Privacy Policy

Effective: October 27, 2026.

1. Who we are

This Privacy, Cookie, and Settings Policy (“Policy”) is issued by Alocis, LLC, a limited liability company organized under the laws of the State of Delaware, United States, at 8 The Green, Suite R, Dover, Delaware 19901, United States (“Alocis”, “we”). It covers alocis.com, the application at app.alocis.com, and other sites, APIs, and services that point to this Policy (together, the “Service”).

Alocis provides software-as-a-service infrastructure for digital payments. We are not a bank, payment institution, acquirer, e-money issuer, custodian, or fiduciary. The business that subscribes to the platform (the “Customer”) sells goods or services to end buyers (“Buyers”) and contracts, in its own name, the payment providers it connects to the platform.

Privacy, terms, and other compliance matters: [email protected]. See also our Terms of Use (including Annex A — Data Processing).

2. Scope

This Policy covers the marketing site, the admin dashboard, APIs, webhooks, notifications, pixels, member areas, the buyer portal, and the infrastructure we operate. The payment page and the buyer portal run on the Customer’s behalf. The Customer must publish its own policy toward Buyers. Links we display at checkout are the ones the Customer configures and do not replace the merchant’s legal notice.

Where another country’s law applies extraterritorially — including the EU and UK General Data Protection Regulation (GDPR / UK GDPR), Brazil’s General Data Protection Law (LGPD), or U.S. state laws such as the California CCPA/CPRA — we handle personal data to the extent that law requires. The company’s seat and primary legal framework are those of Delaware and the United States.

3. Roles

We are the controller of account, subscription-billing, security, and dashboard-operations data. For Buyer data entered at checkout or in the buyer portal, the Customer is generally the controller and Alocis acts as a processor (service provider), handling that data under the Customer’s instructions, this Policy, the Terms of Use, and Annex A (Data Processing) to the Terms.

4. Data we process

Depending on how the Service is used, we may process:

• dashboard user registration and access data (name, email, role, authentication logs);
• account and workspace configuration (products, links, coupons, appearance, redirects, third-party credentials stored in protected form);
• transactions and subscriptions (amounts, status, identifiers, metadata, and payment tokens or references);
• Buyer data submitted at checkout or in the buyer portal (name, email, phone, and tax identifier or address when the Customer or the payment method requires them);
• technical records (IP address, user agent, timestamps, session identifiers);
• integration content (webhook URLs, message templates, notification events);
• metadata of calls to payment providers, with sensitive fields redacted under our internal practices.

When the flow uses tokenization in the browser or at the payment provider, the full card number (PAN) and CVV travel between the Buyer’s browser and that provider. Alocis does not store PAN or CVV in clear text.

5. Why we use data

We use data to authenticate users, operate workspaces, orchestrate payments and subscriptions for the Customer, deliver webhooks and notifications, prevent fraud and abuse, provide support, meet legal duties, exercise rights, and, where a lawful basis allows, send product communications. We do not sell personal data. Our own measurement and marketing on the institutional site occur only if you accept them, as described in the cookies section.

Lawful bases may include contract performance, legitimate interests (security, fraud prevention, and improvement of the Service), consent where required, and legal obligation. The Customer is responsible for the lawful basis and for consents toward Buyers.

6. Cookies and similar technologies

Cookies are small files stored in the browser. We may also use local storage. This section is our cookie policy.

Strictly necessary

We use essential cookies for dashboard login and session (including the identity provider), buyer-portal session after an access link, technical checkout correlation, security, and language preference. Without them, login, payment, or parts of the site may fail. In most jurisdictions these cookies do not require consent because they are necessary for the service you request.

Institutional site

On alocis.com, on the first visit, you choose necessary cookies only or also Alocis measurement and marketing cookies. Strictly necessary cookies work without that choice. Site measurement and marketing run only if you accept all. The choice stays in the browser; clearing it brings the notice back. What the Customer installs at checkout does not depend on this notice.

Performance and marketing

Analytics or marketing cookies at checkout appear when the Customer enables a tracking pixel, Google Tag Manager, or an equivalent tool. Third parties (for example Meta or Google) may set cookies such as _fbp, _fbc, or advertising and measurement cookies. That layer belongs to the Customer: the Customer must obtain consent where the law requires it (including the EU, the UK, and certain U.S. states), give notice to Buyers, honor opt-out, and not fire tags where that is prohibited. Alocis supplies the technical mechanism.

Duration and controls

Session cookies expire when the browser closes or when the configured session ends (on the buyer portal, typically about 24 hours). Third-party cookies follow each provider’s policy, often 90 days or longer. You can block or delete cookies in your browser. That may prevent login or completion of payment. For marketing, also use the provider’s preferences (Google, Meta) and whatever the Customer offers at checkout.

We do not respond uniformly to the legacy Do Not Track signal. Where the law requires honoring Global Privacy Control or an equivalent for advertising cookies, the Customer must configure marketing tags to respect that signal.

7. Privacy settings

• Dashboard. Authentication is handled by an identity provider. We recommend multi-factor authentication and revoking access when someone leaves the team. The Customer sets invitations and permissions.
• Checkout. The Customer configures collection of tax identifiers and addresses, URLs for its own privacy policy and terms, recurring-billing consent where relevant, and the post-payment redirect. Checkout session data is technical and short-lived.
• Webhooks and exports. Events (transactions, subscriptions, cart) are sent to the Customer’s URLs, with a signature when configured. The Customer must use HTTPS, validate signatures, and limit retention at the destination. Exported files become the Customer’s responsibility after download.
• Buyer portal. Optional access by a short-lived email link and a session cookie. The Customer decides what the Buyer can do. Data shown is limited to purchases for that email in the workspace.
• Notifications. Email or other channels use the Buyer’s contact details for events the Customer configures. Channel credentials belong to the Customer and are not shown again after they are saved.

We do not control retention periods at payment providers, chargeback logs, the Customer’s email logs, or member-area databases. The Customer must align deletions across every system that receives a copy of the data.

8. Sharing

We share data with processors that help us provide the Service, with providers the Customer enables, and when law, a valid order, or the defense of rights requires it. The list below is illustrative. New platforms may be added quickly and may process data before they are named here. The Customer enables only what it uses and must read each integration’s terms:

• dashboard identity and authentication;
• transactional email or SMTP configured by the Customer;
• payment providers the Customer connects;
• member-area providers, when enabled;
• cloud infrastructure (hosting, database, cache, queues, and object storage);
• measurement tools the Customer installs at checkout.

9. International transfers

Alocis is in the United States, and processors may be in other countries. Where the GDPR, the LGPD, or an equivalent law requires a transfer safeguard, we will use standard contractual clauses or an equivalent mechanism to the extent applicable.

10. Retention

We keep data for as long as needed for the contract, legal duties, the exercise of rights, fraud prevention, and dispute resolution. Some records are deleted on an ongoing basis. The account holder may inactivate the workspace in the dashboard: use of that account is suspended and, after 60 days, the workspace data is deleted, except what the law requires us to keep. Reactivation before that date depends on Alocis. The user’s sign-in account does not end solely because of that inactivation.

Where the law or a competent order so requires, records may remain after a deletion request for the applicable period. Backups may persist for a limited time after deletion and are then removed to the extent technically reasonable.

11. Security and incidents

We use commercially reasonable measures against unauthorized loss, access, disclosure, copying, or alteration. No method of transmission or storage is completely secure.

If we become aware of a security incident that poses a relevant risk or harm to personal data, we will notify the Customer (when we act as processor) and, when the law requires, the competent authority and affected individuals, within a timeframe consistent with the LGPD, GDPR, and other applicable rules, with the information we have at that time, and we will cooperate with the controller Customer in communicating to Buyers.

12. Rights

Where applicable law provides them, you may request access, correction, deletion, portability, restriction, or objection, and you may withdraw consent without affecting prior processing. Buyer requests should go first to the Customer, who is the controller toward them. Requests to us: [email protected] (the single channel for privacy, data-subject requests, account deletion, and compliance matters). We may require proof of identity and forward the request to the Customer when the Customer is the controller.

We confirm receipt within a reasonable time. We respond within 15 (fifteen) days of a verified request under the LGPD, which may be extended by another 15 (fifteen) days with written justification. When the GDPR or UK GDPR applies, the default period is one (1) month, extendable when complexity or volume requires it. California residents: we do not sell or share personal data for cross-context behavioral advertising within the meaning of the CCPA/CPRA, to the extent that law reaches us as a service provider.

Refusing data may prevent us from providing part of the Service. Continued use of the site after this Policy is posted indicates awareness of the practices described here, without limiting any specific consent the law requires.

13. Children

The Service is not directed to anyone under 18. We do not knowingly collect children’s data. If we learn of improper collection, we will delete the data to the extent reasonable.

14. Third-party sites

The Service may link to sites we do not operate. We do not control their content or practices and are not responsible for them.

15. Changes

We may update this Policy by posting a new version on this page, with the date at the top. Continued use after the effective date is awareness of the new version, except where the law requires additional notice or consent.

16. Contact

Alocis, LLC — 8 The Green, Suite R, Dover, Delaware 19901, United States. Compliance: [email protected].