Privacy Policy

Last updated: September 29, 2026

1. Who we are

allus.fyi is the business platform operated by B.K.I.F. B.V. ("we", "us", "our"), registered in the Netherlands. For the processing described here we are the controller, except where clause 5 says we act as your processor. Our full registration details, including our registered address, are on the Legal Notice, and you can reach us about privacy at privacy@allme.fyi.

2. What this policy covers

This policy covers the personal data we process for the allus.fyi business platform and for the people who use it on your company's behalf — the person who signs up, anyone who signs in to your account, and the people you name as contacts for a service.

It is not the privacy notice for your own customers. Where a person's data reaches you through the Service, your own privacy notice governs what you then do with it — see clause 5.

3. What we collect

Account and representative data — the name, email address and hashed password of the person who signs up, and the identifiers of anyone who signs in to your account.
Company details — your company name, your profile fields, your service configuration, and the contact addresses you set for a service.
Usage and audit data — server logs (address, timestamp, request path), security events such as sign-ins and key changes, delivery records for webhooks and the change feed, and the operational log we show you in the portal.
Billing data — your billing details, your balance and settlement records, and the invoices we issue. Card and payment details are handled by our payment provider; we do not store them.
Contract flow content — the answers your customers give and the documents generated from them. We hold these on your behalf; clause 5 explains the difference.

4. Why we process it, and on what basis

To perform our contract with you (Article 6(1)(b) GDPR) — creating and running your account, providing the portal, the API and the integrations, metering usage and billing you.
For our legitimate interests (Article 6(1)(f) GDPR) — keeping the Service secure, preventing abuse, diagnosing faults, and telling you about changes that affect your use of it.
To meet legal obligations (Article 6(1)(c) GDPR) — keeping accounting records and answering lawful requests.

5. Our two roles, and what reaches you

What reaches you. A person's information reaches your company only because that person connected to one of your services and chose which of their fields to share. Nothing is sent without that choice. They can change a value, point the share at a different field, withdraw a field, or end the connection at any time, and the Service then stops delivering it.

Where we are the controller. For the platform, for your company account and for the profile data of allme.fyi users, we are the controller. When a person shares a field with you we are a conduit: on receipt you become an independent controller for that data in your own systems, with your own purposes, your own lawful basis and your own duties toward that person. No processing agreement is needed for that half; clause 5 of the Terms of Service sets out what you owe.

Where we are your processor. For contract flow runs we act on your behalf: you decide what is asked and why, your customer answers, and we store the answers and the documents generated from them. That is Article 28 processing, and the processing terms are clause 16 of the Terms of Service, which you accept when you sign up.

6. Sharing and sub-processors

We share personal data only with the categories of provider we need in order to run the Service, each under a contract that limits them to our instructions:

Hosting and infrastructure — the cloud provider that runs our servers, databases and file storage.
Payment processing — the payment provider that takes your payments and produces the records behind your invoices.
Transactional email — the provider that delivers verification, notification and alert messages.
Push notification delivery — the mobile platform operators that deliver notifications to the apps of the people who connect to you.
Machine translation — the translation provider that translates the texts your company writes for people to read into their language. Only those texts are sent, never the personal data of the people who read them.

We name categories rather than individual providers so that this policy stays accurate as providers change. Ask us at privacy@allme.fyi for the current list. We do not sell personal data, and we do not share it for advertising.

7. Where data is stored, and international transfers

Data is stored in the region assigned to it. A person's or a company's data stays in their own region and does not leave it by default.

To let people and companies sign in, connect and sign documents from anywhere, some records are kept in every region: account and security settings (email address, display name, share code, devices and sign-in history), who is connected to whom and the requests between them, groups, bunches and parental links, the names and status of documents and contract flows and the name, IP address and browser they are signed with, the email address given for contract notifications, verification records, company business cards, and anything reported to us for moderation. Everything else stays in its own region.

The one exception is sharing. When a party shares with a party in another region, an encrypted copy of only what was shared is stored in that party's region so that it can be read there. Nothing else travels. Documents and photos are never copied at all, not even when they are shared: they stay in their owner's own region's storage and are read from there.

We operate a region in the European Union and a region in the United States. Where data is stored in or transferred to our United States region, the recipient is our hosting provider acting for us, and we rely on the EU–US Data Privacy Framework, with the European Commission's Standard Contractual Clauses as the fallback basis.

Where a shared copy reaches a company or a person in another region, that recipient is independent and acts for its own purposes, so our hosting provider's certification does not cover it. The basis for that transfer is the user's own explicit decision to share with that specific party (Article 49(1)(a) GDPR). Nothing travels unless they share it, and withdrawing the share stops it.

We rely on Standard Contractual Clauses for the transfers to Apple and Google that are needed in order to deliver push notifications.

8. Retention

We keep personal data for as long as we need it for the purpose we collected it for, and no longer:

account and company data — for as long as your account exists, and then for as long as we need it to close out the relationship;
contract flow answers and generated documents — for as long as the run is retained. You can read them through the company-data API for as long as your account exists, and ask us to return or delete them under clause 16 of the Terms of Service — except a signed document, the signature on it, and the answers it was generated from, which we keep as the record of an agreement with another party;
billing and invoicing records — for as long as tax and accounting law requires us to keep them;
security events and audit records — for as long as they remain useful for investigating abuse and for as long as we must be able to account for what happened;
server and delivery logs — for as long as they are useful for diagnosing faults and for security.

We state purposes rather than fixed periods because the period follows the purpose: when a purpose ends, the data is deleted or anonymised, except where this section or clause 16 of the Terms of Service says we keep it.

9. Security

We protect personal data with technical and organisational measures appropriate to the risk:

everything travels over encrypted connections;
data is encrypted at rest;
the contact field values people share with your services are encrypted to your service key, whose private half is generated in your own browser and is never sent to us;
contract flow answers are encrypted per party;
passwords are stored only as one-way hashes, and access is controlled by OAuth 2.0 with signed tokens, optional two-factor authentication, and per-client endpoint restrictions;
we keep an audit record of security-relevant actions on an account.

10. Your rights

Where we hold personal data about you, you have the right to:

ask for a copy of it;
have inaccurate or incomplete data corrected;
have it erased where we no longer have a basis to keep it;
receive it in a structured, commonly used, machine-readable format, and have it transmitted to another controller where that is technically feasible;
object to processing based on our legitimate interests, and ask us to restrict processing while an objection or a correction is considered;
withdraw a consent at any time, without affecting what we did before you withdrew it.

Write to privacy@allme.fyi to exercise any of these. You also have the right to complain to a supervisory authority; ours is the Autoriteit Persoonsgegevens in the Netherlands, at autoriteitpersoonsgegevens.nl.

If your request concerns data you received into your own systems from a person who connected to your service, they should address it to you: for that data you are the controller.

11. Changes to this policy

We may update this policy. When we do, we notify you through the Service and by email to the address on your account, in the way clause 13 of the Terms of Service describes. The date at the top of this page shows the most recent revision.

12. Contact

Privacy questions and requests go to privacy@allme.fyi. Our registered details are on the Legal Notice.