Privacy Policy

What we collect

Account data: name, email, password hash. Agent data: named access tokens and an audit log of actions (deploys, shares, spending). App usage: for each hosted app we record requests (path, method, status, and the authenticated user's email) so that app owners can see who uses their apps; retention is 60 days. Cookies: session cookies only — no advertising or cross-site tracking.

What we do with it

Operate the service, show owners their apps' analytics, secure accounts, and send transactional email (invitations, summaries). We do not sell personal data or use it for advertising.

Where it lives

Infrastructure providers (subprocessors): Fly.io (compute, São Paulo region), Cloudflare (DNS, storage), Paddle (payments — they are the merchant of record and process billing data), Resend (transactional email). App code and data are stored encrypted at rest where supported; project secrets and AI credentials are encrypted by Alora before storage.

Your rights

You can access, correct or delete your data: project deletion is self-serve; for full account deletion write to hola@alora.build and we will remove your data within 30 days. If you appear as a user of someone else's app, the app owner controls that app's data; we act as processor.

Contact

hola@alora.build — Santiago Infante López, Argentina.