Legal
What we collect, why we collect it, how long we keep it, and what you can ask us to do about it.
Last updated 21 August 2026
AlpineERP (“AlpineERP”, “we”, “us”) provides a hosted business operating system. This policy covers this website and the AlpineERP product.
For personal data processed through this website and our sales process, AlpineERP is the controller. For personal data inside a customer’s AlpineERP tenant, the customer is the controller and AlpineERP is the processor, acting on that customer’s documented instructions under a data processing agreement.
Privacy questions go to privacy@alpineerp.com.
When you use this website. Pages viewed, approximate location derived from IP address, browser and device type, and referring source. We use this to understand which parts of the site are useful.
When you contact us. The details you send us in an enquiry, and our correspondence with you. You control what goes into that box. Please do not paste customer records, credentials, or anything confidential into a public demo.
When you ask us to deploy or contact you. Your name, work email, company, role, team size, any phone number and notes you provide, and the blueprint you generated, so the person who calls you already understands your process.
Inside a customer tenant. Whatever the customer puts there. We do not decide what that is, and we do not use it for our own purposes.
AlpineERP is built on ERPNext, an open-source business platform published by Frappe Technologies under the GNU General Public Licence v3. We operate, configure, host and support it; we are not affiliated with, endorsed by, or acting as an agent of that project or its maintainers, and they are not processors of your data. The licence terms and attribution are set out on our licensing page.
We do not carry out automated decision-making that produces legal or similarly significant effects for you.
Subject to your jurisdiction, you may request access to your personal data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent at any time without affecting processing already carried out.
Write to privacy@alpineerp.com. We respond within 30 days. If your request concerns data inside a customer’s tenant, we will refer you to that customer, who controls it.
You may also complain to your local supervisory authority. We would rather you told us first.
We use a small number of processors, each under contract and each limited to what its function requires: cloud hosting and storage, transactional email, product analytics, our CRM, and the model provider that powers the assistant. A current list, with locations, is available on request.
Where data leaves its region of origin, transfers rely on Standard Contractual Clauses or an equivalent lawful mechanism. Your instance is provisioned in a region you choose at signup, which we name in writing before you go live.
Encryption in transit and at rest, a separate database per customer, role-based and row-level access control, and a change history recording who made each write. We do not hold SOC 2 or ISO 27001 certification at this time; both are on our roadmap. See our security overview.
Where we are the processor, we notify the affected customer without undue delay after becoming aware of a personal data breach, and assist them with their own notification obligations.
AlpineERP is built in part on open-source software. The business application layer is derived from ERPNext, licensed under the GNU General Public License v3, together with the Frappe Framework, licensed under the MIT License. AlpineERP is not affiliated with or endorsed by Frappe Technologies Pvt. Ltd.
These components are self-hosted within our infrastructure. Using them does not transmit your personal data to their maintainers, and the maintainers are not processors of your data.
Full attribution, licence texts, and how to obtain the corresponding source code are set out on our licensing and open-source notices page.
When this policy changes materially we update the date above and, for customers, give notice before the change takes effect. Previous versions are available on request.
This document is provided for information and is not legal advice. It should be reviewed by qualified counsel against the jurisdictions you operate in before you rely on it.
