Privacy Policy

Last updated

This Privacy Policy explains how we collect, use, share, and protect information when you use the Ally platform (managed by Trillium Construction LLC) and should be read together with our Terms of Service.

Definitions

For purposes of this Privacy Policy:

  • “Service” means the Ally software-as-a-service application, including all related features, technologies, integrations, APIs, and mobile or desktop applications.
  • “Tenant” (or "Account Holder") means a customer organization that subscribes to the Service.
  • “End User” means individual(s) authorized by a Tenant to use the Service.
  • “Personal Data” means information that identifies, relates to, describes, or could reasonably be linked to an individual.
  • “Tenant Data” means data submitted to or generated in the Service by or on behalf of a Tenant, including Personal Data contained within such data.
  • “Account Data” means information provided in connection with creating, administering, or supporting an account.
  • “Usage Data” means data about how the Service is accessed and used.
  • “Subprocessors” means third parties we use to process Tenant Data or Personal Data on our behalf to provide the Service.

Roles and Scope

To the extent we process Tenant Data on behalf of a Tenant, we act as a processor or service provider for that Tenant, and the Tenant is responsible for determining the purposes and means of such processing. To the extent we process Personal Data for our own business purposes, such as operating our website, administering accounts, billing, security, analytics, and compliance, we act as an independent controller or business. This Privacy Policy applies to Personal Data we process as a controller/business and supplements any applicable customer agreements or data processing terms for processing we perform on behalf of a Tenant.

1. Information We Collect

1.1 Personal Data

We may collect the following categories of Personal Data to provide and operate the Service:

  • Identity Data: Names, job titles, and company affiliation for End Users, Contacts, and Vendors added to the platform.
  • Contact Data: Email addresses and phone numbers.
  • Account Credentials: Email addresses and password hashes or other authentication credentials.
  • Billing and Account Data: Billing contact information, invoicing details, payment-related records, and account administration information.
  • Support Data: Information you provide when you contact us for support, including messages, attachments, and related correspondence.

1.2 Business and Financial Data

We collect and store business-related data generated through your use of the platform, including projects, schedules, task lists, budgets, invoices, bills, contracts, and vendor and subcontractor records. This may include Tenant Data processed on behalf of the Tenant under the Terms of Service.

1.3 User-Generated Content

We collect files, notes, comments, messages, and other content that users upload or create within the application.

1.4 Technical and Usage Data

We automatically collect certain technical information when you use the Service, including IP addresses, browser type, device identifiers, log data (pages accessed, features used, timestamps), and performance and diagnostic data. This data is collected using standard server logs and may employ cookies or similar technologies. You may manage cookie preferences through your browser settings, though doing so may affect certain Service features.

1.5 Information from Third-Party Integrations

If you authorize integrations (such as QuickBooks), we may receive data from those services as necessary to provide the integration. Such data is subject to both this Privacy Policy and the third party's own privacy terms.

1.6 Information We Collect Automatically and from Other Sources

We may also collect information from:

  • Automated tools and logs, such as error reports and system diagnostics.
  • Service providers and partners, such as payment processors, support providers, and infrastructure vendors.
  • Publicly available sources, where permitted by law and relevant to account administration, fraud prevention, or compliance.

2. How We Use Your Information

We do not sell personal information and do not share personal information for cross-context behavioral advertising. We use the information we collect to:

  • Provide, operate, and maintain all features of the Ally platform, including project management, invoicing, scheduling, and collaboration tools.
  • Facilitate authorized integrations with third-party platforms such as QuickBooks.
  • Send transactional notifications, security alerts, product updates, and customer support responses. We do not send marketing communications without your consent.
  • Detect, investigate, and prevent unauthorized access, misuse, and other security incidents.
  • Analyze usage patterns and performance metrics to improve the functionality, reliability, and user experience of the Service.
  • Comply with applicable laws, regulations, and lawful government requests.
  • Establish, exercise, or defend legal claims.
  • Administer and secure accounts, including authentication, troubleshooting, and audit logging.

3. Sub-Processors and Data Sharing

To provide the Service, we share specific data with trusted third-party sub-processors. By using Ally, you consent to the processing of your data by the following providers.

  • QuickBooks (Intuit): To facilitate accounting integration, we share relevant financial data (such as invoices and bills) with Intuit. Your use of this integration is also subject to Intuit's Privacy Policy.
  • OpenAI: We use OpenAI’s API to power project summarization features. When these features are used, limited project data—such as notes, tasks, budgets, and schedules—may be securely transmitted to OpenAI solely to generate the requested summary or related output. OpenAI does not use data submitted through its API to train or improve its models unless we explicitly opt in to data sharing. OpenAI may process and retain API data in accordance with its applicable API data retention policies, including for abuse monitoring or as otherwise required by law.
  • Postmark: We use Postmark to process user email addresses for the delivery of transactional notifications, alerts, and system messages.
  • Cloud Infrastructure (AWS): Our platform is hosted on Amazon Web Services (AWS), which serves as our primary infrastructure and database hosting provider. All data stored on our platform resides within AWS's secure infrastructure.

We may update our list of Subprocessors from time to time. Where required by law or contract, we will provide advance notice of material Subprocessor changes and an opportunity to object through the applicable customer agreement or notice process.

4. Data Sharing & Other Circumstances

In addition to the sub-processors listed above, we may share Personal Data and Tenant Data in the following circumstances:

  • Business Transfers: In connection with a merger, acquisition, financing, or sale of business assets, Personal Data or Tenant Data may be transferred to the acquiring entity, subject to confidentiality obligations consistent with this Privacy Policy.
  • Legal Requirements: We may disclose information if required by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Ally, our users, or the public. Where legally permitted, we will notify the Tenant of such requests.
  • Professional Advisory: We may share information with lawyers, auditors, and insurers.
  • Investigations: We may share information with authorities or third parties when required by law, to protect rights, or to investigate fraud or security incidents.
  • With Your Consent: We may share information for other purposes with the Tenant's explicit prior consent.

We do not sell Personal Data and we do not share Personal Data for cross-context behavioral advertising.

5. Data Security

We implement multiple layers of technical and organizational security measures to protect Tenant Data, including:

  • Multi-Tenancy Isolation: We use technical controls designed to prevent one Tenant from accessing another Tenant’s data.
  • Encryption in Transit: All data transmitted between the Service and users is encrypted using TLS.
  • Encryption at Rest: Tenant Data stored in our database is encrypted at rest by our cloud infrastructure provider.
  • Access Controls: Access to production systems is restricted to authorized Ally personnel on a need-to-know basis.
  • Administrative Safeguards: Role-based access controls, logging, monitoring, and internal security procedures intended to reduce unauthorized access.

Despite these measures, no internet transmission or storage system is completely secure. We cannot guarantee absolute security. In the event of a data breach that affects Tenant Data, we will notify affected Tenants as required by applicable law.

6. Data Retention

We retain Tenant Data for as long as the account remains active. Upon account deletion, data is removed from active systems within thirty (30) days and from backup systems within ninety (90) days. Technical, usage, and log data may be retained in anonymized or aggregated form for longer periods for service improvement purposes, security, analytics, or legal compliance purposes.

We may also retain information as necessary to resolve disputes, enforce agreements, prevent fraud or abuse, or comply with legal, tax, accounting, or regulatory obligations.

7. Your Rights and Choices

Subject to applicable law, Tenants and their users may have the following rights regarding personal data, where applicable:

  • Access: The right to request a copy of personal data we hold about you.
  • Correction: The right to request correction of inaccurate or incomplete personal data.
  • Deletion: The right to request deletion of personal data, subject to our retention obligations.
  • Data Portability: The right to receive personal data in a structured, machine-readable format where technically feasible.
  • Objection: The right to object to certain processing of personal data based on legitimate interests.

To exercise these rights, contact us at support@allyprojectmanagement.com. We will respond to verifiable requests within the timeframe required by applicable law (typically thirty (30) days).

We may need to verify your identity before responding to a request. If you are an End User using the Service through a Tenant, we may direct your request to the Tenant where appropriate.

8. Children's Privacy

The Service is intended solely for use by business entities and their personnel. The Service is not directed to children under the age of 13 (or under 16 in certain jurisdictions), and we do not knowingly collect Personal Data from children. If we become aware that we have collected Personal Data from a child without appropriate consent, we will take steps to delete that information promptly.

9. Cookies and Tracking

The Service may use cookies and similar tracking technologies to maintain session state, remember preferences, and analyze usage patterns. These technologies are used solely for operational and analytical purposes related to the Service. We do not use tracking technologies for advertising. You may control cookie settings through your browser; however, disabling certain cookies may affect the functionality of the Service.

10. International Data Transfers

Because we and our service providers may operate in different jurisdictions, Personal Data may be transferred to, stored in, and processed in countries other than the country in which it was collected. Where required by law, we use appropriate safeguards for such transfers, which may include Standard Contractual Clauses or other approved transfer mechanisms

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify Tenants of material changes via email or a prominent in-app notice at least thirty (30) days before the changes take effect. Continued use of the Service following the effective date constitutes acceptance.

12. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us at support@allyprojectmanagement.com.