Privacy Policy · Allsead

Allsead ("we", "us", "the Platform") is operated by Autelli Productions, the data controller for the purposes of the GDPR. Full publisher and registration details, including the registered address, are on the Legal Notice. This Privacy Policy explains how we collect, use, and protect your personal data when you use allsead.com.

By using Allsead, you agree to the practices described here. If you do not agree, please do not use the Platform.

Section 1

Who can access Allsead?

Allsead is an invite-only, identity-verified platform. Access requires a valid @insead.edu email address or explicit pre-approval. Your affiliation with INSEAD is a prerequisite for membership, and we may verify or revoke access at any time.

Section 2

What data we collect

Data you provide

Email address (required for registration)
Password (stored as a one-way cryptographic hash, we cannot read it)
Name, campus, promotion, programme (provided during onboarding)
Biography (optional)
Profile photo (optional, stored in our private file storage)
Listings you create (Market, Housing)
Posts, comments, and messages you send

Data we collect automatically

IP address (used for rate limiting and security only)
Session information (stored securely server-side)
Last seen timestamp (for security and aggregate activity statistics)
AI assistant query count (for daily usage limits)
Days of activity (see "Activity log" below)

Activity log

To understand how the Platform is used, we record which days you are active: one date per member per day, nothing more, no pages visited, no content read, no messages, no location. These dates are only ever used as aggregate statistics (for example, how many members were active on a given day) by the platform operator. They are deleted when your account is deleted, and retained for no longer than 12 months.

Section 3

How we use your data

To operate the Platform and enable its core features
To verify your INSEAD affiliation
To send transactional emails (verification, password reset)
To enforce platform rules and prevent abuse
To personalise your experience (campus-specific content)

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as strictly required to operate the Platform (transactional email delivery, cloud hosting).

Section 4

Data storage and security

Your data is stored on cloud infrastructure operated by Cloudflare, our hosting provider. Where personal data is processed outside the European Economic Area, the transfer is protected by the safeguards in Cloudflare's data processing terms, including the European Commission's Standard Contractual Clauses. Passwords must be at least 10 characters and are hashed using PBKDF2-SHA256 with 100,000 iterations. Sessions are stored server-side, session and verification tokens are kept only as one-way cryptographic hashes, and sessions expire after 30 days. We use HTTPS, secure cookies (HttpOnly, Secure, SameSite), and bot protection on all sensitive forms.

Section 5

Cookies

We use a small number of first-party cookies, none of which track you across other websites: allsead_session (essential, keeps you signed in), allsead_cookie_consent (remembers your cookie-banner choice), and, for platform operators and partners only, short-lived session cookies for their respective consoles. We do not use advertising or analytics cookies.

Section 6

Your rights (GDPR)

Access

Request a copy of all data we hold about you

Rectification

Correct inaccurate data in your profile settings

Erasure

Request deletion of your account and all associated data

Portability

Request your data in a machine-readable format

Objection

Object to certain processing activities

To exercise any of these rights, contact us at support@allsead.com. We will respond within 30 days.

Section 7

Data retention

We retain your data for as long as your account is active. If you request deletion, we will remove your personal data within 30 days, except where retention is required by law. Some anonymised aggregate data may be retained for platform improvement.

Specific retention periods

Veil conversations: 30 days. See below.
Activity log: 12 months, then deleted.
Sessions: 30 days from sign-in, or immediately on sign-out.
Verification and password-reset links: 30 minutes.
Listings and posts: until you delete them or your account is deleted. Deleting a listing also deletes the message threads attached to it.
Moderation records: reports and the administrator action log are kept while they remain relevant to platform safety.

Veil conversations are held for 30 days, then permanently deleted. Veil is anonymous, and that is exactly why a conversation cannot be unrecoverable: if someone is harassed there, a moderator has to be able to establish what happened and who did it. Messages are stored encrypted at rest for 30 days and are readable only by a platform moderator acting on an open report, never by other members, never by your conversation partner, and not for any other purpose. Every such access is written to the administrator audit log. After 30 days the conversation and the record of who was in it are deleted automatically.

Your identity in Veil is separate from this: your name is only ever revealed to your conversation partner if you both choose to reveal it. Walking away, or being reported, never discloses who you are.

Section 8

AI assistant

The campus AI assistant processes your queries using a large language model running on our hosting provider's AI infrastructure (Cloudflare Workers AI). Your queries are processed in real time and are not used to train AI models. We log token counts for rate limiting only; query content is not stored.

The one-paragraph activity snapshot you can generate on your own profile is produced the same way, from your own activity on Allsead, and is only ever shown to you.

Section 9

How your feed is ranked

Your Social feed is ordered automatically rather than purely by time, so the most relevant posts for you appear first. We are transparent about the basics:

What it uses (inputs)

Your campus and cohort
The posts you engage with (likes and comments) and the topics you interact with
How recent and how active a post is
Communities you have joined

It does not use your private messages, your password, sensitive personal characteristics, or any information from outside Allsead.

What it decides (outputs)

Only the order in which posts appear in your feed

The ranking never changes who is allowed to see a post, is the same engine for every member, and is not used for advertising, profiling, or any automated decision that has legal or similarly significant effects on you. Your feed only ever contains content you are already permitted to see.

Section 10

Changes to this policy

We may update this policy from time to time. Significant changes will be communicated via the Platform. Continued use of the Platform after changes constitutes acceptance of the updated policy.

Section 11

Contact

For any privacy-related questions, contact: support@allsead.com

Allsead is proprietary software. Unauthorised reproduction or distribution of any part of the Platform is prohibited. See the Legal Notice.