Privacy Policy

Alvora Velo (placeholder entity name), United Kingdom (primary registration and contracting jurisdiction). Registered office: [PLACEHOLDER: UK registered office address — not a founder's home address]. Contact for privacy matters: contact@alvoravelo.com.

This policy covers only the pre-launch email waitlist on this page. It does not cover the future trip-booking service, which will have its own, separate privacy notice once it is publicly available.

When you submit the waitlist form, we collect: your email address, the date and time of submission, the date and time you gave consent (the same moment, recorded separately), your IP address, your browser's user agent string, and the verification status of your subscription (pending, verified, or unsubscribed).

We collect the email address to send you a one-time confirmation message and, once confirmed, occasional updates about the Alvora Velo launch. We collect the IP address and user agent specifically to detect and prevent automated abuse of the signup form (spam, bot submissions, and fake addresses) — not to identify or track you individually.

For sending you launch updates: your consent, given by ticking the consent checkbox before submitting the form (UK GDPR Art. 6(1)(a) / EU GDPR Art. 6(1)(a)). You may withdraw this consent at any time — see "Your rights" below.

For the IP address and user agent used in abuse prevention: our legitimate interest in keeping the waitlist free of spam and fraudulent signups (UK GDPR Art. 6(1)(f) / EU GDPR Art. 6(1)(f)), balanced against your right to privacy — this data is used only for that purpose and is never used to profile you or shared for marketing.

No email address is added to the active waitlist, and no update emails are ever sent, until you click the confirmation link in the verification email. If you don't click it, your submission is automatically deleted after 30 days.

Unverified (pending) signups are deleted automatically 30 days after submission if the confirmation link is never clicked.

Verified subscriptions are kept until you unsubscribe, or for 24 months from your last interaction with an email we send you, whichever happens first — after which they are deleted automatically.

Records of rejected or blocked signup attempts (used only to produce the abuse-prevention counts referenced below) contain no email address or other personal data, and are kept indefinitely as anonymous counts only.

You have the right to access the data we hold about you, request its correction or erasure, object to or restrict our processing of it, request a copy in a portable format, and withdraw your consent at any time. Withdrawing consent (unsubscribing) does not affect the lawfulness of processing before that point.

To exercise any of these rights, or with any other question, contact us at contact@alvoravelo.com. Every email we send after verification also includes a direct one-click unsubscribe link.

If you are unhappy with how we've handled your data, you have the right to complain to your local data protection authority. In the UK, this is the Information Commissioner's Office (ico.org.uk). [PLACEHOLDER: expected to be the UK ICO given UK registration, pending legal confirmation — see docs/portal/12-UK-COMPLIANCE-ASSESSMENT.md]

We use Microsoft 365 (Microsoft Corporation) to send the confirmation and update emails. Microsoft processes your email address only as our data processor, strictly to deliver these messages, under Microsoft's own data protection commitments for Microsoft 365 services.

We use Vercel (hosting) and Neon (database, built on PostgreSQL) to run this website and store waitlist data securely. Both act as our data processors and do not use your data for their own purposes.

We do not sell your data, and we do not share it with any other third party for marketing or advertising purposes.

Microsoft 365, Vercel, and Neon may process data on servers located outside the UK/EU, including in the United States. Where this happens, we rely on the providers' own Standard Contractual Clauses and equivalent safeguards recognised under UK GDPR and EU GDPR for such transfers.

If you are a resident of a US state with its own privacy law (e.g. California's CCPA/CPRA), you have similar rights to those described above — access, deletion, and the right to opt out of any sale or sharing of personal information. We do not sell personal information.

This policy was last updated 11 August 2026 (version 2026-08-11.1). If we make a material change, we will update the effective date above; for anything that changes what we do with data you've already given us, we will also notify existing verified subscribers by email.