Legal
Last updated: August 13, 2026
Alvor Pty Ltd (ABN 40 700 022 546) (“Alvor”, “we”, “us”, or “our”) is an Australian company. We are committed to protecting your personal information and handling it in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This Privacy Policy explains what personal information we collect, how we collect, use, disclose, store, and protect it, and how you can access, correct, or complain about our handling of it. It applies to our website at alvor.io and to the Alvor platform.
Customer Data. When our business customers use the Alvor platform, they may upload information (which can include personal information about their own staff, customers, or vendors). We process that information on our customer's behalf and under our agreement with them; the customer controls how it is handled. We refer to it as “Customer Data”. This policy governs the personal information we handle in our own right, not Customer Data (see “Customer Data” below).
Account information. When you register for an account, we collect your name, email address, company name, job title, and password.
Usage data. We automatically collect information about how you interact with our platform and website, including pages visited, features used, timestamps, IP address, and device information such as browser type and operating system.
Communications. When you contact us or request a demo, we collect the information you provide, including your name, email, company, role, and any additional details you share.
Cookies and analytics. We use cookies and similar technologies to maintain session state, remember preferences, and understand usage patterns. For analytics we use Google Analytics and PostHog (hosted in the EU). Google Analytics is gated behind your consent. PostHog runs a cookieless, anonymous visitor measurement by default (no cookies, nothing stored on your device, a short-lived server-generated identifier) under our legitimate interest in understanding how the site is used; it is first-party and not used to track you across other sites, and you can opt out at any time by choosing “Reject” or using Cookie Settings. Accepting upgrades PostHog to full, cookie-based analytics. See our Cookie Policy for details, including how to change your choice at any time.
Demo request analytics. If you accept analytics and submit a demo request, we associate the request with the domain of your work email (the part after the “@”) so we can understand which organisations are interested. We do not derive this in the cookieless mode.
We do not seek to collect sensitive information (as defined in the Privacy Act, such as health information or information about your racial or ethnic origin, political or religious beliefs). Please do not send us sensitive information unless it is necessary.
We collect personal information directly from you when you register, complete a form, request a demo, or correspond with us. We collect usage data automatically through cookies, analytics, and server logs when you use our website or platform. We may also collect personal information from third parties, for example when your employer invites you to their workspace, or from publicly available business sources. Where we collect your personal information from someone other than you, we take reasonable steps to make you aware of this policy.
We use the personal information we collect to:
We only use your personal information for the purpose for which it was collected, a related purpose you would reasonably expect, or as otherwise permitted or required by law.
We may send you marketing communications about our products and services where you would reasonably expect it or where you have consented. Every marketing message includes a way to opt out, and you can opt out at any time by using the unsubscribe link or emailing privacy@alvor.io. We handle marketing consistently with the Spam Act 2003 (Cth). We do not sell your personal information, and we do not disclose it to third parties for their own direct marketing.
We do not sell your personal information. We may disclose it to:
Some of these recipients are located overseas. See “Overseas Disclosure” below.
We host the Alvor platform and website primarily on Amazon Web Services infrastructure located in Australia (Sydney). However, some of our service providers are located overseas, which means your personal information may be disclosed to, or accessed from, outside Australia. The overseas recipients and the countries in which they are likely to handle your information are:
Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contractual data-protection terms.
We take reasonable technical and organisational measures, appropriate to the risk, to protect your personal information against misuse, interference, loss, and unauthorised access, modification, or disclosure. No method of transmission or storage is completely secure, but we work to protect your information and to respond appropriately if a risk arises.
We retain your personal information only for as long as needed for the purposes for which it was collected, while your account is active, or as required by law. If you request account deletion, we will remove your personal information within a reasonable time, except where retention is required by law or for legitimate purposes such as dispute resolution. We take reasonable steps to destroy or de-identify personal information we no longer need.
Where you use the Alvor platform, information you upload (including any personal information about other people) is processed on your behalf and governed by your agreement with us, not by this policy. You are responsible for that information as its controller. If you are an individual whose personal information may be held in a customer's Alvor workspace and you wish to access, correct, or delete it, please contact that organisation directly; we will assist our customer to respond as required.
Our AI Assistant operates on a bring-your-own-model basis: you connect your own model provider, and any personal information processed through it is handled under your own arrangement with that provider, not as a sub-processor of ours. We do not use Customer Data to train machine-learning models except as described in your agreement with us or with your consent.
You may request access to, or correction of, the personal information we hold about you by contacting our Privacy Officer at privacy@alvor.io. We will respond within a reasonable time (usually within 30 days) and may need to verify your identity first. Access is generally free, and we will tell you in advance if a reasonable cost applies. If we decline a request, we will explain why and how you can complain.
If a data breach occurs that is likely to result in serious harm to affected individuals, we will assess it and, where the Notifiable Data Breaches scheme under the Privacy Act applies, notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.
If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please contact our Privacy Officer at privacy@alvor.io. We will acknowledge your complaint, investigate it, and aim to respond within a reasonable time (usually within 30 days).
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, by phone on 1300 363 992, or by writing to GPO Box 5218, Sydney NSW 2001.
If you are located in the European Economic Area (EEA) or the United Kingdom (UK), the EU General Data Protection Regulation or the UK GDPR applies to our handling of your personal information, in addition to the Australian Privacy Principles. For the personal information we collect in our own right, Alvor Pty Ltd is the controller; where we process Customer Data on a customer's behalf, that customer is the controller and we act as processor.
Legal bases. We rely on the following legal bases to process your personal information:
International transfers. We are based in Australia and use service providers in Australia, the European Union, and the United States. Where we transfer personal information out of the EEA or UK to a country that is not the subject of an adequacy decision (which includes Australia and the United States), we rely on appropriate safeguards, primarily the European Commission's Standard Contractual Clauses and the UK Addendum, together with the data-protection terms we have in place with those providers.
Your rights. You have the right to access, rectify, erase, restrict, or port your personal information, to object to processing based on legitimate interests or to direct marketing, and to withdraw consent. To exercise any of these rights, contact privacy@alvor.io. You also have the right to lodge a complaint with your local supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the data protection authority in your country.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the “Last updated” date. Your continued use of our services after changes take effect constitutes acceptance of the revised policy.
If you have questions or concerns about this Privacy Policy or our data practices, please contact our Privacy Officer at Alvor Pty Ltd (ABN 40 700 022 546), privacy@alvor.io.