# Privacy Policy

PRIVACY POLICY

Effective Date: 8 March 2026

Version: 2.0

Alato Limited complies with the New Zealand Privacy Act 2020 and the General
Data Protection Regulation (GDPR) for users in the EEA.


1. INFORMATION WE COLLECT

1.1 Information You Provide

 * Account: Name, email, password (encrypted), organization name.

 * Billing: Address, payment info (processed via Stripe; we do not store card
   details).

 * Content: Spectrograms, audio recordings, metadata, location data.

 * Preferences: Consent choices for analytics and AI training.

1.2 Information Collected Automatically

 * Usage: Pages visited, analysis requests, errors, clicks.

 * Device: IP address (anonymized after 30 days), browser type, OS.

 * Cookies: Authentication tokens, analytics cookies (PostHog).

1.3 Cookie Policy

 * Essential: Required for login and security.

 * Analytics: Optional (PostHog). You can opt-out in Settings.

 * Consent: For EU users, we request consent before placing non-essential
   cookies.

1.4 Children's Data

The Service is not intended for children under 16. We do not knowingly collect
data from children.


2. DATA CONTROLLER / PROCESSOR ROLES (GDPR)

2.1 Dual Roles Clarified

 * We are Data Processor when you upload User Content for analysis. You are the
   Controller; we process per your instructions.

 * We are Data Controller when processing your account info, billing data, or
   when using anonymized data for AI training.

2.2 Sub-Processors

We use third-party sub-processors to provide the Service.


3. HOW WE USE YOUR DATA

Purpose

Data Used

Legal Basis (GDPR)

3.1 Service Delivery

Account, content, billing

Contract (Art. 6(1)(b))

3.2 Analytics & Improvement

Usage, device data

Consent OR Legitimate Interest (Opt-out in Settings)

3.3 AI Training

Spectrograms (anonymized)

Consent (Art. 6(1)(a))

3.4 Security

Logs, access patterns

Legitimate Interest (Art. 6(1)(f))

3.5 Legal Compliance

As required by law

Legal Obligation (Art. 6(1)(c))

3.6 Marketing (B2B)

Email, usage

Legitimate Interest / Consent

3.7 AI Training Sources: We train models using public datasets, licensed data,
and anonymized User Content (only where explicit consent is given).


4. DATA SHARING

We do not sell your personal data. We share data only with:

4.1 Service Providers (Data Processors)

 * AWS: Hosting and storage (Sydney, AU; Oregon, USA).

 * PostHog: Analytics (Opt-out available).

 * Stripe: Payment processing. Note: Stripe collects device identifying
   information for fraud detection. See Stripe's privacy policy.

 * SendGrid: Transactional emails.

 * Intercom: Support chat.

4.2 Legal Requirements: We may disclose info if required by law, court order, or
to protect rights and safety.

4.3 Anonymized Data: We may share aggregated, non-identifiable data with
research partners.


5. DATA RETENTION & DELETION

5.1 Retention Periods

Data Type

Retention Period

Active account data

Duration of account + 30 days

Closed account data

30 days after closure

User Content

Duration of account + 30 days (except anonymized data)

Billing records

7 years (tax law requirement)

Support tickets

3 years

Security logs

12 months

Analytics (identifiable)

12 months or until opt-out

Anonymized AI training data

Indefinitely

5.2 Deletion Process:

Upon request or account closure:

 1. Immediate: Account deactivated.

 2. 7 Days: Personal identifiers (name, email) permanently deleted.

 3. 30 Days: Raw User Content deleted from databases.

 * Exception: Anonymized data (if consented) is retained indefinitely as it is
   no longer personal data.

5.3 Anonymization Process (For AI Training):

If you consent to AI training, we:

 1. Remove all direct identifiers.

 2. Aggregate data with at least 10 other users.

 3. Apply differential privacy.

 4. Commit not to re-identify the data.


6. DATA SECURITY & BREACH NOTIFICATION

6.1 Security: We use AES-256 encryption at rest, TLS 1.3 in transit, and enforce
strict access controls.

6.2 Breach Notification:

 * GDPR: We notify the supervisory authority within 72 hours.

 * NZ Privacy Act: We notify the Privacy Commissioner and affected users if a
   breach causes, or is likely to cause, serious harm.


7. INTERNATIONAL TRANSFERS

7.1 Location: Alato Limited is based in New Zealand.

7.2 EU Adequacy: The European Commission recognizes New Zealand as providing an
adequate level of data protection. Data can be transferred from the EU to NZ
without additional safeguards (like SCCs).


8. YOUR DATA RIGHTS

Depending on your location (EEA, NZ, or other), you have the right to:

 * Access: Request copies of your data.

 * Rectification: Correct errors.

 * Erasure: Delete your data (subject to retention policies).

 * Object: Opt-out of analytics or marketing.

 * Portability: Download your data in JSON/CSV format.

How to Exercise: Contact us via our website www.alato.co.nz
[http://www.alato.co.nz]. We respond within 30 days.


9. CONTACT INFORMATION

Alato Limited

Address: 20 Marshmeadow Road, Hamilton, New Zealand

Supervisory Authority (NZ): Office of the Privacy Commissioner (privacy.org.nz
[http://privacy.org.nz])