Last updated: 1 August 2026
1. Who we are
AlignmentX ("AX", "we", "us" or "our") is operated by PURPLE CRAYOLÁ LTD, 82A James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom. Company number: 15615450.
PURPLE CRAYOLÁ LTD is the controller of the personal information described in this policy, except where an organisation using AX is separately responsible for deciding how participant information is used.
Privacy and Data Protection Officer enquiries, where applicable, can be sent to hello@thealignmentx.com.
2. Scope
This policy explains how we handle personal information when you visit AX, create an account, complete an assessment, receive a report, use a journal or formation plan, access learning or coaching, join an organisation or cohort, make a purchase, contact us or otherwise use our services.
Our separate Cookie Notice explains optional advertising technologies and your cookie choices.
3. Information we collect
Depending on the features you use, we may collect:
- Account and identity information: name, email address, encrypted password, profile information, authentication provider identifiers, avatar, role and account status.
- Assessment and development information: assessment responses, scores, themes, generated interpretations and reports, progress, retries and feedback.
- Private working information: journal entries, reflections, goals, plans, actions and check-ins.
- Coaching information: booking requests, availability, meeting details, session status, follow-up actions and notes shared through the service.
- Organisation and cohort information: employer or organisation membership, cohort membership, assignments, progress and authorised facilitator notes.
- Learning information: course enrolment, assignments, progress, completion and learning notifications.
- Purchase information: products purchased, amounts, currency, discounts, payment status, gateway references and entitlement history. AX does not store complete payment-card details.
- Communications: support enquiries, privacy requests, notification preferences, marketing choices and messages sent to or from AX.
- Technical and usage information: IP address, device and browser information, session and security data, timestamps, requested pages, application events and diagnostic logs.
- Public marketing information: campaign parameters and advertising identifiers, but only where you have accepted advertising cookies.
Please do not enter information about other people, medical details or other special-category information unless the relevant AX feature expressly asks for it and you are authorised to provide it.
4. How and why we use information
We use personal information to:
- Create, secure and administer accounts.
- Deliver assessments, calculate scores and generate requested reports.
- Save journals, plans, learning progress and coaching activity.
- Provide organisation and cohort workspaces to authorised users.
- Process purchases, prevent fraud and maintain access entitlements.
- Send service, security, booking, learning and account communications.
- Respond to support enquiries and privacy requests.
- Operate, troubleshoot, secure and improve AX.
- Meet accounting, tax, regulatory and legal obligations.
- Send marketing communications where permitted and measure advertising where consent has been given.
Our principal lawful bases under UK data-protection law are:
- Contract: processing necessary to create your account and provide requested AX services.
- Legitimate interests: operating, securing, improving and administering AX, preventing misuse, supporting users and understanding service performance, where those interests are not overridden by your rights.
- Legal obligation: maintaining financial records, responding to lawful requests and meeting regulatory duties.
- Consent: optional advertising technologies and marketing where consent is required. You may withdraw consent at any time.
Where processing involves special-category information, we will identify and document an additional lawful condition before carrying it out.
5. Assessment scoring and profiling
AX uses rules-based automated processing to score assessment responses and produce themes, developmental descriptions and reports. The inputs are the responses you provide; the output is intended to support personal reflection, learning and coaching.
AX assessment results are not medical diagnoses and are not used by PURPLE CRAYOLÁ LTD to make decisions producing legal or similarly significant effects, such as decisions about employment, credit, insurance or healthcare. An organisation must not use AX results for such decisions unless it has independently established a lawful, fair and transparent basis and appropriate human review.
You may request information about your assessment inputs and outputs, correct inaccurate account information, object where applicable, or contact us if you believe an automated result should be reviewed.
6. Organisations, cohorts and coaches
If an organisation provides or manages your access, authorised organisation administrators, facilitators or coaches may see information permitted by that workspace's configuration, such as membership, assignment status, progress, bookings and approved result summaries.
The organisation may be an independent controller for its own use of that information. You should also read its privacy information. Private journals and other content are not shared merely because you belong to an organisation unless the relevant feature clearly says otherwise.
7. Who receives information
We may share the minimum necessary information with:
- Infrastructure, database, storage and hosting providers.
- Email and notification providers, which may include Amazon SES, Resend or an authorised SMTP provider.
- Payment providers selected at checkout, which may include Stripe, PayPal, Revolut Pay or Paystack.
- Google, where Google sign-in, Calendar or Meet features are enabled and used.
- Cloudflare, where Turnstile abuse protection is enabled.
- Cloudinary or another configured storage provider for approved media or reports.
- MailerLite, if you separately subscribe to marketing communications.
- Google and Meta for advertising only as described in our Cookie Notice and only after required consent.
- Assigned coaches, authorised organisation administrators and facilitators where needed to provide the relevant service.
- Professional advisers, insurers, auditors, regulators, courts, law-enforcement bodies or a purchaser of the business where disclosure is lawful and necessary.
We do not sell assessment answers, reports, journals or coaching information.
8. International transfers
Some providers may process information outside the United Kingdom or European Economic Area. Where a restricted transfer occurs, we use an appropriate mechanism such as an adequacy decision, approved contractual clauses, the UK International Data Transfer Agreement or UK Addendum, together with any required assessment and supplementary safeguards.
Contact us if you would like more information about safeguards relevant to a particular provider.
9. Retention
We retain information only for as long as reasonably necessary for the purposes described above, including legal, accounting, security and dispute-resolution requirements. Our standard schedule is:
- Account, assessment, report, journal, plan, learning and coaching information: while the account or service relationship remains active, followed by review, deletion or anonymisation when no longer required. Approved erasure requests are completed subject to lawful exceptions.
- Financial and transaction records: normally six years from the end of the relevant company financial year, or longer where legally required.
- Support messages: normally up to 24 months after resolution, unless needed for an active dispute or safeguarding matter.
- Security and diagnostic logs: normally up to 12 months, unless a longer period is needed to investigate misuse or an incident.
- Marketing records: until you unsubscribe or withdraw consent, with a minimal suppression record retained where necessary to honour that choice.
- Privacy-request records: normally up to six years after completion to demonstrate how the request was handled.
- Advertising-cookie choices: up to the period stated in the Cookie Notice; identifiable AX-controlled campaign reports are normally retained for up to 24 months.
At the end of a retention period, information is deleted, anonymised or reviewed where a documented reason justifies further retention.
10. Security
We use organisational and technical safeguards designed to protect personal information, including access controls, authentication, encryption in transit, role-based permissions, logging, backups and controlled administrative access. No online service can guarantee absolute security.
You are responsible for keeping your credentials confidential and for notifying us promptly if you suspect unauthorised account access.
11. Your rights
Depending on your location and the circumstances, you may have rights to:
- Be informed about processing.
- Request access to your personal information.
- Correct inaccurate or incomplete information.
- Request deletion or restriction.
- Object to processing, including direct-marketing profiling.
- Receive certain information in a portable format.
- Withdraw consent without affecting earlier lawful processing.
- Request appropriate human involvement where applicable.
- Complain to a data-protection regulator.
You can submit available closure, erasure and export requests through your AX profile or email hello@thealignmentx.com. We may verify your identity before acting.
UK residents may complain to the Information Commissioner's Office.
12. Marketing
We send marketing email only where permitted. You can unsubscribe using the link in a marketing message or contact us. Service and security messages may still be sent where necessary to operate your account.
See the Cookie Notice for advertising-cookie controls.
13. Children
AX is not designed for unsupervised use by children. Organisations arranging access for a person under 18 must ensure that they have an appropriate lawful basis, provide suitable transparency information and obtain any required parental or guardian authorisation.
14. Changes and contact
We may update this policy when our services, providers or legal obligations change. Material changes will be communicated where appropriate.
Questions and rights requests can be sent to:
PURPLE CRAYOLÁ LTD, 82A James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom
Company number: 15615450