Alora

GDPR overview

GDPR is addressed concretely, not by slogan. The publisher is established in Germany, so the GDPR and the BDSG apply directly, and the privacy policy names XSUPRA GmbH as controller with legal@xsupra.io as the contact. Legal bases are set out article by article: 6(1)(b) for performing the contract, 6(1)(f) for improving the platform, 6(1)(c) for tax and retention duties, and 6(1)(a) for consent-based processing such as push notifications. Data subject rights under articles 15, 16, 17, 18, 20 and 21, plus withdrawal of consent under 7(3), are listed, and the competent supervisory authority is named with its postal address in Magdeburg. Transfers outside the EU rely on standard contractual clauses. A separate article 28 processing agreement is concluded where XSUPRA processes on the customer's behalf. The policy is dated March 2026.

Who owns the data?

The customer keeps the data. Clause 10.3 of the terms states that the user retains all rights to the data and content entered into the software, and that XSUPRA GmbH may process it only insofar as necessary to perform the contract. The privacy policy adds that no data is sold to third parties, and the site promises export or deletion at any time. One reservation belongs in the same breath: clause 10.4 allows the publisher to create anonymised and aggregated data and to use it for statistics, product improvement and scientific publication, without asking again.

Reuse rights

Users may reuse their own field data freely, since they never transfer ownership of it. On termination, clause 6.4 provides that stored data is made available on request in a common format, where technically possible and reasonable, so the material can be carried to another system. What users may not touch is the software itself: clause 4.2 forbids copying, redistributing, renting, sublicensing and decompiling it, and clause 10.2 forbids using XSUPRA trade marks or logos without express consent. In the other direction, conversations are stored on the publisher's servers, pseudonymised before being sent to Azure or OpenAI for processing, and excluded from the training of external AI models, while anonymised and aggregated data does feed the publisher's own models.

Data retention & training

Hosting summary

Hosting is European by declaration. The site states that everything runs on servers inside the European Union, fully compliant with the GDPR, and repeats that farm data stays in the EU and remains the customer's. The terms add that the software is hosted on servers operated by XSUPRA or by contracted third parties. The privacy policy names those third parties: Microsoft Azure and Google Cloud for hosting and processing, Stripe for payments, GPT models via Azure or OpenAI for AI processing on pseudonymised data, and an unnamed third-party provider for audio production, which receives only aggregated, non-personal data. Where data does move to a third country such as the United States, the policy relies on standard contractual clauses and additional security measures. One component is deliberately kept in-house: the product analytics system is fully self-hosted in the publisher's own PostgreSQL database, with no transmission to external analytics vendors. No specific hosting country is named anywhere — only the EU region.