Privacy Notice

Version: 28 September 2026

Who is responsible

AltoDocs ApS, Denmark, CVR 46738276, is responsible for account administration, enquiries and website operation. Contact kunt.alp@altodocs.io about privacy or your rights. For personal data your organisation includes in its documents, the organisation generally determines the purposes and AltoDocs provides the service on its behalf. Business customers can request our data-processing terms and provider information.

Accounts and trials

We use your name, email, authentication information, organisation membership and access status to provide and secure your account. We keep a dated record of the terms you accept. The legal bases are performance of a contract, steps you request before a contract, and our legitimate interests in secure service operation and administering business accounts. Trial and security emails concern your account; creating an account does not subscribe you to marketing.

Enquiries and calls

When you submit a demo, setup-call or custom-app enquiry, we use your contact details and description to respond and arrange the next step. Phone numbers are requested only when you choose a callback. We retain the request in a protected intake and use our self-hosted Twenty CRM for the contact and follow-up task. We rely on requested pre-contractual steps or our legitimate interest in responding to business enquiries. Please avoid sensitive personal data and confidential project files in an initial enquiry.

Cookies, analytics and recordings

Essential storage supports authentication, preferences and security. The privacy-choice cookie lasts up to 180 days and is shared between altodocs.io and app.altodocs.io. Optional PostHog analytics and masked session recordings require your permission. Recordings are separately optional. Signup and enquiry forms are blocked from replay and field values are masked. You can reject optional tracking or withdraw it using Privacy choices on the website or Privacy in the app’s account settings at any time. Withdrawal stops future optional collection; it does not undo previous lawful processing. Essential server security and operational records are separate.

Providers and recipients

Our product hosting and storage use Hetzner in the EU and self-hosted Supabase. We use self-hosted Twenty for CRM, Resend for transactional email and PostHog EU for optional analytics and recordings. Authorised operators and contracted providers access only what is needed for their function. A connected email or calendar provider may process your correspondence and meeting details. Google sign-in, if you choose it, is handled by Google. Payment details are handled by our payment provider when you choose to purchase.

AI features are optional. Prompts and the content included in an AI request are sent to the provider you select using the configured provider credentials. Consider that provider’s terms, processing locations and your authority to share the information. An EU-hosted application does not mean every external provider processes all data only within the EU. Contact us for current processor and international-transfer information.

Retention

We retain information only while needed for the service, an active enquiry, security, applicable legal obligations or establishing and defending legal claims. Closed enquiries and inactive records are reviewed for deletion. Account closure and deletion requests are assessed against those purposes; backup copies follow their recovery cycle. Trial expiry pauses editing and does not automatically delete your documents. We retain limited evidence where necessary to honour contact preferences and document accepted terms.

Your rights

Subject to the applicable conditions, you can request access, correction, deletion, restriction or portability of your personal data, object to legitimate-interest processing, and withdraw consent. Contact us using the address above. We may need to verify your identity. You can complain to the Danish Data Protection Agency, Datatilsynet. We do not use this enquiry or trial workflow to make automated decisions with legal or similarly significant effects.