Privacy Policy

Who we are

AllotMe Ltd ("we", "us", "our") operates AllotMe Plots, a platform for managing UK allotment associations. We are registered in England and Wales.

What data we collect

From association admins who sign up: your name, email address, password (hashed), and the name and contact details of your association.

From your members, added by you: name, email, phone number, postcode, address, and plot assignment. You provide this data as part of managing your association.

From members paying rent online: Stripe collects payment card details directly. We never see or store card numbers. We only receive confirmation of successful payments.

Usage data: we log basic activity (logins, feature use) to understand how the platform is used and improve it.

Legal basis

We process data on two legal bases:

• Contract: processing is necessary to provide the Service you've subscribed to.
• Legitimate interest: we process limited usage data to maintain and improve the platform, detect abuse, and secure the service.

Data controller and processor roles

For your association's admin account data, AllotMe Ltd is the data controller. For your members' data that you enter into the platform, your association is the data controller and AllotMe Ltd is the data processor.

Who we share data with

We use these sub-processors to run the Service:

• Stripe, Inc. for processing online rent payments (privacy policy: stripe.com/privacy)
• MailerSend for sending transactional emails (rent requests, reminders, confirmations)
• Render for hosting the web application
• Google Cloud Platform (GCP) for the managed MySQL database (europe-west2, London)

We do not sell your data or share it with advertisers.

Data retention

While your subscription is active, we retain all data you've entered. If you cancel, we retain your data for 90 days to allow export or restoration, then delete it.

Some data (billing records, legal compliance) may be retained longer where required by law.

Your rights

Under UK GDPR, you have the right to:

• Access a copy of your data
• Correct inaccurate data
• Delete your data
• Port your data to another service
• Object to processing
• Lodge a complaint with the UK Information Commissioner's Office (ICO)

To exercise any of these rights, email privacy@allotme.co.uk.

Security

We use industry-standard security practices: encrypted connections (TLS), hashed passwords (bcrypt), database access controls, and Stripe's PCI-compliant payment processing. We do not store any card details ourselves.

International transfers

Your data is stored in the UK or EU. Some sub-processors (Stripe) may transfer data outside the EU under appropriate safeguards such as Standard Contractual Clauses.

Changes to this policy

We will notify account owners by email of any material changes at least 14 days in advance.

Contact

Privacy questions: privacy@allotme.co.uk