Privacy Notice

Version: 12 October 2026

Who is responsible

AltoDocs ApS, Denmark, CVR 46738276, is responsible for account administration, enquiries and website operation. Contact kunt.alp@altodocs.io about privacy or your rights. For personal data your organisation includes in its documents, the organisation generally determines the purposes and AltoDocs provides the service on its behalf. Business customers can request our data-processing terms and provider information.

Accounts and trials

We use your name, email, authentication information, organisation membership and access status to provide and secure your account. We keep a dated record of the terms you accept. The legal bases are performance of a contract, steps you request before a contract, and our legitimate interests in secure service operation and administering business accounts. Trial and security emails concern your account; creating an account does not subscribe you to marketing.

Purchases, tax and withdrawals

When you purchase, we retain your billing name, email, address, optional company and VAT number, quoted prices and tax, accepted subscription terms, payment references and subscription status. Revolut processes the payment details and provides its hosted checkout. We use billing records to fulfil your subscription, apply tax rules, reconcile payments and meet accounting obligations. These records may need to remain after account deletion. A withdrawal notice records your name, confirmation email, contract details and submission time; we send a receipt and use the notice to administer cancellation and any refund due. These transactional messages do not subscribe you to marketing.

Enquiries and calls

When you submit a demo, setup-call or custom-app enquiry, we use your contact details and description to respond and arrange the next step. Phone numbers are requested only when you choose a callback. We retain the request in a protected intake and use our self-hosted Twenty CRM for the contact and follow-up task. We rely on requested pre-contractual steps or our legitimate interest in responding to business enquiries. Please avoid sensitive personal data and confidential project files in an initial enquiry.

Product feedback

When you submit feedback in the app, we store your account identity, email, chosen feedback type, message and submission time to review your feedback, improve AltoDocs and follow up where needed. The submission creates a contact or uses your existing contact and creates an assigned follow-up task in our self-hosted Twenty CRM. Automated email acknowledges receipt; human replies use our Workspace mailbox. Document content and screenshots are not automatically attached. Please avoid confidential project details in your message. Product feedback does not subscribe you to marketing.

Cookies, analytics and recordings

Essential storage supports authentication, preferences and security. The privacy-choice cookie lasts up to 180 days and is shared between altodocs.io and app.altodocs.io. PostHog analytics and masked session recordings are on by default and can be switched off at any time using Privacy choices on the website or Privacy in the app’s account settings. After you log in, analytics identify your account; the same settings can hide your name and email without stopping recordings. Signup, enquiry and feedback forms are blocked from replay and field values are masked. Switching analytics off stops future optional collection; it does not remove data already collected. Essential server security and operational records are separate.

Providers and recipients

Our product hosting and storage use Hetzner in the EU and self-hosted Supabase. We use self-hosted Twenty for CRM, Resend for transactional email and PostHog EU for optional analytics and recordings. Authorised operators and contracted providers access only what is needed for their function. A connected email or calendar provider may process your correspondence and meeting details. Google sign-in, if you choose it, is handled by Google. Payment details are handled by our payment provider when you choose to purchase.

AI features are optional. Prompts and the content included in an AI request are sent to the provider you select using the configured provider credentials. Consider that provider’s terms, processing locations and your authority to share the information. An EU-hosted application does not mean every external provider processes all data only within the EU. Contact us for current processor and international-transfer information.

Connections to AI assistants

When you connect an external AI assistant to AltoDocs, you select the projects it can access and review its requested read or write permissions. The assistant receives content returned by its tool calls and can save changes within those permissions. AltoDocs receives the tool inputs, not automatically your entire conversation or access to your other applications. A separate AltoDocs login session and connection records are encrypted on our server; your AltoDocs password and login tokens are not returned to the assistant. Disconnect through your assistant to revoke its connector token. Connections expire after 30 days. Your chosen assistant provider handles the information it receives under its own terms and privacy arrangements.

Retention

We retain information only while needed for the service, an active enquiry, security, applicable legal obligations or establishing and defending legal claims. Closed enquiries and inactive records are reviewed for deletion. Account closure and deletion requests are assessed against those purposes; backup copies follow their recovery cycle. Trial expiry pauses editing and does not automatically delete your documents. We retain limited evidence where necessary to honour contact preferences and document accepted terms.

Your rights

Subject to the applicable conditions, you can request access, correction, deletion, restriction or portability of your personal data, object to legitimate-interest processing, and withdraw consent. Contact us using the address above. We may need to verify your identity. You can complain to the Danish Data Protection Agency, Datatilsynet. We do not use this enquiry or trial workflow to make automated decisions with legal or similarly significant effects.