Who is responsible for what
Data protection law splits responsibility between the business that decides why data is collected and the business that processes it on their behalf. Getting that split right matters more than any badge, so we start there.
Controller and processor
- Your customer data — you are the controller: The contacts, companies, notes and deals you put into Alano are yours. You decide what to collect and why; Alano processes it on your instructions. Under GDPR that makes you the controller and Alano the processor.
- Your account data — Alano is the controller: The information we hold to run the service for you — your name, email, company details and usage data — is ours to be responsible for. There, Alano Tech Pte. Ltd. is the controller.
The distinction has a practical edge: a data subject asking you to delete their record is a request you action inside your own workspace, and one we will support. A request about your own account details comes to us.
GDPR
Alano is designed to meet GDPR obligations, and we have not obtained — and cannot obtain — a GDPR certificate, because no such certification exists. What we can tell you is what is actually in place:
- A data processing agreement is available on request, at hello@alano.ai.
- Access to personal data inside your workspace is restricted by role, by group and by field, and enforced by the database rather than by the interface.
- Access and changes to records are recorded in an append-only audit trail, which is what an accountability obligation asks you to be able to produce.
- We do not sell personal data, and we do not use your CRM data to train AI models without your explicit opt-in.
- Export, correction and deletion requests are handled by our team within 30 days. These are handled over email rather than by self-service tooling in the product — we would rather say so than imply a button exists.
Alano Marketing, our campaign product, additionally records every consent grant and withdrawal with its source and legal basis, maintains suppression lists, and re-checks both at the moment each message is sent. Those controls belong to that product; the CRM sends no bulk mail and has no consent ledger.
Singapore PDPA
Alano is built and operated by Alano Tech Pte. Ltd., incorporated in Singapore, and handles personal data in accordance with the Singapore Personal Data Protection Act. Data protection enquiries go to hello@alano.ai.
Who else processes your data
Running Alano means a small number of other companies handle your data on our behalf. A data processing agreement is not worth much without knowing who they are, so here they are:
| Provider | What it does | What reaches it |
|---|---|---|
| Supabase | Database, authentication and file storage | All CRM records, accounts and attachments |
| Vercel | Serves the web application | Request metadata; no CRM records at rest |
| OpenAI | Powers every AI feature | Only the content needed for the request you made — customer and company details, notes, images you supply |
| Search-based enrichment and translation | Company names, websites and text to be translated | |
| EmailJS | Sends transactional email | Recipient addresses and notification content |
We update this list when it changes. If a change would matter to your assessment, tell us and we will notify you directly.
Where certification actually stands
Alano's infrastructure provider, Supabase, holds SOC 2 Type II and ISO/IEC 27001:2022. Those audits cover the platform Alano runs on: the data centres, the managed database, the storage layer and the provider's own operational controls.
They do not cover Alano's application-level controls — our access model, our change management, our incident response. Alano holds no certification of its own today. We are working toward independent SOC 2 readiness, and we will say so on this page when it is genuinely in place, with a date and a report you can request. Not before.
Making a request
For a data processing agreement, a data subject request, a security questionnaire, or anything else in this area, email hello@alano.ai. We respond to privacy requests within 30 days and usually much sooner.
Overview | Architecture | Deployment | Privacy Policy | Chrome Extension Security | Contact