Privacy Policy
Alluvial | Effective date: 10 October 2026
1. Who we are
Alluvial is operated by Aptitude Solutions Ltd, a company registered in England and Wales (company number 17476747), whose registered office is at 167 - 169 Great Portland Street, 5th Floor, London, England, W1W 5PF ("we", "us", "our"). Our registration with the Information Commissioner's Office (ICO) is pending, and we will add our registration number here once it is issued.
This policy forms part of our Terms and Conditions. It explains how we handle personal data when you visit our website, use Alluvial (including our app, API, extensions and integrations) or contact us. Please read it with our Cookie Policy. Questions go to enquiries@alluvial.ac.
2. Our role
We are the controller of the personal data we use for our own purposes: account, billing, usage, support and marketing data, and the scan history, metadata and feedback we use to improve Alluvial.
We are a processor of the manuscripts and other content you submit for analysis ("Input") and the results we generate from them ("Output") where that content contains personal data about other people, such as student work or documents written by staff. In that case the customer (for example, your school, university or employer) is the controller. We process Input and Output only on its instructions, under our Data Processing Agreement, and you should send requests about that data to the customer first.
3. What we collect and why
| Data | Examples | What we use it for | Lawful basis (UK GDPR) |
|---|---|---|---|
| Account and organisation data | Name, email, organisation, role, password (hashed), single sign-on identifier | Creating and managing your account and providing the Services | Contract |
| Billing data | Billing name and address, order history, limited payment details from our payment processor (we do not store full card numbers) | Taking payment and keeping financial records | Contract; legal obligation |
| Input and Output | Manuscripts, text, files, scan results and reports | Analysing your content and returning results | Contract; or the customer's instructions where we act as processor |
| Scan history, metadata and feedback | Timestamps, scores, document length, settings used, feedback you give | Testing, securing, maintaining and improving Alluvial | Legitimate interests (improving and securing our service) |
| Service analytics | Consent state, pseudonymous browser and Account identifiers, opaque Organisation identifiers, Organisation display names, Stripe customer/subscription identifiers and links, event names and limited billing amounts | Understanding onboarding, product use, screening reliability and billing; maintaining service operations | Consent for browser analytics; legitimate interests for necessary server-side operational metrics |
| Usage and device data | IP address, browser, device, operating system, logs, approximate location from IP | Security, fraud prevention, diagnostics and measuring performance | Legitimate interests |
| Support and communications | Emails, messages, survey responses | Responding to you and improving support | Legitimate interests; contract |
| Marketing data | Email address, preferences, interaction with our emails | Sending news and offers | Consent, or legitimate interests for existing customers where PECR allows |
| Cookie data | Cookie identifiers and similar technologies | As set out in our Cookie Policy | Consent for non-essential cookies; legitimate interests for essential ones |
We do not ask for special category data (such as health, religion or ethnicity) and ask customers not to submit it unless necessary. Manuscripts can contain any kind of personal data, so customers are responsible for ensuring they have a lawful basis to submit it.
Where we rely on legitimate interests we have weighed them against your rights and interests. You can ask us for details.
4. How we treat manuscripts and other Input
We use Input to run the analysis you request and return the results. We do not use the text of your Input to train artificial intelligence or machine-learning models, and we do not sell it.
We do use scan history, Output, metadata and your feedback to test, secure, maintain and improve Alluvial, including our screening models.
5. Screening results and automated decisions
Alluvial screens content for low-quality and low-effort indicators. Its results are probabilistic indicators, not decisions, and Alluvial does not determine whether content was written by AI or by whom. We do not make decisions about individuals that have legal or similarly significant effects.
Organisations that use Output to make decisions about people, such as academic or disciplinary decisions, must apply meaningful human review and fair process and remain responsible for their own compliance with data protection law, including the rules on automated decision-making. If a decision about you relied on Alluvial Output, you can ask the organisation that made it to explain it and to review it. We will help them respond.
6. Who we share personal data with
We share personal data only where necessary and only with:
- Service providers (sub-processors) that host our systems, process payments, send email, or help keep Alluvial secure. They act under written contracts that restrict their use of the data. See our Sub-processors page. PostHog processes the limited service analytics described below as our separate processor for our controller purposes, not as a processor of manuscript content.
- Your organisation's administrators, if you use Alluvial through a workspace, who may see your account details and scan history.
- Professional advisers, insurers and auditors, under duties of confidentiality.
- Courts, regulators and law enforcement, where the law requires it or we need to protect our rights, users or others.
- A buyer or successor, if we are involved in a merger, acquisition or sale of assets. We will tell you if your data is affected.
We do not sell personal data.
7. International transfers
Core Alluvial account, billing and manuscript data is hosted in the United Kingdom. With your consent, browser analytics and limited server-side operational analytics are sent to PostHog EU Cloud, hosted in Frankfurt, Germany. We do not send manuscript text, filenames, submission identifiers, findings, scores, reports, or other manuscript-derived records to PostHog. General product analytics use pseudonymous Account identifiers and opaque Organisation identifiers; Organisation profiles may also include the Organisation display name and Stripe customer/subscription identifiers and dashboard links. A separate screening-quality signal stream is limited to categorical flag type and severity, ruleset version, coarse OJS outcome transitions, and editor feedback categories, under a fixed system identity. It contains no account, organisation, installation, journal, submission, screening, or finding identifiers; author metadata; source identifiers; or manuscript text. This controller-purpose stream helps us measure false-positive candidates and improve screening quality and is not joined to account or organisation analytics. We do not send Account contact details. PostHog's EU Cloud processing is subject to its Data Processing Agreement and current sub-processor terms. Other service providers may process limited personal data outside the UK. Where UK personal data is transferred outside the UK, we use a lawful transfer mechanism, such as UK adequacy regulations or the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where required. See the Sub-processors page for provider locations and links to current provider terms.
8. How long we keep personal data
We keep personal data only as long as we need it for the purposes above, and then delete or anonymise it.
| Data | Retention |
|---|---|
| Account data | While your account is active; then deleted or anonymised when no longer needed, except records kept to meet legal obligations or resolve claims |
| Billing records | Six years after the end of the relevant financial year, to meet tax and accounting law |
| Input and Output | Source uploads are temporary; screening records and derived results are retained for up to seven years from creation, then deleted. Organisation owners may request deletion earlier, subject to legal exceptions |
| Scan history and metadata | While needed to provide and improve the Services; manuscript-derived screening records follow the seven-year period above |
| Service analytics events | 12 months in PostHog EU Cloud |
| Analytics person profiles | While the related Organisation is active; erased on an applicable Organisation offboarding or deletion request |
| Consent choice | 180 days, after which we ask again |
| Support and communications | While needed to resolve the matter and meet legal obligations |
| Marketing data | Until you unsubscribe or withdraw consent |
We may keep data for longer where the law requires it or we need it to establish, exercise or defend legal claims.
9. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, staff confidentiality obligations and monitoring. No system is completely secure. You are responsible for keeping your credentials safe and for signing out of shared devices. If a personal data breach is likely to put you at risk, we will notify you and the ICO as the law requires.
10. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your personal data;
- access a copy of it;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
- receive certain data in a portable format;
- withdraw consent at any time, where we rely on it, without affecting earlier processing; and
- ask for human review of, and challenge, certain automated decisions.
To exercise a right, email enquiries@alluvial.ac. We may ask you to verify your identity. We respond within one month, which we may extend by up to two further months for complex requests, and we will tell you if we do. Rights are subject to legal exceptions.
If we process your data as a processor for a customer, we will pass your request to them and help them respond.
11. Cookies
We use essential cookies to make Alluvial work and, only after you accept, analytics cookies and local storage. The analytics consent choice is stored for 180 days. You can withdraw it at any time through the cookie controls; withdrawal stops further browser analytics collection. See our Cookie Policy for the exact storage and behaviour.
12. Children
Alluvial is intended for adults. Schools and other institutions may authorise its use by students under 18, in which case the institution decides whether and how students use it and is responsible for providing any required notices. We do not knowingly collect personal data directly from children. If you think a child has given us personal data without proper authorisation, contact us and we will delete it.
13. Links to other services
Alluvial may link to or integrate with third-party websites and platforms. Their privacy practices are their own, and we are not responsible for them.
14. Changes to this policy
We may update this policy. We will post the new version here with a new effective date and, for material changes, tell you by email or in the product.
15. Contact and complaints
Aptitude Solutions Ltd 167 - 169 Great Portland Street, 5th Floor, London, England, W1W 5PF Email: enquiries@alluvial.ac
If you are unhappy with how we have handled your personal data, please contact us first. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.