Privacy Policy

1. Introduction

Zachery Stanger, trading as Alber Analytics ("Alber Analytics", "we", "us" or "our"), is the controller of personal data described in this policy. Our address is 3 Allington Lane, Ebbsfleet Valley, Swanscombe, DA10 1GE, United Kingdom.

We are committed to protecting your privacy and ensuring transparency in how we handle your data.

2. Information We Collect

Information You Provide Directly

We collect information you provide when you:

• • Fill out our contact forms or request an audit
• • Submit inquiries or feedback
• • Create an account or use our client portal
• • Communicate with us via email, phone, or other channels

This may include your name, email address, company, enquiry type and message, account identifiers, and information you choose to provide through the portal or connected services.

Information Collected Automatically

When you use the website and portal, we process technical information needed to operate, secure and diagnose the service, including:

• • IP address, browser and device information
• • Authentication and session information
• • Pages and features requested, timestamps, and diagnostic and security logs

Essential cookies and similar storage are used for sign-in, security and portal functionality.

3. How We Use Your Information

We use the information we collect for the following purposes:

• • Providing and improving our services and website functionality
• • Responding to your inquiries and customer support requests
• • Sending communications you have requested or consented to receive
• • Operating connected Microsoft, Google and social-media features you authorise
• • Monitoring service performance, security and misuse
• • Complying with legal obligations and protecting our rights

Automated AI Review for Migration Analyses

For eligible GPO and SCCM migration analyses, we automatically use Anthropic, an external AI service provider, to perform an advisory review. We send only server-generated categorical facts about the proposed migration: a temporary review reference, mapping status, target type, semantic parity, limitation count, and whether Microsoft evidence exists.

We do not send uploaded files, policy or baseline names, behavioral text, recommendations, support URLs, scripts, registry or policy paths or values, tenant inventory, credentials, customer-provided text, customer identifiers, or descriptions to the AI provider for this review.

Other Google AI Features

Other, separately identified portal features use Google Gemini. Depending on the feature you choose, Gemini receives GPO policy names, configuration, registry paths and values, Intune mapping evidence; SCCM baseline names and script extracts; public business names, addresses, phone numbers, URLs and website text; or organisation brand, audience, campaign, blog, social and image-generation instructions. If you choose to include reference images in a marketing plan, their filenames, media types and image contents are also sent to Gemini. This broader processing is separate from the restricted Anthropic migration review above.

4. Legal Basis for Processing

Our lawful basis depends on why we use the information:

• • Contract: to provide the portal and services you request, administer accounts, and provide support
• • Legitimate interests: to respond to business enquiries and operate, secure, diagnose and improve the service, where those interests are not overridden by your rights
• • Consent: for optional marketing and optional connections where consent is the appropriate basis; you may withdraw it at any time
• • Legal obligation: where we must retain or disclose information to comply with applicable law

5. Information Sharing

We do not sell personal data. We use the following service providers where the relevant feature is used:

• • Clerk for account authentication, organisation membership and session management

• • Webflow for hosting this website, and for storing enquiries sent through our audit form and emailing them to us

• • Google Analytics, only if you accept analytics cookies

• • Cloudflare Turnstile to protect our forms from spam

• • Google Fonts to display the website’s typefaces

• • Application hosting and database providers for service data, encrypted portal records, logs and application delivery
• • Resend for contact, invitation and service emails
• • Microsoft for authorised Intune, Graph and SharePoint connections, tenant configuration and files
• • Google services for authorised Search Console data, Maps business discovery, and PageSpeed and Chrome UX checks for public URLs
• • Google Gemini for migration verification, grouping and naming; lead and public-website research; and authorised blog, brand, social-plan, caption and image generation
• • LinkedIn, X, Facebook and Instagram for social connections, public-profile discovery and publishing features you authorise
• • Anthropic for the restricted categorical migration review described above
• • Legal authorities when required by law or to protect our rights
• • Successors in the event of a merger, acquisition, or sale of assets

6. Data Retention

Encrypted GPO and SCCM migration reports expire after 24 hours. Other account, workspace, connected-service, publication, enquiry, security and audit records are kept only while needed to provide the service, maintain an appropriate audit trail, meet legal obligations, resolve disputes and establish or defend legal claims. Retention depends on the record and the connected service. You may ask us for the period or criteria applying to a particular record.

7. Data Security

We implement industry-standard security measures to protect your personal information, including encryption, secure servers, and access controls. However, no security measure is 100% secure. We encourage you to protect your passwords and report any suspicious activity.

8. Your Rights

Under UK data protection law, subject to applicable conditions and exemptions, you may have the right to:

• • Access your personal information
• • Correct inaccurate or incomplete information
• • Delete your personal information (right to be forgotten)
• • Restrict or object to processing
• • Receive your data in a portable format
• • Withdraw consent to processing
• • Object to direct marketing at any time
• • Ask not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects

To exercise these rights, contact privacy@alberanalytics.co.uk. We may need to verify your identity and normally respond within one month. You may complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would welcome the opportunity to address your concern first.

9. Cookies and Analytics

We use essential cookies and similar storage that the website needs to work, including one that remembers your cookie choice. If you accept analytics cookies, we also use Google Analytics to understand how the website is used. It sets cookies (such as _ga) and collects information such as pages visited, approximate location, device and browser. Google Analytics does not load unless you click Accept, and you can change your choice at any time using the Cookie settings link in the footer. Our forms use Cloudflare Turnstile to check that submissions come from a person; it runs in your browser and processes technical information such as your IP address for that purpose.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites before providing personal information.

11. Children

Our business services are not directed to children, and children should not create portal accounts or submit personal data through the service.

12. International Data Transfers

Some providers may process personal data outside the United Kingdom. We are completing provider-by-provider verification of processing locations and contractual safeguards and do not rely on your consent as the legal basis for a restricted transfer. UK data protection law requires an applicable mechanism for restricted transfers. Depending on the destination and provider, that may be UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another safeguard recognised by UK law. We will update this policy when the provider review is complete; meanwhile, contact us about a particular service.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, and other factors. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of our services constitutes your acceptance of the updated Privacy Policy.