Privacy
Last updated [SET THIS ON THE DAY YOU PUBLISH]
Alcove is a desk and room booking tool operated by Yehuda Levy, a sole trader trading as Alcove, of Hafetz Haim 14, Ra'anana 43339, Israel. This page describes what it stores, why, who else sees it, and how long it is kept.
The two relationships
When your organisation uses Alcove, your employer decides what goes into it and we hold it on their behalf. If you want your bookings changed or removed, your organisation’s administrator can do it, and asking them is faster than asking us.
For the account itself, and for billing, we decide. That is the part this page mostly describes.
What is stored
| What | Why |
|---|---|
| Your email address and name | To sign you in, and to show colleagues who booked a desk |
| Which organisations you belong to, and whether you administer them | To decide what you can see and change |
| Your bookings: which desk or room, which day, which hours | The service itself |
| Whether you confirmed you turned up, and when | To release desks nobody came to, and to report how much of the office is actually used |
| Names you add as guests to a meeting | So the people in the room are on the booking |
| Your organisation’s subscription status | To know whether the account is paid up |
| If you connect a calendar: a token allowing Alcove to write your bookings into it | Two-way sync. It is encrypted before it is stored and you can disconnect at any time |
We do not store card details and never see them. Payment is handled entirely by Paddle.
Who else receives it
Alcove runs on other people’s services, and your data reaches these in the course of running it.
| Who | What they get, and why |
|---|---|
| Supabase | Hosts the database and sign-in. Everything above is stored there. |
| Vercel | Runs the application and holds its server logs. |
| Paddle | Takes payment as merchant of record. Receives the billing contact’s email and the number of seats, and is the seller your receipt comes from. |
| Resend | Sends invitations and notifications. |
| Sentry | Receives error reports. Configured not to collect IP addresses or cookies, and web addresses are stripped of anything identifying before they are sent. |
| Google, Microsoft | Only if you choose to sign in with them, or connect a calendar. |
We do not sell data, and there is no advertising or tracking of any kind in the product.
Cookies
Alcove sets two kinds of cookie and both are strictly necessary: one keeps you signed in, one remembers which organisation you are looking at. There are no analytics or advertising cookies, which is why there is no banner asking you about any.
The calendar feed
If you subscribe to your bookings as a calendar feed, the address you are given contains a secret, and anybody holding that address can read your bookings without signing in. That is how calendar subscriptions work everywhere — your calendar application cannot sign in on your behalf. Switch it off or issue a new address at any time from Your bookings; the old one stops immediately.
How long it is kept
Bookings are kept while your organisation keeps its account, because the record of who sat where is what the usage report is built on. Closing an organisation hides it immediately and deletes it permanently after 30 days. Records that must be kept for tax are kept as long as the law requires.
Your rights
Under Israel’s Privacy Protection Law, 5741-1981, you may ask to see the information held about you, ask for it to be corrected, and ask for it to be deleted. Write to hello@getfreeboard.com and we will answer within the period the law allows.
Where your employer decides what is in Alcove — which is most of it — we may need to pass your request to them rather than act on it ourselves, and we will tell you if that happens.
If you think we have handled your information badly, you can complain to the Israeli Privacy Protection Authority.
If you are in the UK or the EU
Alcove is operated from Israel, which the European Commission recognises as providing an adequate level of data protection. That is what allows a European or British office to use it without additional transfer paperwork.
Where the UK or EU GDPR applies to your organisation, the rights it gives you — access, correction, erasure, portability, objection — apply to information we hold, and the same address above reaches us.
Where it is held
[CONFIRM AND STATE YOUR SUPABASE AND VERCEL REGIONS. If either sits outside the EEA, name it — an EU customer’s security review will ask, and the honest answer is easier to give in advance than in a questionnaire.]
Changes
If this page changes in a way that affects you, we will tell organisation administrators by email before it takes effect.
Contact
Yehuda Levy, Hafetz Haim 14, Ra'anana 43339, Israel. hello@getfreeboard.com.
The terms this service is provided on are here.