Privacy Framework

Privacy Policy

Effective date: January 1, 2025. Last updated: May 2025.

This Privacy Policy describes how Alt+Shift+X ("we," "our," or "the platform") collects, uses, and protects information across our web, mobile, and tablet platforms. Our privacy framework is anchored in the principle of User Data Sovereignty — documents you process remain yours, and yours alone.

Data Collection and Usage

We collect the minimum data necessary to operate the platform. The following table summarises what we collect, why, and how long it is retained.

Data Type	Purpose	Retention
Name and business email	Account creation and authentication	Duration of account
Organisation details (industry, size, country)	Regional compliance and marketplace matching	Duration of account
Authentication credentials	Secure login and session management	Hashed; duration of account
Stripe Customer and Subscription IDs	Payment processing reference (no card data stored)	7 years (tax compliance)
Component usage metrics (query counts, response times, error rates)	Trust Score computation and recommendations	12–24 months by tier
Device identifiers and user agent strings	Security monitoring and brute-force protection (mobile/tablet only)	90 days rolling

We do not sell, rent, or share your personal information with third parties for advertising or marketing purposes.

Data Sovereignty and Document Privacy

Critical Standard — Marketplace Law 3: No component on this platform may store, transmit, or log user documents. Documents are held exclusively in the runtime Knowledge State and are permanently destroyed upon session termination. This is a contractual and technical guarantee.

Ephemeral Processing is the foundation of our document intelligence architecture. When you submit a document for extraction:

—The document is loaded into the runtime Knowledge State of the selected component.
—Extraction occurs entirely in memory; no copy is written to disk or transmitted externally.
—Upon session end, the Knowledge State is cleared and the document is irrecoverably destroyed.
—Anonymised analytics are strictly prohibited. We do not analyse document content for any secondary purpose.

Third-Party Integrations

Integration	Provider	Data Shared	Standard
Payment Processing	Stripe	Billing identifiers only; no card data passes through our servers	PCI DSS compliant
Transactional Email	SendGrid	Recipient email address and notification content	GDPR data processing agreement
Authentication (optional)	Google and Microsoft OAuth 2.0	Email address and profile name for SSO login	OAuth 2.0 / OpenID Connect
Enterprise SSO (optional)	Customer-provided SAML IdP	Configured by organisation administrator	SAML 2.0

All third-party providers are bound by data processing agreements. We conduct annual reviews to ensure continued compliance.

Mobile and Tablet Applications

The Alt+Shift+X mobile and tablet applications are subject to all policies stated above, with the following additional statements required by Apple App Store and Google Play Store guidelines.

Topic	Statement
Location data	The app does not track or request precise geographic location. Country of registration is used solely for regional marketplace compliance.
Cross-app tracking	Alt+Shift+X does not track user activity across third-party apps or websites for advertising purposes.
In-app notifications	Real-time alerts (Trust Score changes, security alerts, quota warnings) are delivered via WebSockets and require explicit user opt-in within the app settings.
Device data	Standard device identifiers and user agent strings are collected for security monitoring only and are purged on a 90-day rolling basis.
Camera and microphone	The app does not request camera or microphone access.

GDPR and Regulatory Compliance

Alt+Shift+X is designed with Privacy by Design and Privacy by Default principles. For users in the European Economic Area, the following rights apply.

Your Right	How to Exercise It
Right to access	Request a full export of your data via the P-50 data export function in account settings.
Right to deletion	Organisation Owners may delete their organisation. All PII is purged within 30 days of the request.
Right to portability	Your component stack and configuration can be exported as a YAML file from your account settings.
Right to rectification	Update personal information directly in account settings at any time.
Right to object	Contact our Data Protection Officer at privacy@altshiftx.com to lodge an objection.

A Data Processing Agreement (DPA) is available to all organisations upon request. Enterprise subscribers receive a pre-executed DPA as part of their onboarding package.

For security, all data at rest is protected with AES-256 encryption and all data in transit uses TLS 1.3. API keys and two-factor authentication secrets are rotated every 90 days.

Questions or Concerns

For privacy-related inquiries, data requests, or to obtain a copy of our Data Processing Agreement, please contact our Data Protection Officer.

privacy@altshiftx.com

We use cookies to keep you logged in, process payments, and understand how the Platform is used. Non-essential cookies stay off until you accept. By clicking Accept All, you agree to our Cookie Policy.