ALTE · Alternative Technologies

Privacy Policy

Customer, user and website privacy · British English

1. Scope

This Privacy Policy explains how ALTE L.L.C-FZ (“ALTE”) collects and uses personal data through alteglobal.ai, ALTE accounts, trials, subscriptions, product interfaces, support, marketing and related business operations. Where ALTE processes personal data contained in Customer Data only on a business customer’s documented instructions, ALTE generally acts as a processor and the Data Processing Addendum applies.

2. Personal data we collect

3. How we use personal data

• Provide, authenticate, secure and administer accounts, trials and paid Services.
• Provision workspaces, enforce plan entitlements and process subscription lifecycle events.
• Provide product functionality and connected integrations on Customer instructions.
• Process payments, invoicing, tax and accounting records.
• Provide support, troubleshoot incidents and prevent fraud, abuse or security threats.
• Measure service performance, improve product reliability and understand feature usage.
• Send service messages, trial reminders, billing notices and security notices.
• Send marketing communications where permitted and provide opt-out controls.
• Comply with legal, regulatory, tax, sanctions and record-keeping obligations.

4. Legal grounds

Depending on the context and applicable law, ALTE may process personal data because it is necessary to perform a contract, comply with legal obligations, pursue legitimate business interests that do not override individual rights, or because valid consent has been obtained. Where consent is the applicable basis, it may be withdrawn for future processing, subject to legal or contractual requirements.

5. Customer Data: controller and processor roles

For personal data that a business customer uploads, connects or instructs ALTE to process through the Services, the customer normally determines the purposes and means of processing and acts as controller, while ALTE acts as processor. The customer is responsible for providing notices and obtaining any lawful basis, consent or authorisation required for that data. ALTE’s processor obligations are set out in the DPA.

6. Payments

Payments are expected to be processed through Stripe UAE. Stripe may process payment credentials, fraud signals and transaction data under its own terms and privacy framework. ALTE receives transaction status and billing information necessary to administer subscriptions. ALTE does not intentionally store full card numbers or card security codes.

7. Connected mailboxes and Google user data

Where a Customer connects their own mailbox to ALTE Email Outreach, ALTE acts on the Customer’s instruction to send campaign messages from that mailbox. What else ALTE may do with a connected mailbox depends on the mailbox provider, as set out below. A mailbox is connected only by the Customer, and can be disconnected by the Customer at any time.

What ALTE accesses. The permissions ALTE requests depend on the provider of the connected mailbox.

• Google. ALTE requests two permissions only: permission to send email on the Customer’s behalf (https://www.googleapis.com/auth/gmail.send), and permission to see the email address of the signed-in account (https://www.googleapis.com/auth/userinfo.email). The first is used to deliver the Customer’s campaign messages. The second is used to show the Customer which mailbox is connected and to send from the correct address. ALTE does not request permission to read, search or download messages in a Google mailbox, and does not read the Customer’s Gmail inbox.
• Microsoft. ALTE requests permission to send email on the Customer’s behalf (Mail.Send), permission to read mail in the connected mailbox (Mail.Read), permission to read the basic profile of the signed-in account, including its address (User.Read), and permission to keep the connection working without a fresh sign-in each time (offline_access). Mail.Read is a permission to read the mailbox as a whole, not a permission limited to replies: Microsoft does not offer a narrower one. ALTE uses it to identify replies from the companies in the Customer’s own list in ALTE, and the delivery failures returned by mail servers; what that means in detail is set out under “What ALTE stores” below. Reply detection is available for Microsoft mailboxes.
• SMTP. A mailbox connected over SMTP is used for sending only. ALTE does not read mail from it.

Signing in to ALTE with Google. Separately from a connected mailbox, ALTE offers “Sign in with Google” as a way to sign in to the product: that sign-in requests the openid, email and profile permissions only, identifies the person signing in, and gives ALTE no access to mail. It is a separate integration from the mailbox connection: a Customer may use either one without the other.

What ALTE stores. Where ALTE reads a connected mailbox — that is, a Microsoft mailbox — it reads the inbox and the junk-mail folder, and stores two kinds of message. The first is a message treated as a reply. ALTE applies a single test for this: whether the sender’s address belongs to a company held in that Customer’s own list of companies in ALTE. It does not check whether a campaign was in fact sent to that company, so a message from a company the Customer has collected but has not yet written to is stored in the same way as an answer to a campaign. For such a message ALTE stores the sender address, the subject, the time it was received, and the body of the message up to the first 8,000 characters, which for most messages is the whole message. This is used to show the Customer the message in their workspace, to mark a campaign message sent to that company as answered, and to record a request to be removed from further messages. The second is a delivery failure notice returned by a mail server — a bounce, sent by an address such as postmaster or mailer-daemon rather than by the recipient — of which ALTE stores the recipient address the notice refers to, its subject and its diagnostic text, so that the Customer can see which addresses did not receive the message. Every other message in those two folders is read in order to apply those two tests, and nothing from it is kept: its sender, its subject and its content are not written to ALTE’s systems. For a Google mailbox, and for a mailbox connected over SMTP, no message is read and no message content is stored.

What ALTE does not do. ALTE does not use Google user data to train, retrain or improve generalised artificial-intelligence or machine-learning models. Message content from a connected mailbox is not sent to any model provider. ALTE does not sell Google user data, does not transfer it for advertising purposes, and does not allow humans to read it except with the Customer’s explicit permission, where required for security, to comply with applicable law, or where the data has been aggregated and de-identified.

Credentials. Authorisation tokens and mailbox passwords are stored encrypted, with the encryption key held in a file readable only by the service account. They are never written to logs or returned by the API in plain text.

Disconnection and deletion. The Customer can disconnect a mailbox at any time in the product settings. On disconnection, ALTE deletes the stored credentials for that mailbox and deletes the data ALTE obtained from that mailbox, namely the stored replies and bounce notices. Two things are deliberately kept. The record in the Customer’s own campaigns that a given message was answered stays: it is the Customer’s record of their own work, and it holds no content from the mailbox. The Customer’s do-not-contact list stays as well: an address is on it because someone asked not to be written to again, and erasing that request would put the address back into the next campaign. For a Google mailbox, ALTE also revokes the authorisation with Google at the point of disconnection. Microsoft does not provide an equivalent interface for an application to revoke its own grant; for a Microsoft mailbox the Customer, or their tenant administrator, withdraws the authorisation in their own Microsoft account settings. A Customer using a Google mailbox can also withdraw ALTE’s access directly in the security settings of their Google Account, at myaccount.google.com/permissions.

Limited Use. ALTE’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Cookies, analytics and advertising

ALTE may use strictly necessary cookies for authentication, security and billing. With appropriate consent settings, ALTE may also use analytics and advertising technologies: PostHog for product analytics, Meta Pixel and LinkedIn Insight Tag for advertising measurement. Google Analytics and Google Tag Manager are not used. Further information appears in the Cookie Policy. Non-essential tracking should be governed by the website’s consent-management settings.

9. Sharing personal data

• Service providers and subprocessors that host, secure, support or deliver the Services.
• Payment providers such as Stripe for checkout, billing, fraud prevention and subscription administration.
• Professional advisers, auditors, insurers and accountants where reasonably necessary.
• Authorities, regulators, courts or law-enforcement bodies where disclosure is legally required.
• A successor or purchaser in a merger, financing, restructuring or sale, subject to appropriate confidentiality and legal safeguards.

ALTE does not sell personal data to advertisers. A current list of material subprocessors used to process Customer Data is available on request.

10. International transfers

The Services may involve processing or storage outside the UAE, including through cloud or AI infrastructure. ALTE will use transfer mechanisms and contractual, organisational or technical safeguards required by applicable UAE data-protection law. Where ALTE acts as processor, transfer commitments are also addressed in the DPA.

11. Retention

ALTE retains personal data for as long as necessary for the purposes described in this Policy, including service delivery, account history, security, dispute resolution, tax and legal obligations. Customer workspace data is kept with no fixed end date: it is not deleted when a trial or subscription ends, and it is not deleted on a schedule. ALTE deletes Customer workspace data when the Customer asks for it to be deleted. A deletion request is carried out, unless retention of specific records is required by law or contract.

12. Security

• Access controls and least-privilege permissions.
• Encryption in transit and, where appropriate, at rest.
• Separation of production and test environments.
• Secure secrets/token storage for connected integrations.
• Logging, monitoring, backups and incident-response procedures.
• Vendor and subprocessor security review proportionate to the risk.
• Reasonable administrative controls for staff and contractors.

13. Individual rights

Subject to applicable law and the circumstances of the processing, individuals may have rights relating to access, correction, deletion, restriction or objection, portability, withdrawal of consent and complaints. Where ALTE processes data solely on a customer’s behalf, ALTE may direct a request to that customer and assist it as required by the DPA.

14. Direct marketing

ALTE will provide an unsubscribe or opt-out method in marketing communications where required. Service, security and billing notices are transactional and may still be sent while an account or legal obligation remains active.

15. Children

The Services are designed for business users and are not intended for children. ALTE does not knowingly offer self-service subscriptions to persons under 18.

16. Changes and contact

ALTE may update this Privacy Policy to reflect product, legal or operational changes. The current version will show its effective date. Privacy requests should be sent to info@alteglobal.ai. Complaints may also be made to the competent UAE data-protection authority where applicable.