detail is in the security whitepaper.

10. Cookies

See the full cookies policy. In short: one first-party session cookie (aa_sid) needed for sign-in; one first-party preference cookie (aa_c) recording your cookie choice; optional analytics through Plausible (cookie-less by design). No third-party trackers.

11. Complaints

If we cannot resolve a data-protection matter to your satisfaction, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, website ico.org.uk. Our ICO registration reference is ZA 947 218.

12. Changes to this notice

Material changes will be notified to you by email at least thirty days in advance. The version currently in force is at the top of this page; superseded versions are archived and available on request from the DPO.