Alty is operated by TWC Tec (ABN 69 509 502 107), an Australian business. This policy explains what personal information we collect through the Alty website at alty.one and the Alty platform, why we collect it, who we share it with, and what you can do about it.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Who this policy covers
Alty serves two kinds of people, and the distinction matters:
- Visitors and enquirers — you use alty.one, join the waitlist, or complete the Business Friction Finder. TWC Tec is the controller of that information.
- Platform users — you sign in to an Alty instance provided by your employer or another organisation. That organisation decides what business data goes into Alty and how it is used; TWC Tec processes it on their behalf. Their own privacy policy applies to that data alongside this one, and requests about it are best directed to them first.
What we collect
When you join the waitlist
Your email address, and the date you submitted it.
When you complete the Business Friction Finder
Your name, email address, business name, a short description of what your business does, your team size, the friction points you select, the ratings you give, and any free-text answers you write. We generate a PDF summary from these answers and email it to you.
When you use the Alty platform
- Account identity — your email address, your name as recorded by the organisation that invited you, and, if you sign in with Google or Microsoft, the profile photo that provider returns.
- Sign-in records — session tokens, magic-link tokens, and the times and outcomes of sign-in attempts, kept so we can secure accounts and investigate abuse.
- Business data — whatever your organisation chooses to record in Alty: contacts, projects, documents, invoices, notes and similar. We do not decide what goes in there, and we do not use it to build profiles or train models.
Technical information
Our hosting provider records standard request data — IP address, browser user agent, request time and path — for security, abuse prevention and diagnostics. We do not use advertising cookies or third-party analytics trackers on alty.one. The cookies the platform sets are strictly functional: they keep you signed in and protect sign-in against cross-site request forgery.
Signing in with Google or Microsoft
Alty offers optional sign-in with a Google or Microsoft account. If you use it, we request only the basic profile scopes — your unique identifier, verified email address, name and profile photo. We do not request access to your email, files, calendar, contacts or any other data held by those providers, and we do not keep a refresh token, so we cannot reach your account after you finish signing in.
Information received from Google APIs is used only to authenticate you and populate your Alty profile. Alty's use and transfer of that information adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can revoke Alty's access at any time in your Google account permissions or your Microsoft account settings; your Alty account and its data are unaffected, and you can continue signing in by email link.
Why we use it
- To answer your enquiry, send your Friction Finder summary, and tell you when Alty is available.
- To create and secure your account, and to sign you in.
- To provide the platform to the organisation you belong to.
- To keep the service running, diagnose faults, and prevent abuse.
- To meet our legal and record-keeping obligations.
We do not sell personal information, we do not share it with advertisers, and we do not use your business data to train machine-learning models.
Who we share it with
We use a small number of service providers, each doing one job under contract to us:
| Provider | Purpose | Where |
|---|---|---|
| Cloudflare | Hosting, content delivery, storage and access control for the website and platform | Global edge network |
| Resend | Sending transactional email — sign-in links, summaries, notifications | United States |
| Google / Microsoft | Optional sign-in, only if you choose it | Global |
| TWC Tec CRM | Recording and following up enquiries; operated by TWC Tec on its own infrastructure | Australia |
Some of these providers store or process data outside Australia. We otherwise disclose personal information only where you ask us to, where the law requires it, or where it is necessary to protect our rights or someone's safety.
How it is protected
Traffic is encrypted in transit. Each customer organisation's platform data is held in its own isolated store, so one organisation cannot read another's. Administrative access is restricted to TWC Tec personnel who need it, behind multi-factor authentication. Credentials and API keys are held as encrypted secrets, never in our source code.
No system is perfectly secure. If a data breach occurs that is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
How long we keep it
- Waitlist and enquiry records — while the enquiry is live and for up to seven years afterwards for business records, unless you ask us to delete them sooner.
- Platform data — for as long as the organisation's instance is active. On termination it is deleted within 90 days, unless the organisation asks for an export first or the law requires us to keep it.
- Sign-in and security logs — typically 90 days.
Your rights
You can ask us to give you a copy of the personal information we hold about you, to correct it if it is wrong, or to delete it. Email support@alty.one and we will respond within 30 days. We may need to verify your identity first.
If you are a platform user, requests about your organisation's business data go to that organisation — we will refer you to them, and assist them in meeting the request.
You can unsubscribe from any marketing email using the link in it. Sign-in and other transactional emails are part of the service and cannot be unsubscribed from while your account is active.
Children
Alty is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16.
Changes
We may update this policy as Alty develops. The current version is always at alty.one/privacy, with the date it took effect at the top. Material changes affecting platform users will be notified by email.
Contact us
TWC Tec (ABN 69 509 502 107)
Email: support@alty.one
If you are not satisfied with our response to a privacy complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.