Alty is provided by Alty One (ABN 69 509 502 107), a business name registered in Australia. This policy explains what personal information we collect through the Alty website at alty.one, the Alty platform, and the Alty apps for Android and iOS, why we collect it, who we share it with, and what you can do about it.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Who this policy covers
Alty serves two kinds of people, and the distinction matters:
- Visitors and enquirers — you use alty.one, send us an enquiry, or complete the Business Friction Finder. Alty One is the controller of that information.
- Platform users — you sign in to an Alty instance provided by your employer or another organisation. That organisation decides what business data goes into Alty and how it is used; Alty One processes it on their behalf. Their own privacy policy applies to that data alongside this one, and requests about it are best directed to them first.
What we collect
When you send us an enquiry
Your name and email address, and anything else you choose to give us on the form: your business name, phone number, industry, team size, country, the parts of Alty you are interested in, and your message. We record it as an enquiry in our own Alty workspace, notify our team, and email you a copy of what you sent.
When you complete the Business Friction Finder
Your name, email address, business name, a short description of what your business does, your team size, the friction points you select, the ratings you give, and any free-text answers you write. We generate a PDF summary from these answers and email it to you.
When you use the Alty platform
- Account identity — your email address, your name as recorded by the organisation that invited you, and, if you sign in with Google or Microsoft, the profile photo that provider returns.
- Sign-in records — session tokens, magic-link tokens, and the times and outcomes of sign-in attempts, kept so we can secure accounts and investigate abuse.
- Business data — whatever your organisation chooses to record in Alty: contacts, projects, documents, invoices, notes and similar. We do not decide what goes in there, and we do not use it to build profiles or train models.
Technical information
Our hosting provider records standard request data — IP address, browser user agent, request time and path — for security, abuse prevention and diagnostics. We do not use advertising cookies or third-party analytics trackers on alty.one. The cookies the platform sets are strictly functional: they keep you signed in and protect sign-in against cross-site request forgery.
When you use the Alty mobile apps
The Android and iOS apps are another way into the same Alty instance, so everything above applies to them. In addition:
- Device records — when you sign in on a device, we record an identifier for it, its platform, the app version and when it was last seen, so you and your administrators can see and revoke signed-in devices.
- Push notifications — if you allow notifications, we store a push token for the device and send notifications through Google Firebase Cloud Messaging (Android) or the Apple Push Notification service (iOS). A notification carries a short title and message, such as which ticket or job changed.
- Camera and photos — used only when you choose to take or attach a photo, for example in a site audit or for a receipt. The photo is stored in your organisation's instance like any other upload.
- Location — only while you are using the app and only if you allow it: to tag site photos with where they were taken and to show the site you are at. We do not track your location in the background.
- Microphone and speech recognition — only when you use voice with the assistant. Speech is turned into text by your device's own speech service (Apple's or Google's, depending on the device and its settings); Alty receives the text, not the audio.
- Face ID or fingerprint unlock — handled entirely by your device. Alty never receives biometric data, only whether the unlock succeeded.
The apps contain no advertising, no advertising identifiers and no third-party analytics or tracking SDKs, and we do not track you across other companies' apps or websites.
Signing in with Google or Microsoft
Alty offers optional sign-in with a Google or Microsoft account. If you use it, we request only the basic profile scopes — your unique identifier, verified email address, name and profile photo. We do not request access to your email, calendar or contacts, and signing in keeps no long-lived token, so we cannot reach your account after you finish signing in.
Connecting your own storage — Google Drive, Dropbox or OneDrive
An Alty administrator can separately choose to connect their organisation's Google Drive, Dropbox or Microsoft OneDrive, so that documents Alty holds are stored in your own account rather than ours. This is a second, explicit consent — it never happens as part of signing in, and Alty works without it.
That connection requests one scope,
drive.file, which grants access only to files Alty itself
creates in your Drive. Alty cannot see, list, open or delete anything else in
your Google account, including files you move out of the folder it creates. When the
connection is used, Alty stores documents you or your customers have already given it
— such as ticket attachments and uploaded files — and reads them back when you open
them. It does not scan your Drive, and it does not use your Drive content for
analytics, advertising, or to train any AI or machine-learning model.
Dropbox and OneDrive work the same way. Alty is registered with each as an
app-folder app — Dropbox's App folder access and Microsoft's
Files.ReadWrite.AppFolder permission — so it can reach only its own folder
under Apps/ and nothing else in that account.
An administrator can disconnect at any time, in Alty or from your Google account permissions. Disconnecting deletes the access Alty holds; it does not delete anything from your Drive. Files Alty has already written there remain yours, in your account, and simply stop being reachable through Alty. The same applies to Dropbox and OneDrive, which can be disconnected in Alty or from that provider's connected-apps settings.
Information received from Google APIs is used only for the purposes described above. Alty's use and transfer of that information adheres to the Google API Services User Data Policy, including its Limited Use requirements. Revoking access leaves your Alty account and its data unaffected, and you can continue signing in by email link.
Connecting Xero
An administrator can connect their organisation's Xero account so that Alty can create and update invoices, payments and contacts there, read the organisation's Xero settings, and attach documents. Alty acts in Xero only for that organisation's instance, only through the connection the administrator approved, and the connection can be removed in Alty or in Xero at any time.
The AI assistant and AI features
Alty includes an assistant ("Alt") and AI features that draft text and read the contents of documents you upload, such as receipts and supplier bills. When you use them, the request — your question or the document, and the business records the assistant looks up to answer it — is sent to Google's Gemini models through Google Cloud, which processes it in the United States or Google's global network and returns the result.
- AI features run when someone in your organisation uses them, or when your organisation has switched on a feature that uses them, such as reading expense receipts and bills as they arrive. Nothing else is sent to an AI model.
- The assistant can see only what the member using it is allowed to see.
- Google processes this data as our service provider under its Google Cloud terms, which do not permit it to use the data to train its models.
- AI output can be wrong. Drafts are shown to you to check and send yourself; the assistant does not send anything on its own.
Why we use it
- To answer your enquiry, send your Friction Finder summary, and tell you when Alty is available.
- To create and secure your account, and to sign you in.
- To provide the platform to the organisation you belong to.
- To keep the service running, diagnose faults, and prevent abuse.
- To meet our legal and record-keeping obligations.
We do not sell personal information, we do not share it with advertisers, and we do not use your business data to train machine-learning models.
Who we share it with
We use a small number of service providers, each doing one job under contract to us:
| Provider | Purpose | Where |
|---|---|---|
| Cloudflare | Hosting, content delivery, storage and access control for the website and platform | Global edge network |
| Resend | Sending transactional email — sign-in links, summaries, notifications | United States |
| Google / Microsoft | Optional sign-in, only if you choose it | Global |
| Google Cloud (Gemini) | The AI assistant, drafting and document reading, only when used | United States / global |
| Google Maps Platform | Address search and maps when you enter or view an address | Global |
| Google Firebase Cloud Messaging / Apple Push Notification service | Delivering notifications to the Android and iOS apps, if you allow them | Global |
| Google Drive, Dropbox, Microsoft OneDrive | Storing documents in your organisation's own account, only if an administrator connects one | Per that provider and account |
| Xero | Invoicing and payments, only if an administrator connects it | Per Xero |
| Alty (our own workspace) | Recording and following up enquiries — they become leads in our own Alty workspace, hosted on Cloudflare like the platform | Global edge network |
Some of these providers store or process data outside Australia. We otherwise disclose personal information only where you ask us to, where the law requires it, or where it is necessary to protect our rights or someone's safety.
How it is protected
Traffic is encrypted in transit. Each customer organisation's platform data is held in its own isolated store, so one organisation cannot read another's. Administrative access is restricted to Alty One personnel who need it, behind multi-factor authentication. Credentials and API keys are held as encrypted secrets, never in our source code.
No system is perfectly secure. If a data breach occurs that is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
How long we keep it
- Enquiry records — while the enquiry is live and for up to seven years afterwards for business records, unless you ask us to delete them sooner.
- Platform data — for as long as the organisation's instance is active. On termination it is deleted within 90 days, unless the organisation asks for an export first or the law requires us to keep it.
- Sign-in and security logs — typically 90 days.
Your rights
You can ask us to give you a copy of the personal information we hold about you, to correct it if it is wrong, or to delete it. Email support@alty.one and we will respond within 30 days. We may need to verify your identity first.
You do not need to email us to delete your account — you can do it yourself, from the app or the web, and it takes effect immediately. How to delete your Alty account sets out exactly what is removed, and what stays with the organisation that runs your workspace.
If you are a platform user, requests about your organisation's business data go to that organisation — we will refer you to them, and assist them in meeting the request.
You can unsubscribe from any marketing email using the link in it. Sign-in and other transactional emails are part of the service and cannot be unsubscribed from while your account is active.
Children
Alty is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16.
Changes
We may update this policy as Alty develops. The current version is always at alty.one/privacy, with the date it took effect at the top. Material changes affecting platform users will be notified by email.
Contact us
Alty One (ABN 69 509 502 107)
Email: support@alty.one
If you are not satisfied with our response to a privacy complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.