Privacy Policy

1. Introduction

Alternivite ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

2. Information We Collect

We collect several types of information to provide and improve the Service for you.

Account Information

When you create an account, we collect information that identifies you, including your name, email address, company name, job title, and password. This information is necessary to establish your account and provide you with access to the Service.

Compliance Documents

When you upload compliance documents for analysis, we store those documents on our secure servers to enable ongoing gap analysis, policy generation, and compliance tracking features. You retain full ownership of all documents you upload.

Usage Data

We automatically collect certain information when you access or use the Service. This includes pages visited, features used, actions taken within the platform, time and date of your visits, time spent on pages, and other diagnostic data. Usage data is collected in aggregate and is not linked to your personal identity unless you explicitly associate it.

Payment Information

When you subscribe to a paid plan, payment information is collected and processed by our third-party payment processor, Stripe. We do not store your credit card number, expiration date, or CVV on our servers. Stripe processes this information in accordance with PCI-DSS standards.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, and maintain the Service.
• To notify you about changes, updates, or new features to the Service.
• To provide customer support and respond to your inquiries.
• To gather analysis and insights so that we can improve the Service.
• To monitor usage patterns and detect, prevent, and address technical issues.
• To send you marketing and promotional communications, which you can opt out of at any time.
• To process transactions and send related information, including purchase confirmations and invoices.
• To comply with legal obligations and enforce our terms of service.

4. Data Processing for AI

When you upload compliance documents, our AI systems process them to provide gap analysis, policy generation, and compliance recommendations tailored to your organization and applicable regulatory frameworks.

Your document content is not used to train, fine-tune, or improve our AI models. All AI processing occurs within encrypted environments with strict access controls. Document content is processed in memory and is not retained beyond the time necessary to generate your requested output.

We employ industry-standard techniques to ensure that your proprietary information remains confidential throughout the AI processing pipeline. Model inputs and outputs are logged for quality assurance purposes but are not used for model training.

5. Data Sharing

We do not sell your personal information to third parties. We may share your information only in the following circumstances:

Service Providers

We may share information with third-party service providers who perform services on our behalf, including hosting infrastructure providers, payment processors, analytics tools, and email delivery services. These service providers are contractually obligated to protect your data and use it only for the purposes for which it was shared.

Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities, such as a court order, subpoena, or government agency request.

Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your information becomes subject to a different privacy policy.

With Your Consent

We may share your information for any other purpose with your explicit consent.

6. Data Security

We implement industry-standard security measures to protect your personal information. Our security practices include:

• AES-256 encryption at rest for all stored data, including compliance documents and account information.
• TLS 1.3 encryption in transit for all data transmitted between your browser and our servers.
• SOC 2 Type II certified infrastructure hosted on enterprise-grade cloud providers with continuous security monitoring.
• Regular penetration testing and vulnerability assessments by independent security firms.
• Role-based access controls limiting employee access to personal data on a need-to-know basis.
• Automated threat detection and incident response procedures.

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

You have the following rights regarding your personal data:

• Access: You can request a copy of the personal data we hold about you.
• Correction: You can request that we correct any inaccurate or incomplete personal data.
• Deletion: You can request that we delete your personal data, subject to certain legal exceptions.
• Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format.
• Opt Out: You can opt out of receiving marketing communications at any time by clicking the unsubscribe link in any email or updating your account preferences.
• Restrict Processing: You can request that we restrict the processing of your personal data under certain circumstances.
• Object to Processing: You can object to our processing of your personal data for certain purposes.

GDPR Rights for EU Residents

If you are a resident of the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local data protection authority. We process your data based on your consent, the performance of a contract, or our legitimate business interests.

CCPA Rights for California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information.

8. Data Retention

We retain your personal data only for as long as your account is active and as needed to provide the Service. If you cancel your subscription or delete your account, we will permanently delete all of your personal data, including compliance documents, within 30 days.

We may retain certain information as required by law or for legitimate business purposes, such as fraud prevention, financial record-keeping, or enforcement of our agreements. Retained data will be limited to what is strictly necessary and will continue to be protected under this Privacy Policy.

9. Children's Privacy

Our Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at privacy@alternivite.com so that we can take appropriate action.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this policy, we will notify you via email to the address associated with your account and by posting a prominent notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the Service after any changes to this policy constitutes your acceptance of the updated terms.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@alternivite.com
• Mail: Alternivite Privacy Team

We will respond to all data protection requests within 30 days.