Alloovium procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ • Access control and least-privilege principles; ” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Australian law. Financial and accounting records are retained for seven (7) years in accordance with obligations under the Corporations Act 2001 (Cth) and the Tax Administration Act 1953 (Cth). Security logs and telemetry data are retained for twelve (12) to twenty-four (24) months to ensure system integrity and detect security incidents. Upon termination of the Service, we will delete or anonymise Customer Content within ninety (90) days, unless a longer retention period is required to comply with legal obligations or to establish, exercise, or defend legal claims.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ • APP 8 (Cross-border Disclosure) — before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient does not breach the APPs. See Section 7 (International Transfers). ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We maintain this list and note material changes. For each sub-processor, we apply the principle of least privilege — each third-party system shall only have access to the minimum personal information required to fulfil its purpose. Sub-Processor Purpose Data Categories Location & Transfer Basis Legal Entity Microsoft Azure Primary Hosting Infrastructure Content, User, Performance, Device, Activity Australia/EEA; APP 8 Microsoft Corporation (Australian operations) Google Cloud Hosting Infrastructure (Redundancy) Content, User, Performance, Device, Activity Australia/EEA; APP 8 Google LLC (Australian operations) OpenAI AI model inference and processing Content USA; APP 8 OpenAI Ireland Ltd Langsmith Application Observability, debugging and tracing Content, Activity USA; APP 8 LangChain Inc. San Francisco, CA, USA Supabase Database hosting and authentication User, Content Singapore; APP 8 Supabase Inc. Singapore 049513 Anthropic Model inference and analysis Content USA/EEA; APP 8 Anthropic Ireland, Limited Dublin 4, Ireland Circleback Meeting transcriptions and summarisation User, Content USA; APP 8 CircleBack, Inc. McLean, VA, USA HubSpot CRM, marketing, customer communications User, Content, Support EEA/USA; APP 8 HubSpot Dublin 2, Ireland PostHog Analytics, session tracking User, Content USA; APP 8 PostHog Inc San Francisco, CA, USA ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ No most-favoured-nation or parity commitment is provided unless expressly agreed in a separate written amendment signed by both parties.” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Subscriptions renew automatically for successive terms unless you cancel no later than 60 days before the end of the current term (via the billing portal or written notice to zander@alloovium.com). A notice is effective when received and valid only upon our written confirmation. You retain access through the end of the paid term; refunds are not provided unless required by applicable law.” | Captured 2026-07-19Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.