AAlera
Join waitlist

Data Processing Addendum

You control your clients' data. We process it for you.

The short version: you are the controller, Alera is the processor, and this spells out how we handle your clients' data on your behalf — security, subprocessors, breaches, and your clients' rights. It is part of your Terms of Service.

Last updated September 21, 2026

Section 01

About this addendum

  • This Data Processing Addendum (the “DPA”) explains how Alera handles the personal data of your clients when you use the product. It is part of, and incorporated into, the Alera Terms of Service — accepting the Terms accepts this DPA — and it applies whenever you use Alera to collect or manage information about people who book with you.
  • It is written to support the obligations you may have under privacy laws such as the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and other US state privacy laws. Where a term here conflicts with the general Terms of Service on the specific subject of client-personal-data processing, this DPA controls; on every other subject the Terms control.
  • Plain-language summary: you decide what client data to collect and why; Alera stores and processes it only to run the features you use, follows your instructions, keeps it secure, uses vetted subprocessors, and helps you answer your clients when they ask about their data.

Section 02

Roles and key terms

  • You are the “controller” of your clients' personal data — you decide what to collect (contact details, intake responses, notes, visit history) and the purposes it's used for. Alera is the “processor” that stores and processes that data on your behalf and on your instructions.
  • For a limited set of data Alera decides on its own — your own account and login details, product usage and diagnostic data, and fraud/security signals — Alera acts as an independent controller, described in the Privacy Policy rather than here.
  • “Personal data,” “data subject,” “processing,” “controller,” and “processor” carry the meanings given in applicable data protection law. “Client” means an individual who books with you or whose information you record in Alera. “Subprocessor” means a service provider Alera engages to process client personal data.

Section 03

What we process, and on whose instructions

  • Alera processes client personal data only to provide and support the product — creating and confirming bookings, sending reminders and messages you set up, storing your records, taking payments through your connected payouts account, and the other features described in the Privacy Policy — and only on your documented instructions. Your use of the product, your settings, and this DPA are those instructions.
  • We will not use client personal data for our own marketing, sell it, or share it with data brokers, advertising networks, or booking directories. If a law compels us to process data in a way your instructions don't cover, we'll tell you first unless the law forbids it.
  • If we ever believe an instruction of yours would violate a privacy law, we'll let you know.

Section 04

Confidentiality and our people

  • Access to client personal data is limited to the personnel and systems that need it to operate and support the product. Anyone with access is bound by confidentiality obligations, and access is removed when it's no longer needed.

Section 05

Security

  • We maintain technical and organizational measures designed to protect client personal data against unauthorized access, loss, or disclosure — including encryption in transit and at rest, access controls and least-privilege permissions, network isolation, audit logging, and encrypted, rotating backups. A fuller summary is in “Our security measures” below.
  • Security is a shared responsibility: you're responsible for keeping your own login secure, for who you invite or share access with, for the security of any API key you embed on your own site, and for the lawful basis on which you collect client data in the first place.

Section 06

Subprocessors

  • You authorize Alera to engage subprocessors to help run the product. We describe them by function — cloud infrastructure, a payment processor, a messaging (SMS/MMS) provider, an email provider, a document-recognition (OCR) service, machine-translation and language-detection services, an AI provider, an error-monitoring service, an address-autocomplete service, and content-delivery networks — in the “How we share data” and “Translation and AI features” sections of the Privacy Policy, which forms the current subprocessor list for this DPA.
  • Every subprocessor is engaged under terms that limit it to processing data only to provide its function, bind it to confidentiality and security obligations no less protective than those in this DPA, and forbid it from using the data for its own purposes.
  • If we add or change a subprocessor in a way that materially affects the processing of client personal data, we'll update the Privacy Policy list and give notice in the app (and by email where relevant) before the change takes effect, so you have a chance to object. If you have a reasonable, data-protection-based objection, tell us and we'll work in good faith to address it; if we can't, you may stop using the affected feature.

Section 07

Helping you answer your clients

  • Your clients may ask you — as their controller — to access, correct, delete, restrict, port, or stop certain uses of their data. The product gives you self-serve tools for most of this: view and edit any client record, export a client's data (CSV / vCard), delete records, and honor SMS opt-outs (STOP) automatically.
  • Where you need more than the built-in tools to respond to a verified client request within your legal deadline, we'll provide reasonable assistance. If a client contacts Alera directly, we route them back to you — we don't disclose or act on your client list without you.
  • We'll also give you reasonable help with data-protection impact assessments and consultations with regulators, to the extent they relate to Alera's processing and you can't complete them from the information already in the Privacy Policy and this DPA.

Section 08

If there's a data breach

  • If we become aware of a personal-data breach affecting client data we process for you, we'll notify you without undue delay after confirming it, with the information you reasonably need to meet your own notification obligations — what happened, the categories and rough number of records involved, the likely consequences, and the steps we're taking. We'll keep you updated as we learn more.
  • Notifying you is our responsibility; notifying your clients or a regulator, where the law requires it, is yours as the controller — we'll support you with the details you need.

Section 09

Where data is processed

  • Client personal data is stored and processed on cloud infrastructure in the United States. If you or your clients are located outside the US, using Alera transfers that data to the US for processing.
  • For transfers of data protected by EU/UK law, we rely on appropriate safeguards (such as the Standard Contractual Clauses and the UK Addendum, which are incorporated by reference where they apply) together with the security measures described here.

Section 10

Audits and compliance information

  • On reasonable written request, and no more than once a year unless a regulator or a real incident requires otherwise, we'll provide the information reasonably necessary to show we're meeting this DPA — through documentation and written responses rather than direct access to systems that hold other customers' data.

Section 11

Returning and deleting data

  • You can export your data at any time from the product, with no waiting period or paywall. When you delete your account, active client personal data is purged within 30 days and rolls out of encrypted backups within 90 days, except records we're legally required to keep (such as payment-reconciliation and tax records), which persist longer in restricted form. On request we'll confirm deletion.

Section 12

California (CCPA/CPRA) terms

  • For personal data covered by California law, Alera acts as a “service provider.” We do not sell or share client personal data, and we do not retain, use, or disclose it except to perform the product's functions for you (or as otherwise permitted for a service provider). We certify that we understand and will comply with these restrictions.

Section 13

Details of the processing (Annex A)

  • Categories of data subjects: your clients (people who book with you or whom you record), and people who contact you through your booking page.
  • Categories of personal data: contact details (name, phone, email, optional birthday), booking and visit history, intake responses, notes and preferences, message content and attachments, and — where you turn on those features — allergen / sensitivity / patch-test information you record. Payment card data is handled directly by the payment processor and is not visible to Alera.
  • Special-category / sensitive data: the allergen, skin/scalp-sensitivity, and patch-test fields are health-adjacent; you choose whether to record them and remain responsible for the lawful basis to do so.
  • Nature and purpose: storing, organizing, displaying, transmitting, translating, and otherwise processing the data to provide bookings, messaging, payments, records, and the other product features you use.
  • Duration: for the life of your account, and then per the deletion timeline above.

Section 14

Our security measures (Annex B)

  • Encryption of personal data in transit and at rest; encrypted, rotating backups.
  • Access controls and least-privilege permissions, with per-tenant isolation so one account cannot read another's data; passwordless sign-in with one-time codes and session revocation.
  • Network and infrastructure hardening on enterprise cloud infrastructure, audit logging, and monitoring/alerting for errors and suspicious activity.
  • API keys you mint for your own embedded site are stored only as one-way hashes, scoped to the origins you allowlist, and revocable by you.
  • These measures may evolve as the product and the threat landscape change; we won't materially reduce the overall level of protection.

Section 15

Changes, governing law, and contact

  • We may update this DPA when the product or the law changes; the revision date above reflects the current version and material changes get advance in-app notice. This DPA is governed by the same law as the Terms of Service (the State of Delaware), and the Terms' limitation-of-liability applies to it.
  • Questions, or to raise a data-protection concern: email team@alerabooking.com.

This DPA is part of the Alera Terms of Service and works alongside the Privacy Policy, which holds the current subprocessor list. We update it when the product or the law changes and mark the revision date above.

Need a signed copy for your records?

Email team@alerabooking.com — a real person reads it.

Join the waitlist

Already have early access? Sign in