Data Subject Requests

1. Enter the email address the request is about.
2. We send a confirmation link to that address, so that nobody can delete someone else's data. The form always gives the same answer, whether or not we hold the address.
3. After you confirm, we review the request and carry it out within one month: any Alion account registered to the address is deleted with everything linked to it, and the address is added to our suppression list.

The suppression list keeps a one-way hash of the address, not the address itself. It is what stops our systems from adding the address again as a profile, so it is kept after the rest is gone.

• Access: whether we process data about you, a copy of it, and where it came from, why we use it, who receives it and how long we keep it.
• Rectification: correction of inaccurate data and completion of incomplete data.
• Erasure: deletion when the data are no longer needed, when you withdraw consent, when you object and we have no overriding reason, or when processing was unlawful.
• Restriction: we keep the data but stop using it while accuracy or an objection is being checked, or at your request instead of deletion.
• Portability: the data you gave us, in a structured, machine-readable format (JSON).
• Objection: to processing based on legitimate interest, including the publication of your name and role with a company. We stop unless we have compelling legitimate grounds, which we will explain. An objection to direct marketing is always honoured.
• Consent: where we rely on consent, you can withdraw it at any time without affecting what happened before.
• Automated decisions: Alion makes no decisions about you with legal or similarly significant effects based solely on automated processing. The AI features are described in section 06 of the Privacy Policy.
• AI agents: under Settings, AI agents you can switch agent access off (which is also an objection), limit who may write, and see every agent’s read, search and message.

• Time: we answer within one month of receiving the request. For complex or numerous requests we may extend this by two further months, and we will tell you within the first month why.
• Identity: we may ask you to confirm the request from the email address concerned, or for information that shows the data are yours. We ask only for what is needed and delete it once the request is handled.
• Cost: free. For manifestly unfounded or excessive requests we may charge a reasonable fee or decline, and we will explain why.
• Refusals: if we cannot act on a request, fully or partly, we tell you why and that you can complain to a supervisory authority.
• On someone's behalf: a representative can make a request with written authority from the person concerned.
• Records: we keep a record of each request and how it was handled for 3 years, to be able to show that it was handled.

Deleting an account removes the profile and everything linked to it, including uploaded files, messages, applications, matches, API keys, Telegram conversations and logs that carry the account's identifier. The following remain, for the reasons given:

• payment records, for as long as tax and accounting law requires;
• the record of your request, for 3 years;
• the suppression hash of your email address, so that it is not added again;
• a single line saying that an account with that number was deleted, without your name or email.

If an employer has already received your application, the copy in the employer's mailbox is under the employer's control. You can ask the employer directly to delete it.

Please write to [email protected] first; most issues can be fixed quickly. You can also complain at any time to the data protection authority of the country where you live, work or where you think an infringement happened.