Privacy Policy

1. Introduction

ALTURA Society LLC (“Altura,” “we,” “us,” or “our”) operates the Altura platform, mobile applications, and related services (collectively, the “Services”). Altura Society is a free, public community for people building businesses with AI, with one optional paid subscription (The Circle). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services.

This Policy is intended to address, at a general level, the California Consumer Privacy Act (CCPA) and the EU/UK General Data Protection Regulation (GDPR), among other data protection laws.

2. Information We Collect

2.1 Information You Provide

• Account Data: Email address, display name, and profile information when you create an account.
• Payment Data: Payment card details for your membership subscription (processed and stored by Stripe — we do not store full card numbers), plus your subscription and billing history.
• Project Data: The information you choose to publish about what you are building, including descriptions, links to your work, and the questions you ask the community.
• Communications: Messages, support tickets, feedback submissions, and community posts.

2.2 Information Collected Automatically

• Device & Browser Data: IP address, device type, operating system, browser type, screen resolution, and language preferences.
• Usage Data: Pages viewed, features used, click patterns, session duration, referral URLs, and in-app navigation paths.
• Analytics: We use Mixpanel and similar tools to analyze platform usage. These services may set cookies or use device identifiers.
• UTM & Campaign Data: Source, medium, campaign, and referral parameters when you arrive from external links or advertisements.

2.3 Information from Third Parties

• Stripe: Payment confirmation, customer ID, and membership subscription status.
• OAuth Providers: If you sign in via Google, Discord, or another OAuth provider, we receive your email and basic profile from that provider.

3. How We Use Your Information

• Provide Services: Review your application, operate your account and membership, and deliver club features.
• Payments: Process Stripe payments for membership subscriptions.
• Compliance: Comply with applicable law and respond to lawful requests.
• Communications: Send transactional emails (receipts, security alerts), product updates, and marketing (with opt-out).
• Improvement: Analyze usage patterns, debug issues, improve features, and personalize your experience.
• Security: Detect and prevent fraud, abuse, unauthorized access, and violations of our Terms of Service.

4. Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, we process your data under:

• Contract: Necessary to provide Services you have requested (account and membership).
• Legal Obligation: Tax reporting and cooperation with lawful requests.
• Legitimate Interest: Fraud prevention, platform security, analytics, and service improvement.
• Consent: Marketing communications and optional analytics cookies (you may withdraw consent at any time).

5. Data Sharing & Disclosure

We do not sell your personal information. We share data only as follows:

• Service Providers: Stripe (membership payments), Supabase (hosting/database), Vercel (deployment), Mixpanel (analytics), Resend (email), and cloud infrastructure providers — all under data-processing agreements.
• Legal & Regulatory: We disclose data when required by law, subpoena, court order, or to comply with tax-reporting obligations.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity.
• With Your Consent: When you explicitly authorize sharing (e.g., your public member profile).

6. International Data Transfers

Altura is based in the United States. If you access our Services from outside the U.S., your information will be transferred to and processed in the U.S. and other countries where our service providers operate.

For EEA/UK users, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms, to ensure adequate protection of your personal data during cross-border transfers.

7. Cookies & Tracking Technologies

We use the following categories of cookies:

• Essential: Required for authentication, security, and core functionality. Cannot be disabled.
• Analytics: Mixpanel and similar tools that track usage patterns. Can be disabled in browser settings.
• Preferences: Remember your settings (theme, language). Optional.

We do not use third-party advertising cookies or participate in cross-site behavioral advertising networks. You may control cookies through your browser settings; disabling essential cookies may impair functionality.

8. Data Retention

• Account Data: Retained while your account is active and for 30 days after a deletion request.
• Transaction & Tax Records: Retained as long as required by applicable tax and recordkeeping law (generally several years) so we and Stripe can meet reporting obligations.
• Analytics Data: Aggregated/anonymized within 24 months.
• Support Communications: Retained for 2 years after resolution.

9. Your Rights

All Users

• Access, correct, or update your personal information via account settings.
• Request deletion of your account and associated data (subject to legal retention requirements).
• Opt-out of marketing emails at any time via the "unsubscribe" link.
• Export your transaction history and ledger data.

California Residents (CCPA)

Under the CCPA, you have the right to:

• Know what personal information we collect, use, and disclose.
• Delete personal information we hold about you (with exceptions for legal obligations).
• Opt-Out of Sale: We do not sell personal information.
• Non-Discrimination: We will not discriminate against you for exercising these rights.

To submit a CCPA request, email alturaofficial@proton.me with subject line “CCPA Request.” We will respond within 45 days.

EEA/UK Residents (GDPR)

Under the GDPR, you additionally have the right to:

• Rectification: Correct inaccurate or incomplete personal data.
• Restriction: Request we limit processing of your data in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Object: Object to processing based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time.
• Lodge a Complaint: File a complaint with your local Data Protection Authority.

To exercise GDPR rights, email alturaofficial@proton.me with subject line “GDPR Request.” We will respond within 30 days.

10. Payments

Stripe-processed. Membership subscriptions are billed by Stripe. Credit card details are handled by Stripe, a PCI DSS Level 1 certified payment processor; Altura does not store full card numbers, CVVs, or bank routing numbers on our servers.

What Altura stores. We store your membership status, subscription dates, and billing history — not your payment credentials.

Not a bank or crypto wallet. Altura holds no balance for you, is not a bank or stored-value account, and does not custody or transact in any cryptocurrency, token, NFT, or other digital asset.

11. Children's Privacy

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately and we will delete such data.

12. Data Security

We implement industry-standard security measures including TLS encryption, bcrypt password hashing, Row-Level Security (RLS) on all database tables, and regular security audits. However, no method of transmission or storage is 100% secure.

You are responsible for maintaining the confidentiality of your account credentials.

13. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. There is currently no industry standard for recognizing or honoring DNT signals. We do not currently respond to DNT signals but will update this policy if a standard is established.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the Services after changes constitutes acceptance.