Privacy policy
Last updated: 9 November 2026
This policy explains what personal data Aplinto collects, why, and what you can do about it. Aplinto is a CRM for education consultancies: consultancies (our customers) use it to manage their leads, students and team.
Who is responsible
For your Aplinto account and our website, Aplinto is the data controller. For the records a consultancy keeps in its workspace (for example its leads and students), the consultancy is the controller and Aplinto processes that data on its behalf and only on its instructions. If your data is in a consultancy's workspace, please contact that consultancy first.
What we collect
- Account data: your name, email address and the identifier of your sign-in account, plus the company, branch and role you belong to.
- Workspace data: whatever a consultancy and its team enter into Aplinto, such as enquiries, lead and student details and notes.
- Billing data: the plan your company is on and payment status. Card details are handled by our payment provider; we never see or store them.
- Technical data: IP address, browser type, sign-in times and security logs, used to keep the service running and to detect misuse.
Why we use it
- To provide the service you or your company signed up for (contract).
- To keep accounts and data secure and prevent fraud (legitimate interest).
- To send service emails such as sign-in codes and important account notices.
- To meet legal, tax and accounting obligations.
We do not sell personal data and we do not use it for advertising.
Cookies
Aplinto uses only the cookies needed to sign you in and keep your session secure. We do not use advertising or tracking cookies, so there is no cookie banner.
Who we share it with
We use a small number of service providers, each bound to protect the data:
- Microsoft (Entra External ID): sign-in, accounts and verification emails.
- Hetzner: hosting of our servers and databases in Germany (EU).
- Cloudflare: network delivery and protection against attacks.
- Our payment provider: processing subscription payments.
Some providers may process data outside your country. Where that happens we rely on the safeguards required by law, such as standard contractual clauses.
How long we keep it
Account and workspace data are kept while the account is active. When a company closes its workspace, its data is deleted within 90 days, except what we must keep for legal or accounting reasons. Security logs are kept for a limited period.
Security
Data is encrypted in transit, access is limited to people who need it, each company's data is kept separate from every other company's, and sign-in is handled by Microsoft's identity platform.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict how we use it, and complain to your data protection authority. To use any of these rights, contact us at the address below.
Children
Aplinto is a business tool and is not intended for children under 16.
Changes
If we change this policy we will update the date above, and tell account holders about significant changes.
Contact
Questions or requests: [email protected]