Privacy Policy

1. Introduction

ALTURA Society LLC (“Altura,” “we,” “us,” or “our”) operates the Altura platform, mobile applications, and related services (collectively, the “Services”). Altura Society is a network for people building businesses. Altura is free. Paid features are not available. This Privacy Policy explains, in plain English, what we collect, why, who we share it with, and how to get it deleted.

This Policy is intended to address, at a general level, the California Consumer Privacy Act (CCPA) and the EU/UK General Data Protection Regulation (GDPR), among other data protection laws.

2. Information We Collect

2.1 Information You Provide

• Account Data: Email address, display name, and profile information when you create an account.
• Payment Data: Payment card details for your membership (processed and stored by Stripe; we do not store full card numbers), plus your membership status, renewal date, and billing history.
• Mailing Address: If you become a member, the postal address you give us so we can mail your physical card. It is stored on your account and used only for shipping the card and replacements.
• Survey Answers: What you tell us on the join survey (what you are building, your stage, what you need, how you heard about us).
• Project Data: The information you choose to publish about what you are building, including descriptions, links to your work, and the questions you ask the community.
• Communications: Messages, support tickets, feedback submissions, and community posts.

2.2 Information Collected Automatically

• Device & Browser Data: IP address, device type, operating system, browser type, screen resolution, and language preferences.
• Usage Data: Pages viewed, features used, click patterns, session duration, referral URLs, and in-app navigation paths.
• Product Analytics (PostHog): We use PostHog to count a small, fixed set of product events, for example that a signup started, a profile was viewed, or a checkout was completed. Analytics is tied to your account ID only, never your email or name. We do not capture what you type, and we honor the browser Do Not Track setting (see Section 13).
• Error monitoring and session replay (Sentry): To fix bugs we record a small share of sessions (about 5%, and sessions where an error occurs) as a replay of page layout and clicks, with all text, typed input and media masked so we never see what you read or type.
• UTM & Campaign Data: Source, medium, campaign, and referral parameters when you arrive from external links or advertisements.

2.3 Information from Third Parties

• Stripe: Payment confirmation, customer ID, and membership subscription status.
• OAuth Providers: If you sign in via Google, Discord, or another OAuth provider, we receive your email and basic profile from that provider.

3. How We Use Your Information

• Provide Services: Operate your account, public profile, feed, Discover, private network, relevance, introductions, and direct messages.
• Payments: Process annual membership payments through Stripe, and send you a renewal reminder email at least 30 days before each renewal.
• Member Card: Print and mail your physical member card to the address on file.
• Referrals: Attribute signups to the referral link they arrived through and issue referral credit.
• Compliance: Comply with applicable law and respond to lawful requests.
• Communications: Send transactional emails (receipts, security alerts), product updates, and marketing (with opt-out).
• Improvement: Analyze usage patterns, debug issues, improve features, and personalize your experience.
• Security: Detect and prevent fraud, abuse, unauthorized access, and violations of our Terms of Service.

4. Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, we process your data under:

• Contract: Necessary to provide Services you have requested (account and membership).
• Legal Obligation: Tax reporting and cooperation with lawful requests.
• Legitimate Interest: Fraud prevention, platform security, analytics, and service improvement.
• Consent: Marketing communications (you may withdraw consent at any time by unsubscribing).

5. Data Sharing & Disclosure

We do not sell your personal information. We share data only as follows:

• Service Providers: Stripe (payment processing), Supabase (database and authentication), PostHog (product analytics), Sentry (error monitoring and masked session replay), Resend (email), OneSignal (push notifications), the printer and postal carrier that produce and deliver member cards (mailing address only), and our web hosting provider. Each receives only what it needs to do its job.
• Legal & Regulatory: We disclose data when required by law, subpoena, court order, or to comply with tax-reporting obligations.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity.
• With Your Consent: When you explicitly authorize sharing (e.g., your public member profile).

6. International Data Transfers

Altura is based in the United States. If you access our Services from outside the U.S., your information will be transferred to and processed in the U.S. and other countries where our service providers operate.

For EEA/UK users, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms, to ensure adequate protection of your personal data during cross-border transfers.

7. Cookies & Tracking Technologies

We use the following categories of cookies:

• Essential: Required for authentication, security, and core functionality. Cannot be disabled.
• Analytics: A PostHog identifier so product events from the same browser can be counted once. Turn on Do Not Track in your browser and no analytics runs at all.
• Preferences: Remember your settings (theme, language). Optional.

We do not use third-party advertising cookies or participate in cross-site behavioral advertising networks. You may control cookies through your browser settings; disabling essential cookies may impair functionality.

8. Data Retention

• Account Data: Retained while your account is active and for 30 days after a deletion request.
• Transaction & Tax Records: Retained as long as required by applicable tax and recordkeeping law (generally several years) so we and Stripe can meet reporting obligations.
• Analytics Data: Aggregated/anonymized within 24 months.
• Support Communications: Retained for 2 years after resolution.

9. Your Rights

All Users

• Access, correct, or update your personal information via account settings.
• Request deletion of your account and associated data through our data deletion page (subject to legal retention requirements, such as tax records). We process requests within 30 days.
• Opt out of marketing emails at any time via the unsubscribe link.
• Ask for a copy of the data we hold about you.

California Residents (CCPA)

Under the CCPA, you have the right to:

• Know what personal information we collect, use, and disclose.
• Delete personal information we hold about you (with exceptions for legal obligations).
• Opt-Out of Sale: We do not sell personal information.
• Non-Discrimination: We will not discriminate against you for exercising these rights.

To submit a CCPA request, email hello@alturasociety.com with subject line “CCPA Request.” We will respond within 45 days.

EEA/UK Residents (GDPR)

Under the GDPR, you additionally have the right to:

• Rectification: Correct inaccurate or incomplete personal data.
• Restriction: Request we limit processing of your data in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Object: Object to processing based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time.
• Lodge a Complaint: File a complaint with your local Data Protection Authority.

To exercise GDPR rights, email hello@alturasociety.com with subject line “GDPR Request.” We will respond within 30 days.

10. Payments

Stripe-processed. The annual membership is billed by Stripe, our payment processor. Credit card details are handled by Stripe, a PCI DSS Level 1 certified payment processor; Altura does not store full card numbers, CVVs, or bank routing numbers on our servers.

What Altura stores. We store your membership status, term dates, and billing history, not your payment credentials.

Not a bank or crypto wallet. Altura holds no balance for you, is not a bank or stored-value account, and does not custody or transact in any cryptocurrency, token, NFT, or other digital asset.

11. Children's Privacy

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately and we will delete such data.

12. Data Security

We implement industry-standard security measures including TLS encryption, bcrypt password hashing, Row-Level Security (RLS) on all database tables, and regular security audits. However, no method of transmission or storage is 100% secure.

You are responsible for maintaining the confidentiality of your account credentials.

13. Do Not Track Signals

Some browsers send a "Do Not Track" (DNT) signal. We honor it: when DNT is on, our analytics library does not load and no product events are recorded for that browser. Essential cookies needed to keep you signed in still work.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the Services after changes constitutes acceptance.