Meet Alto Privacy Policy

1. Who we are and when this policy applies

BTMK Holdings LLC, doing business as Meet Alto ("we," "us," or "Meet Alto"), provides business software for social inbox management, AI assistance, automations, contacts, and related integrations. This policy covers our websites, application, APIs, support, and related services.

We act as a controller for information about our visitors, account holders, billing, support, and our own service administration. When a business uses Meet Alto to manage its audience's messages, contacts, or commerce information, we generally process that information on the business's behalf as its processor or service provider. That business determines its purposes and instructions and is responsible for its own privacy notice. An applicable data processing agreement provides additional terms for that processing.

If you interact with a business that uses Meet Alto, contact that business first about its use of your information. You may also contact us, and we will assist or refer your request to the appropriate business where necessary. This policy does not govern independent third-party websites or applications you choose to use.

2. Information we collect

The information involved depends on the features you use and permissions granted.

Facebook, Instagram, WhatsApp, YouTube, and TikTok make different information and capabilities available. We receive only the information returned for the applicable connection, permissions, and enabled workflows. We do not receive every category from every platform.

3. Why we use information

We use account and operational information to provide accounts and workspaces, authenticate access, fulfill purchases, administer plans, provide support, communicate about the service, diagnose problems, protect against abuse, and meet legal obligations. We use product analytics to understand adoption and improve operation. We may send product or promotional communications where permitted, with an unsubscribe option.

On customers' instructions, we process social interactions and Customer Data to display inboxes; classify or moderate comments; generate replies; run approved automations and follow-ups; capture and organize contacts; retrieve relevant knowledge; provide order assistance; synchronize chosen integrations; and report on engagement and campaign or purchase attribution. Reports or lead classifications can involve inferences about interaction or purchase intent.

We also use website and app interaction information for referral attribution, advertising measurement, and marketing as described below. These activities are separate from using a customer's audience list to market Meet Alto. We do not use customer audience lists or private conversation content for our own advertising.

4. AI processing

Meet Alto uses OpenAI to provide AI features. Depending on the feature, we send relevant instructions, conversation text and context, knowledge excerpts, and supported media or transcripts for generation, classification, retrieval embeddings, or analysis. Relevant information can contain personal information. Pinecone supports storage and retrieval of knowledge embeddings and associated content or metadata.

We may retain conversation summaries, feedback, and business-specific guidance to provide continuity and improve responses for the relevant customer or connected account. This is distinct from training a general-purpose model. This policy does not authorize us to train a general-purpose model on your private Customer Data. Any materially different use requires a separate lawful basis, notice, and any required authorization.

AI results and classifications may be incorrect. Businesses choose the purposes and configuration of their automations and must provide required notices and safeguards. People interacting with a business can ask it about automated processing and available human assistance.

Our AI-generation telemetry is designed to record operational metadata such as model, feature, token use, latency, and error status without including raw prompts or responses in those telemetry events. This does not mean all application analytics or support records are anonymous or contain no personal information.

Ask Alto, the in-app AI assistant

Meet Alto includes Alto, an AI assistant that signed-in members of a workspace can use to ask about Meet Alto and their workspace, and to prepare drafts and changes.

What Alto uses. To answer, Alto uses your question, the conversation so far, and the workspace data it needs, such as connected accounts, campaigns, AI agents, sequences, analytics, knowledge sources, Inbox comments and messages, and, on plans that include Contacts, your contacts. This can include personal information about people who interact with your accounts, such as names, usernames and message content, and email addresses or phone numbers when you ask for them.

AI provider. Alto's requests are processed by OpenAI as our sub-processor. We ask OpenAI not to store these requests. Under OpenAI's API terms, API data is not used to train its models, and OpenAI may keep it for up to 30 days to monitor for abuse.

Storage and deletion. Alto conversations are stored with your workspace and are visible only to the member who started them. They are deleted automatically 90 days after the last message, and you can delete one at any time. Deleting a workspace deletes its Alto conversations. Drafts Alto creates are kept like any other draft until you delete them.

Analytics. Our product analytics record how Alto is used, such as the number of questions, which tools it used, response times, costs, errors and your ratings of answers. They don't include the text of your questions or Alto's answers.

Changes Alto makes. Alto never sends messages to your customers, publishes anything or deletes anything. It saves drafts for you to review, and it changes or pauses an existing item only after you click Apply.

5. Who receives information

We disclose information as needed for the purposes in this policy:

The vendors that process a particular person's information depend on the feature and configuration. Not every listed provider receives all information. Customer-selected destinations may process information under their own terms and privacy notices. Contact us for information about subprocessors applicable to your use case and any available data processing terms.

We may also disclose information to professional advisers, authorities, or other parties when reasonably necessary to comply with law, establish or defend legal rights, or protect against fraud and security threats. In a merger, financing, acquisition, or sale of assets, information may be disclosed or transferred subject to appropriate protections and any notice required by law.

For billing inquiries, refunds, or payment disputes, we may share relevant transaction records, payment-authorization and policy-acceptance records, service-delivery or usage evidence, and related communications with payment processors, banks, card issuers, payment networks, and advisers handling the matter. We limit these disclosures to information reasonably necessary to investigate or resolve the issue, rather than unrelated customer conversations or audience information.

6. Cookies, analytics, advertising, and choices

We use cookies and similar technologies for authentication, security, saved preferences, analytics, referrals, and advertising measurement. These purposes are not all essential to providing the service.

PostHog can associate app activity with account identity. Meta Pixel and Meta Conversions API can receive interaction and conversion events, device or browser information, identifiers, and hashed contact information. Google advertising features can receive conversion information and hashed email where used. Hashing is a matching safeguard, not anonymization. Tolt supports referral attribution. Our own ad-click cookie, alto_click_id, has a configured browser lifetime of 90 days; other storage lifetimes vary by provider and settings.

Advertising-related disclosures may constitute a "sale," "sharing," or targeted advertising under some US privacy laws even if no money is exchanged for the information. We do not sell customer audience contact lists. We do not use YouTube API Data for targeted advertising.

Our marketing website uses visitor-identification services from Retention.com and/or RB2B, depending on the page and configuration. These services may use cookies, device or network information, and partner data to associate a visit with an email address or business profile, including when you have not submitted a form. We may use the matched information for sales and marketing outreach where legally permitted. Read the Retention.com privacy notice and RB2B privacy notice for their practices. Their controls include the Retention.com opt-out and RB2B GDPR opt-out. You can also direct privacy requests to Meet Alto; vendor opt-outs do not replace our own obligations or provide consent for tracking or outreach.

To request withdrawal of consent or opt out of sale, sharing, or targeted advertising, contact hey@meetalto.ai and identify the website or account involved. Applicable law may require prior consent, on-site choice controls, or recognition of Global Privacy Control and other opt-out signals. Contacting us is an additional request route, not a substitute for those requirements. Blocking cookies alone does not necessarily stop server-side transfers.

You may also adjust browser storage settings and use advertising providers' controls. Those controls are additional choices, not a replacement for rights you can exercise directly with us. Contact hey@meetalto.ai for assistance. Refusing optional tracking does not prevent use of core service functions, although strictly necessary storage may be needed for sign-in and security.

7. Legal bases where applicable

Where the GDPR, UK GDPR, or a similar law requires a legal basis for our controller processing, we rely on:

• Contract necessity for providing the service you request and administering your purchase.
• Legitimate interests in securing and maintaining the service, preventing misuse, understanding business use, and handling business support, balanced against your rights.
• Consent for optional tracking, marketing, or other activities where required. You may withdraw it without affecting the lawfulness of earlier processing.
• Legal obligations for applicable accounting, compliance, and lawful requests.

Our customers are responsible for the legal bases for information we process on their instructions. If information is required to provide a requested feature and you do not supply it, we may be unable to provide that feature.

8. Retention, disconnection, and deletion

We retain information for the relevant service purpose, subject to customer instructions, applicable agreements, legal obligations, and platform restrictions. Retention depends on the category, whether the connection or account remains active, and whether information is needed for a dispute, fraud prevention, or legal compliance.

Account records, customer-managed content, contacts, and conversations are generally retained while needed to provide the workspace and until an applicable deletion instruction or retention limit applies. Operational caches and job records have separate, limited retention rules; these do not establish a universal deadline for every copy of Customer Data.

To request account closure or deletion, contact hey@meetalto.ai and identify the account, workspace, or connected business involved. We may verify identity and authority without requesting unnecessary information. Closing an individual login is not necessarily an instruction to erase an organization shared with other authorized people.

Following verified account closure, we delete or de-identify personal information within 90 days, except for limited information that must be retained for legal, accounting, dispute, or security purposes. A shorter applicable legal or platform deadline takes priority. For disconnected Facebook or Instagram integrations, associated information is deleted within 180 days at the latest unless a shorter period applies; this is not a waiting period for valid deletion requests. Requests requiring earlier erasure are handled within their applicable deadlines.

Disconnecting an integration stops access through that connection but does not, by itself, establish that all previously stored information has been erased. A Meta deletion-request receipt acknowledges receipt, not completion. Contact us for a deletion status update. Deletion instructions must also address relevant derived information and copies held by our processors. Limited backup copies, where present, remain protected and must not be restored to active use contrary to a deletion instruction.

For YouTube API Data, we refresh or remove covered stored data within 30 days unless a specific policy exception applies. In-app disconnection revokes authorization and initiates deletion; covered Authorized Data is deleted as soon as possible and within 7 calendar days. Direct deletion requests and account deletion also trigger removal of covered stored YouTube data within 7 calendar days. If access is revoked in Google security settings, we periodically check authorization and delete affected API Data as soon as possible and within 30 calendar days of revocation. These deadlines also apply to covered derivative copies; other general retention periods do not override them.

Removing information from Meet Alto does not delete the corresponding content on a social platform, Shopify, a customer-selected integration, or a previously authorized external application. Ask the relevant business or provider about those copies.

9. Google, YouTube, and TikTok information

Meet Alto uses YouTube API Services. Google's processing is described in the Google Privacy Policy. Your use of YouTube features is also subject to the YouTube Terms of Service.

We use authorized channel identity, video metadata, comments, public commenter information, and OAuth credentials to provide the YouTube features you request. Relevant comment text and context may be processed by OpenAI for AI assistance. We do not sell YouTube API Data or use it for targeted advertising. Permissions do not authorize unrelated uses.

Disconnect your channel within Meet Alto or revoke access through Google security settings. For access, use, sharing, or deletion questions, email hey@meetalto.ai. The preceding section explains the separate deletion deadlines.

TikTok information and choices

When you authorize a TikTok business-account connection, we may receive account identifiers, username, profile information, account type, granted permissions, and access or refresh credentials; video and post identifiers and metadata; comments, replies, mentions, and associated public profile or engagement information; and, where Business Messaging is enabled and authorized, conversation identifiers, message content, timestamps, delivery information, and supported attachments. The categories actually received depend on the permissions, available API, region, and enabled features. Connecting an account does not give us unrestricted access to TikTok activity.

We use this information to maintain the authorized connection and provide the requested inbox, comment management, moderation, replies, eligible messaging, automations, and related reporting. Where an authorized AI feature is enabled, relevant TikTok content and context may be sent to OpenAI as described in Section 4. Necessary infrastructure providers and your authorized workspace members may process or access the information. Any onward disclosure to a customer-selected integration or application must be permitted by the applicable TikTok rules as well as your instructions and applicable law. We do not sell TikTok API information or use it for our own targeted advertising, and this policy does not authorize its use to train a general-purpose AI model.

You can stop enabled workflows, disconnect the account in Meet Alto, or revoke access through TikTok's applicable account or business authorization controls. You can request access, correction, or deletion by emailing hey@meetalto.ai and identifying the relevant account or business. If we process information for a business you interacted with, we may need to coordinate your request with that business.

Disconnection or confirmed withdrawal initiates the applicable connection cleanup: stopping further authorized processing, revoking credentials where supported, and removing covered TikTok-sourced information and derived copies from our systems and relevant processors. Covered data must not be kept beyond its authorized purpose or applicable retention deadline. A general 90-day or 180-day period elsewhere in this policy does not authorize delaying TikTok deletion where an earlier deadline applies. Separately supplied customer contact information may be retained only where it has an independent lawful purpose and is not otherwise subject to the deletion request. A pending cleanup is not a confirmation that erasure is complete; contact us for its status. Deleting our stored information does not remove the corresponding content from TikTok itself.

TikTok handles information under its own Privacy Policy, including the policy applicable to your region. That policy governs TikTok's practices; this policy governs Meet Alto's processing. Contact hey@meetalto.ai with questions or complaints about our use of TikTok information.

10. International processing

Meet Alto is operated by a US company. Information may be processed in the United States and other countries where our service providers operate. Those countries may have different privacy laws from your own.

Where a transfer requires safeguards, we must use a legally valid transfer mechanism and any required supplementary measures. Depending on the transfer, this may involve an adequacy decision or applicable standard contractual clauses and UK transfer provisions. Contact us to ask which safeguards apply or request a copy, subject to appropriate redactions. This notice does not represent that every vendor or transfer is covered by the same mechanism.

11. Your rights and choices

Depending on your location and the processing, you may have rights to access, correct, delete, or obtain a portable copy of information; restrict or object to processing; withdraw consent; or opt out of sale, sharing, targeted advertising, or certain profiling. Where applicable, you may request limits on certain uses of sensitive personal information and appeal a decision on your request. We will not unlawfully discriminate against you for exercising these rights.

Submit requests to hey@meetalto.ai. Include enough information to locate your records and explain what you want to exercise. An authorized agent may act for you where permitted, subject to verification of authority. We respond within the applicable legal deadline and explain permitted extensions or reasons we cannot fulfill a request. To appeal a decision, reply with "Privacy appeal" and the request reference. You may also complain to the privacy regulator with jurisdiction over your situation.

California residents: the categories, sources, purposes, and recipient categories in Sections 2–6 describe our processing. Identifiers, device and interaction information, visitor-identification information, and conversion information may be disclosed to advertising or visitor-identification partners in ways treated as sale or sharing. Use the contact route above to request an opt-out. We do not knowingly sell or share personal information of people under 16.

Unsubscribe from promotional emails using their unsubscribe link or by contacting us. Essential account, billing, and security messages may still be sent. For messages from a business using Meet Alto, exercise marketing preferences with that business as well.

12. Security and children

We use technical and organizational measures designed to protect information, including authenticated access, workspace permissions, and protections for supported credentials and storage paths. See our Security Policy for details. No system is completely secure.

Meet Alto accounts are intended for adults acting for businesses, not children. Customers must not use the service to unlawfully collect children's information. If you believe a child has provided information unlawfully, contact us so we can investigate and take appropriate action, including deletion where required.

13. Updates and contact

We will identify the effective date when this policy is updated and provide additional notice of material changes where required. We will obtain consent before a new use when legally or contractually required, including applicable Google or YouTube requirements. Continuing to use the service is not a substitute for consent where consent is required.

BTMK Holdings LLC, doing business as Meet Alto
8 The Green, Suite R, Dover, Delaware 19901, United States
Email: hey@meetalto.ai