Altiro Privacy Policy

This Privacy Policy explains how Altiro LLC ("Altiro," "we," "us") handles personal information in connection with our client portal at portal.altiro.io (the "Service") and our marketing website at getaltiro.com (the "Website").

1. Who we are

Altiro LLC is a Colorado company based in Denver. We make a client portal for small tax and accounting firms. Firms ("Firms") use it to collect documents and information from their own clients ("Clients"), send requests and reminders, and message each other securely.

You can reach us at info@altiro.io or Altiro LLC, 2921 W 38th Ave #330, Denver, CO 80211.

2. Our two roles

We handle personal information in two different capacities, and your rights depend on which one applies.

When we decide how information is used (Altiro as the business in charge). This covers information about Firm account holders and team members, visitors to our Website, and the technical and usage data we collect to run, secure and improve the Service. This policy fully applies to that information.

When we act for a Firm (Altiro as service provider). When a Client submits intake answers, uploads documents or sends messages in a Firm's portal, that information belongs to the Firm. The Firm decides what to collect and how to use it. We store and process it only to provide the Service to the Firm and on the Firm's instructions, as described in our Terms of Service.

If you are a Client of a Firm, the Firm's own privacy notice governs how it uses your information. Please contact your Firm with questions or requests about your records, including requests to see, correct or delete them. If you contact us instead, we will refer you to your Firm or pass your request along, and we will help the Firm respond.

3. What we collect and how

Information Firms and Clients put into the Service (handled for the Firm):

• names, email addresses, phone numbers and mailing addresses;
• intake form answers, which may include Social Security numbers, dates of birth, income, business ownership details and bank account details;
• uploaded documents, such as W-2s, 1099s, tax returns, identification documents and bank statements;
• messages, tasks and internal staff notes; and
• information people submit through a Firm's public intake link before becoming a Client.

Information we collect directly (Altiro in charge):

• Account information. The name, email address and phone number you give when you sign up or are added as a team member. Our authentication provider, Clerk, handles sign-in.
• Activity logs. Records of who uploaded, viewed or downloaded which file and when, along with the IP address used. These logs help Firms see activity in their portal and help us secure the Service.
• Email delivery records. Information about emails the Service sends, such as reminders and notifications, including whether they were delivered or bounced.
• App analytics. Basic usage data from Vercel Web Analytics, such as pages visited, referring page, browser and device type, and approximate country.
• Website analytics and advertising data. On our marketing Website, Google Analytics and advertising tags from Meta and Google collect information such as pages viewed, device and browser details, IP address and identifiers stored in cookies. See Section 7.
• Communications. What you send us when you email support or give feedback.

We do not currently process payments. When billing launches, a payment processor (for example, CPACharge) will collect payment details directly, and we will update this policy before that happens.

4. How we use information

We use the information we are in charge of to:

• create and manage accounts and let people sign in;
• provide the Service, including sending the reminders and notifications Firms set up;
• keep the Service secure, detect misuse and investigate problems;
• provide support and answer questions;
• understand how the Service and Website are used so we can improve them;
• send service announcements, such as notices of changes to terms or pricing;
• send marketing emails to business contacts who signed up or asked to hear from us (you can unsubscribe at any time);
• measure and run advertising for Altiro on other sites, using Website data only; and
• comply with law and enforce our terms.

For information we handle on a Firm's behalf, we use it only to provide, secure, support and maintain the Service for that Firm, follow its instructions, and comply with law. We do not use Customer Data for advertising, and we do not sell it. No artificial intelligence providers process Customer Data today.

5. Legal bases

We are a US company serving US firms. Under US law, we rely on:

• our contract with each Firm, to provide the Service;
• our legitimate business interest in running, securing and improving the Service and Website and in marketing Altiro to businesses;
• your consent or choices, where the law requires it (for example, for certain marketing or tracking); and
• legal obligations, where we must keep or disclose information.

6. How we share information

We do not sell personal information. We share it only as described below.

Service providers. We use these companies to operate the Service and Website. They may process personal information only to provide their services to us.

When billing launches, we will add a payment processor to this list. We will update this table before adding any new provider that stores or processes Customer Data.

Advertising partners. Meta and Google receive data from the ad tags on our marketing Website, as described in Section 7. They do not receive data from inside the Service.

Within a Firm's portal. Information in a portal is visible to the Firm's team members, and Clients can see their own records. Staff-only internal documents are visible to the Firm's team only.

Legal requests and safety. We may disclose information if we believe in good faith that the law, a subpoena or another legal process requires it, or that it is necessary to protect the rights, safety or property of Altiro, our users or others. When the law allows, we will tell the affected Firm before disclosing its Customer Data so it can respond.

Business transfers. If Altiro is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal. The receiving company will have to honor this policy for information it receives, and we will notify Firms.

7. Cookies, analytics and advertising

In the Service (portal.altiro.io). We use cookies and similar technologies needed for sign-in, security and keeping you logged in. We use Vercel Web Analytics to understand basic usage. We do not place advertising tags inside the Service.

On the Website (getaltiro.com). We use Google Analytics to understand how visitors use the Website. We also use advertising tags from Meta and Google (often called pixels) to measure how our ads perform and to show Altiro ads to people who visited the Website. These tags let Meta and Google collect information about your visit and connect it with what they know about you.

Your choices:

• Most browsers let you block or delete cookies in their settings.
• Google offers a browser add-on to opt out of Google Analytics at tools.google.com/dlpage/gaoptout.
• You can change your ad settings with Google at adssettings.google.com and with Meta in your Facebook or Instagram ad preferences.
• You can learn about interest-based advertising and opt out of participating companies at optout.aboutads.info.

Our Website does not currently respond to "Do Not Track" browser signals or Global Privacy Control signals. If that changes, we will update this policy.

8. Retention

Customer Data. We keep Customer Data while the Firm's account is active. Firms cannot currently delete documents inside the Service; a Firm can ask us to remove specific data at info@altiro.io. When a Firm's account ends, the Firm can ask for an export within 30 days. After that, we delete the Firm's Customer Data within 90 days, except for copies in backups, which are removed as backups age out, and records we must keep to comply with law, resolve disputes or enforce our agreements.

Account information and activity logs. We keep these while the account is active and for as long afterward as reasonably needed for security, record-keeping, dispute resolution and legal compliance.

Website analytics. Analytics and advertising data is kept according to the settings and policies of Google and Meta.

9. Security

We use reasonable safeguards designed to protect personal information. Today these include:

• encryption in transit using TLS (HTTPS), with HSTS enabled;
• uploaded files stored in Amazon Web Services S3 with encryption at rest;
• data separated by Firm, so each Firm sees only its own portal and each Client sees only their own records;
• staff-only internal documents that Clients cannot see;
• download links that expire within minutes;
• an activity log of uploads, views and downloads; and
• removal of access when a Firm removes a team member.

No method of storing or sending information is completely secure, and we cannot guarantee that information will never be accessed without permission. If we confirm a security breach affecting a Firm's data, we will notify the Firm without undue delay, and we will notify individuals or regulators where the law requires us to.

10. Your choices and rights

Clients of a Firm. Contact your Firm to see, correct or delete information in its portal. The Firm controls those records and may have legal or professional reasons to keep them.

Firm users and Website visitors. You can:

• see and update your account details in the Service, or ask us to;
• ask for a copy of the personal information we hold about you;
• ask us to correct or delete it, subject to records we must keep;
• unsubscribe from marketing emails using the link in each email (we will still send essential service messages); and
• limit cookies and ad tracking as described in Section 7.

Send requests to info@altiro.io. We may need to confirm your identity before acting, and we will respond within the time the law requires.

California and Colorado residents. Depending on whether these laws apply to Altiro, residents of California and Colorado may have rights to know what personal information we collect and how we use it, to access, correct and delete it, to get a portable copy, and to opt out of the sale of personal information, targeted advertising or "sharing" for cross-context behavioral advertising. We do not sell personal information. The ad tags on our Website may count as targeted advertising or sharing under these laws; you can opt out using the choices in Section 7 or by emailing info@altiro.io. Colorado residents may appeal a decision we make on their request by replying to our response. We will not treat you differently for using these rights. You may use an authorized agent to make a request where the law allows.

11. Children

The Service and Website are for adults. You must be 18 or older to create an account, and we do not knowingly collect personal information directly from children under 13.

A Firm may upload documents that mention a Client's dependents, such as names, dates of birth or Social Security numbers on a tax return. That information is part of the Firm's Customer Data and is handled for the Firm as described in Section 2. If you believe a child has given us information directly, contact us and we will delete it.

12. International users

Altiro is built for firms in the United States. Our servers and service providers store and process information in the United States. If you use the Service from outside the US, your information will be transferred to and handled in the US, where privacy laws may differ from those in your country.

13. Changes to this policy

We may update this policy as the Service changes. We will post the new version at portal.altiro.io/privacy with a new effective date and version number.

If we make a material change, especially one that lets us use personal information in a new way, we will notify Firm account holders by email or in the Service before the change takes effect. We will not apply a materially less protective practice to information we collected earlier without giving notice and any choice the law requires.

14. Contact

Questions or requests about privacy can go to:

Altiro LLC
Altiro LLC, 2921 W 38th Ave #330, Denver, CO 80211
info@altiro.io