Privacy policy

This Policy is governed by Law 1581 of 2012, Decree 1074 of 2015 and any other regulations that amend or supplement them. For its purposes:

• Personal data: any information linked to or that can be associated with one or more specific or identifiable natural persons.
• Sensitive data: data that affects the privacy of the Data Subject or whose misuse may lead to discrimination (for example, health data, racial or ethnic origin, biometric data).
• Data Subject: the natural person whose personal data is subject to processing.
• Data Controller: the party that decides on the database and/or the processing of the data.
• Data Processor: the party that processes data on behalf of the Controller.
• Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
• Authorization: the Data Subject's prior, express and informed consent to process their data.
• Transfer / Transmission: the sending of data to a recipient, inside or outside the country, as controller or as processor, respectively.

3.1. Data for which Alttos AI is the Controller. This Policy applies to the personal data of Website visitors, of Customers and their business contacts, of prospects (leads) and of those who contact Alttos AI. For this data, Alttos AI decides the purposes and means of processing.

3.2. Data for which Alttos AI is the Processor. With respect to the personal data of End Users (the people who interact with the AI Agents configured by a Customer, for example their clients, patients, prospects, students or guests), Alttos AI acts as Data Processor on behalf of the Customer, who is the Controller. Such processing is carried out in accordance with the Customer's instructions and is governed by the Data Processing Agreement (DPA) signed with them. End Users must direct their habeas data requests to the corresponding Customer.

Depending on the relationship with the Data Subject, Alttos AI may collect:

• Identification and contact data: name, email, phone, company and job title.
• Account data: user identifier, credentials and Platform configuration.
• Billing data: company name, Tax ID or document, address. Card or payment method data is processed directly by the payment gateway, not by Alttos AI.
• Browsing and usage data: IP address, device identifiers, cookies and analytics data.
• Communications data: the information the Data Subject shares in support, sales or PQR (requests, complaints and claims) inquiries.
• In its role as Processor, and on behalf of the Customer, the End User data flowing through the AI Agents, as described in the respective DPA.

The data for which Alttos AI is the Controller is processed in order to:

• Provide, manage and support the Services, and manage the contractual relationship.
• Manage account registration and administration.
• Handle billing and payment collection.
• Respond to requests, inquiries, petitions, complaints and claims.
• Improve, maintain and develop the Platform and the user experience.
• Send commercial and informational communications about the Services, based on the authorization granted and with the option to object at any time.
• Comply with legal, accounting and tax obligations, and respond to requirements from authorities.
• Prevent fraud and ensure information security.

7.1. As a general rule, Alttos AI does not request sensitive data for its own purposes. Providing sensitive data is optional; no Data Subject is obligated to provide it.

7.2. When, due to the nature of a Customer's business, End Users transmit sensitive data through the AI Agents (for example, health-related information in the case of providers in the health or aesthetic sector), such processing is carried out on behalf of the Customer, under the DPA, with the Customer, as Controller, being responsible for obtaining the explicit authorization required by law.

In accordance with Law 1581 of 2012, the Data Subject has the right to:

• Know, update and rectify their personal data.
• Request proof of the authorization granted, except where the law does not require it.
• Be informed, upon request, about the use made of their data.
• File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law.
• Revoke the authorization and/or request the deletion of the data when there is no legal or contractual duty to retain it.
• Access their personal data free of charge.

10.1. Contact channel. Requests are submitted to the email privacy@alttos.ai, indicating the Data Subject's name, a description of the facts and the request, and contact details.

10.2. Inquiries. Will be addressed within a maximum term of ten (10) business days from receipt. When this is not possible, the interested party will be informed and the inquiry will be addressed within the five (5) business days following the expiry of the first term.

10.3. Claims. If the claim is incomplete, the interested party will be requested within five (5) days to complete it. The claim will be resolved within a maximum term of fifteen (15) business days from the day following its receipt; when this is not possible, the interested party will be informed and it will be addressed within the eight (8) business days following.

10.4. Revocation and deletion. The Data Subject may revoke the authorization and request the deletion of their data. The request will not proceed when there is a legal or contractual duty to remain in the database.

Alttos AI uses, among others, the following types of providers that may process personal data to deliver the Services. This list may be updated, with notice given through the Website:

• Artificial intelligence model providers (for example, OpenAI, Anthropic, Google).
• Messaging and interaction platforms (for example, Meta Platforms: WhatsApp and Instagram).
• Payment processors and gateways.
• Infrastructure, hosting, CDN/DNS and email providers (for example, Hostinger, Cloudflare, Google Workspace and transactional email services).

If you messaged a business on WhatsApp (or another channel) powered by Alttos AI: your messages and contact details are managed by that business. To request their deletion, contact the business directly; it controls your information and can erase it with Alttos AI's tools. If you can't reach the business or need help, write to us at privacy@alttos.ai and we'll process your request.

What is deleted: your contact profile, the full history of conversations and messages, attachments (images, audio, documents) and the associated appointments. Only an audit record with no personal data (counts only) is kept, as proof of the deletion.

If you are an Alttos AI business customer: you can delete any contact's data from your dashboard (Contacts → Delete), or request the deletion of your entire account by writing to support.

Timeframe: we handle requests within a maximum of 30 days.

Limitation: Alttos AI cannot delete data that lives in external systems controlled by the business (for example, events in its own Google Calendar); for that, contact the business.

21.1. Scope and roles. When a merchant connects their Shopify store to Alttos AI, authorizing it through OAuth, Alttos AI accesses store data in read-only mode and solely to provide the customer service the merchant configures. In this processing the merchant is the Controller of its customers' personal data (End Users) and Alttos AI acts as Processor, under the Data Processing Agreement (DPA) entered into with the merchant. What is described in this section applies to the Shopify integration and, as applicable, to equivalent integrations with other e-commerce platforms.

21.2. Data accessed.

• Catalog (products, prices, availability): read in real time to answer product questions. Not stored.
• Order status and details: read in real time when an End User asks about their order. Not stored.
• Buyer's email address: used to locate that person's order (ownership verification). Not stored as a record derived from Shopify.

21.3. Purpose. Customer service — answering, on the merchant's behalf, questions about products and order status through the AI Agent.

21.4. AI processing. To compose the answers, the conversation content and the retrieved order data may be processed transiently by the language model providers acting as sub-processors, as described in section 13. This data is not used to train models.

21.5. Retention and deletion.

• Alttos AI does not persist catalog or order data; it is read live on each query.
• The store access token is stored encrypted and is deleted when the app is uninstalled.
• Alttos AI honors Shopify's mandatory privacy requests (customers/data_request, customers/redact and shop/redact). Because it keeps no End User records derived from the store, access and deletion requests are handled with no data to report or erase, and uninstalling triggers the deletion of the store's credentials.

21.6. Enquiries. Privacy enquiries regarding these integrations can be sent to privacy@alttos.ai.