Privacy Policy

This policy covers two different things: the information we collect when you visit altops.co, and the information our agents handle inside a customer deployment. They are kept separate, and the rules are not the same.

Information we collect

When you contact us or book a demo

If you submit the form on our site or book a call, we collect what you give us: your work email address, anything you write in the message, and the details you enter into our scheduling tool when booking. Form submissions are stored in our database. Demo bookings are handled by Calendly.

When you browse the site

We use Vercel Analytics to understand which pages people read and how the site performs. That covers pages visited, approximate location derived from IP address, referring URL, and device and browser type. We use it in aggregate, to decide what to write and what to fix. It does not use cookies.

If you accept cookies in the banner we show on your first visit, we also load a visitor-identification tag from Leadsy (vtag.ai). It uses your IP address and business databases to estimate which company you are visiting from, so our sales team knows which businesses are looking at AltOps. It identifies companies, not individuals, and it does not load at all if you decline.

Inside a customer deployment

To give you an account in the AltOps app at app.altops.co we collect your name, work email address, company and role, and a record of your sign-ins. When our agents run your workflows they necessarily handle your business data: the screen recordings your team makes, the documents an agent reads, the credentials it signs in with, and the records it reads or changes in the systems you connect. This is customer data. We process it to operate the service for you, on your instructions, and for no other purpose.

Intuit QuickBooks Online data

A customer can connect QuickBooks Online to AltOps so their agent can do accounting work in it. When they do, they sign in with Intuit and approve access for one QuickBooks company, and AltOps receives an access token for that company only.

What we access. Depending on the workflows the customer sets up, the agent may read and write that company’s accounting records: company information, customers and vendors (names, contact and billing details), products and services, the chart of accounts, tax codes and rates, invoices, bills, credit memos, payments, deposits and account balances.

How we use it. Only to carry out the work the customer has asked their agent to do in their own QuickBooks company, such as entering a supplier bill, exporting an invoice, recording a deposit or checking that two amounts match, and to show them what the agent did. The agent writes only what the customer’s workflow calls for, and every action is listed in the customer’s AltOps account.

What we never do with it. We do not sell QuickBooks data, use it for advertising or marketing, or share it with anyone other than the service providers listed below. We do not use it to develop, improve or train generalized AI or machine learning models, and we never combine one customer’s QuickBooks data with another’s.

Who sees it. The data is processed by the AI model provider that runs the customer’s agent, only to perform the requested task and under terms that do not allow training on it, and by the cloud providers that host the service. No person at AltOps reads it unless the customer asks us to for support, it is needed to keep the service secure, or the law requires it.

How we protect it. QuickBooks access and refresh tokens are encrypted at rest with AES-256 and used only by that customer’s own deployment, and all data is sent over encrypted (TLS) connections.

Disconnecting and deletion. A customer can disconnect QuickBooks at any time on the Integrations tab of Settings in the AltOps app, or from the Apps section of QuickBooks Online. When they disconnect in AltOps, we revoke the token with Intuit and delete it from our systems. A customer can also ask us to delete the QuickBooks data we hold by emailing kavish@altops.co; we delete it within 30 days, except where the law requires us to keep it.

Google user data

A customer can connect a Google account to AltOps so their agent can work in it. When they do, Google asks them to approve access, and we receive only what they approve. Depending on what the customer’s workflows need, that can include:

• Gmail: reading messages, writing drafts, sending email, and managing labels and filters.
• Google Drive, Docs, Sheets, Slides and Forms: reading, creating and updating files and form responses.
• Google Calendar: reading and creating events.
• Google Contacts and the organization’s directory: looking up people.
• Google Tasks and Google Chat: reading and posting tasks and messages.
• The account’s name and email address, to show which account is connected.

How we use it. Only to carry out the work the customer has set their agent up to do in their own account, such as drafting a reply, filing a document or updating a spreadsheet, and to show them what the agent did. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalized AI or machine learning models.

Who sees it. The data is processed by the AI model provider that runs the customer’s agent, only to perform the requested task and under terms that do not allow training on it, and by the cloud providers that host the service. No person at AltOps reads it unless the customer asks us to for support, it is needed for security, or the law requires it.

How we protect and keep it. Google access tokens are encrypted at rest and used only by the customer’s own deployment. We keep what the agent reads only as long as the task needs it, plus the run history the customer can see. A customer can disconnect a Google account at any time in Settings or at myaccount.google.com/permissions, and can ask us to delete the data we hold from it.

AltOps’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Other connected apps

The same rules apply to every other app a customer connects, such as Microsoft 365, Slack or CommonSKU: we receive only what the customer approves, use it only to perform their workflows, never sell it or use it to train models, and delete the connection’s tokens when the customer disconnects it.

How we use information

• To respond to enquiries and run demos.
• To operate, support and improve the service.
• To run the workflows a customer has asked their agents to run.
• To keep the service secure and investigate misuse.
• To meet legal and accounting obligations.

What we do not do

• We do not sell your personal information, and we do not share it for anyone else’s advertising.
• We do not share customer data with model providers for training. Your recordings, documents and order data are used to run your workflows, not to train anyone’s models.
• We do not move what an agent learns in your deployment (your pricing, margins, approval rules, supplier details or customer list) out of it.

Who we share information with

We share information only with the service providers we need to run the business, only for that purpose, and under terms that require them to protect it:

• Vercel: website hosting and analytics.
• Calendly: demo scheduling.
• Leadsy (vtag.ai): company-level visitor identification on the website, only when you have accepted cookies.
• Cloud infrastructure providers (DigitalOcean, Supabase): the isolated environments customer deployments run in, in the United States and, for customers who ask for it, Canada.
• AI model providers (Anthropic, OpenAI, Google): the models that run a customer’s agent, under terms that do not allow training on customer data.
• Resend: delivery of the reports and notifications we email customers.

We may also disclose information where we are legally required to, to protect the rights or safety of our customers or others, or as part of a merger or acquisition, in which case this policy travels with it.

Security

Data is encrypted in transit (TLS) and at rest, with credentials and access tokens encrypted with AES-256. Each customer runs in an isolated environment, and credentials are held in a password manager inside that environment rather than anywhere central. Access is limited to the people who need it to operate the service. If we become aware of a security incident that affects your data, we will tell you without undue delay and explain what we are doing about it. No system is perfectly secure, and we will not pretend otherwise, but this is where we spend the effort.

Data retention

We keep information for as long as we need it for the purposes above, or as long as the law requires. Customer data is retained for the life of the deployment. When a customer disconnects an app, we delete that connection’s tokens. When a customer closes their account, or asks us to, we delete their data within 30 days, except where the law requires us to keep it.

Your rights

You can ask us to access, correct, export or delete the personal information we hold about you, and you can opt out of any marketing contact at any time. Depending on where you live (for example under the GDPR in the UK and EU, the CCPA in California, or PIPEDA in Canada) you may have additional rights, including the right to object to certain processing and to complain to your local data protection authority. We honour these requests regardless of where you are, and we will not treat you differently for making one.

Where we act as a processor for a customer, requests about data inside their deployment should go to that customer, and we will support them in responding.

Cookies

We use only what the site needs to function, the analytics described above, and, with your consent, the Leadsy visitor-identification tag. We do not run advertising or retargeting pixels. The AltOps app at app.altops.co uses only the cookies it needs to keep you signed in.

On your first visit we ask before setting any non-essential cookies. If you decline, the Leadsy tag never loads and the site works exactly the same. Your choice is stored in your browser; to change it later, clear this site’s data and the banner will ask again. You can also block cookies in your browser entirely.

Children

AltOps is a business product and is not directed at children. We do not knowingly collect information from anyone under 16.

Changes

We may update this policy. When we make a material change we will update the date at the top of this page and, where it affects customers, tell them directly before it takes effect.

Contact us

For any question about this policy or to make a request about your information, email kavish@altops.co or reach us through our LinkedIn page, and we will follow up directly.