Privacy Policy

1. Who is responsible (the controller)

Controller: [to be added], sole trader (empresário em nome individual), Portugal
NIF: [to be added]
Address: [to be added]
Email for privacy requests: [to be added]

We have not appointed a Data Protection Officer because we are not required to. We have not appointed an EU representative because we are established in the EU.

2. Summary

You talk to an AI. Your messages and voice are processed by third-party AI providers to produce answers; we tell you which ones below.
Altless keeps a memory of facts about you and summaries of conversations so it can personalise answers. You can see and delete them.
Your voice is sent to a speech-recognition provider to be turned into text. We do not keep your audio.
Payments on the Site are handled by Stripe / Sold through Link, LLC as merchant of record. We never see your full card number.
We do not sell your data, do not show ads and do not use your conversations to train AI models.
You can delete your account at any time; data is erased 30 days later, except the records listed in section 8.

3. What data we collect and why

The table lists each category, where it comes from, why we process it and the legal basis under GDPR Article 6.

Category	Examples	Source	Purpose	Legal basis
Age confirmation	Your year of birth (from the date of birth you enter when you first sign in) and the time you confirmed your age	You	Confirm that you are at least 18; protect children; comply with the usage terms of our AI providers	Legal obligation (Art. 6(1)(c)) and legitimate interest in protecting children and complying with provider terms (Art. 6(1)(f)). Kept for as long as your account exists
Account data	Email address, display name, authentication identifiers (Clerk user ID), account settings, language	You, Clerk	Create and secure your account, sign you in, contact you about the Service	Contract (Art. 6(1)(b))
Steam data (if you sign in with or link Steam)	Steam ID (64-bit), public persona name and avatar, whether your Steam account owns the Altless app (ownership check), purchases you make in Steam	Valve / Steam Web API, at your request	Sign you in with Steam, link your Steam account, deliver Sparks bought in Steam, prevent abuse of limited offers (one Trial Pack per account and one per Steam account)	Contract; legitimate interest in fraud prevention (Art. 6(1)(f)). After you delete your account, your Steam ID is kept only as described in section 8
Conversations	Text you type, transcripts of what you say, Altless's answers, the game you are asking about, timestamps, your feedback on answers	You	Provide the Service (generate answers), show you your history, debug problems	Contract
Voice audio	Your microphone audio while you speak to Altless	You	Convert speech to text. We do not create voiceprints (biometric templates) from your voice and do not use it to identify you	Contract. Voice can reveal more about you than text, so we only capture audio while you actively use voice input (for example, while you hold the push-to-talk key)
Memory	Facts about you that Altless infers or that you tell it (your name, playstyle, preferences, progress in games), summaries of past conversations	Derived from conversations	Personalise answers across sessions	Contract (it is a core feature). You can delete memory items in the App
Game context	Name of the running game, your in-game question context	App, you	Give relevant answers	Contract
Usage and billing records	Sparks balance, reservations and charges per action, plan, purchase history, refund records, order IDs, country for tax	App, Stripe, Steam	Charge Sparks, show you your balance, prevent abuse, accounting and tax	Contract; legal obligation (accounting and tax law, Art. 6(1)(c)); legitimate interest in fraud prevention
Purchase confirmations and withdrawals	The text and time of the consent box you ticked before paying; a journal of the emails we send you about a purchase (the hash of the address, the hash of the email, delivery events reported by our email provider: delivered, bounced, complaint); your withdrawal statement (the name you enter, the purchase, the date and time — the stored text contains no email address) and the refund made after it. We use your account email to send these emails; in these records the address is stored only as a hash	You, App, Site, Stripe, Resend	Confirm the contract and your consent on a durable medium; receive, acknowledge and answer withdrawal statements; calculate the refund	Contract and legal obligation (consumer law on distance contracts and the right of withdrawal, Art. 6(1)(b) and (c))
Addresses that do not accept our emails	The hash of the email address, the reason (spam complaint, the mailbox refused our email, or our email provider would not send to it) and the date	Resend	Not start a purchase whose confirmation we could not send you. The mark is cleared when you contact support	Legitimate interest in being able to confirm every purchase (Art. 6(1)(f))
Purchase block list	Added after a documented abuse of the purchase-confirmation procedure: your account ID, the hash of your email address, your customer ID and card fingerprint from our payment provider (if available; we never receive or store your card number), the reason, the date and who added the entry. If a payment that matches an active entry is made: a record of the stopped payment (payment identifiers, amount, card fingerprint, customer ID)	Us, Stripe	Prevent repeated abuse. The first entry is added by a person; after that, a payment that matches an active entry is stopped automatically — the full amount is refunded at once and the account it came from is added to the list. To contest an entry, write to [to be added]; a person reviews the decision	Legitimate interest in preventing abuse (Art. 6(1)(f))
Technical data	IP address, device and OS information, App version, approximate location derived from IP (country), error logs, request identifiers	Automatically	Security, rate-limiting, fraud prevention, diagnosing errors, tax determination	Legitimate interest (security and reliability); legal obligation (tax)
Support communications	Emails you send us, complaints filed via the complaints book	You	Answer you, handle complaints, legal defence	Contract; legal obligation; legitimate interest
Waitlist / marketing	Email, game and use-case, optional details you provided on the waitlist; newsletter preferences	You	Send invitations and product news	Consent (Art. 6(1)(a)) — withdraw at any time via the unsubscribe link
Website analytics	Aggregated page views, referrer, browser, country	Automatically	Understand how the Site is used	Legitimate interest. We use only cookie-less, privacy-friendly analytics

We do not intentionally collect special-category data (such as health, religion or sexual orientation). If you tell Altless such things, they are processed like any other conversation content and stored in memory only if relevant to personalisation; you can delete them. Please avoid sharing sensitive information with Altless.

4. How AI processing works

To answer you, we send your message, relevant memory items, recent conversation turns and, where needed, search results to one or more AI model providers through their business APIs. Which provider is used depends on the task (for example, a quick factual answer versus a long research answer). The providers currently used are listed in section 6.

Providers process your data on our instructions as our processors, under their API data-processing terms, and do not use API data to train their models under those terms.
Providers may retain API inputs and outputs for a limited period (typically up to 30 days) for abuse monitoring, as their terms describe.
Altless's answers are generated automatically. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Automated checks are used to prevent fraud (for example, one Trial Pack per account and one per Steam account, or stopping a payment that matches an entry of the purchase block list described in section 3) and to enforce usage limits; you can contest any such decision by contacting us.

Answer cache. To save cost and time, generic questions and answers about games (with no personal information) may be stored in a shared cache and served to other users who ask the same question. We remove personal details from cached answers; memory items are never shared between users.

5. Voice

When you use voice, your audio is streamed to a speech-recognition provider (currently Deepgram or OpenAI) and converted to text; the text is then processed as a conversation. Altless's spoken replies are generated by text-to-speech providers (currently Cartesia, ElevenLabs, OpenAI or Deepgram, depending on the voice you choose); they receive the text of the reply, not your audio. We configure these providers not to retain audio beyond processing where their settings allow. We do not build voiceprints and do not use your voice to identify you.

6. Who we share data with (processors and other recipients)

We share personal data only with service providers that process it for us under contracts that meet GDPR Article 28, with the merchant of record for payments, and with authorities when the law requires. We do not sell personal data.

Recipient	Role	What	Location
Clerk, Inc.	Authentication and account management	Email, name, login events, Steam identity link	USA
Stripe, Inc. / Stripe Technology Europe Ltd / Sold through Link, LLC	Payments, merchant of record, tax, refunds, disputes	Payment details (collected directly by Stripe), billing address/country, email, order data	USA / Ireland. For Managed Payments transactions, Link is an independent controller of the payment data it collects; see Stripe's and Link's privacy policies
Resend, Inc.	Sending our emails about purchases (purchase confirmations, acknowledgements of withdrawal statements) and reporting their delivery	Your email address, the text of the email, delivery events (delivered, bounced, complaint)	USA (company); emails are sent from its EU region (Ireland). Transfers: Standard Contractual Clauses (section 7)
Cloudflare, Inc.	Hosting of the backend (Workers, Durable Objects, KV, R2 storage), DDoS protection, web analytics	All Service data in transit and some at rest (sessions, files)	Global edge network; EU and US data centres
Neon, Inc.	Managed PostgreSQL database	Account, conversations, memory, billing records, Steam data	[to be added]
OpenAI, LLC	AI models (answers, embeddings), speech-to-text, text-to-speech	Conversation content, memory items sent as context, voice audio, text of Altless's replies	USA
Anthropic, PBC	AI models	Conversation content, memory items sent as context	USA
Google LLC (Gemini API)	AI models	Conversation content, memory items sent as context	USA
OpenRouter, Inc. (and the model providers it routes to)	AI model gateway	Conversation content	USA; underlying providers vary
Cohere, Inc.	Re-ranking of search results and knowledge snippets	Your question and candidate text snippets	USA / Canada
Deepgram, Inc.	Speech-to-text, text-to-speech	Voice audio, text of Altless's replies	USA
Cartesia AI, Inc.; ElevenLabs, Inc.	Text-to-speech	Text of Altless's replies	USA
Brave Software, Inc.; Tavily, Inc.; Serper	Web search	The search query derived from your question (no account identifiers)	USA
IGDB (Twitch Interactive, Inc. / Amazon)	Game metadata	Game titles you ask about (no account identifiers)	USA
Valve Corporation (Steam)	Sign-in with Steam, Steam Web API, purchases in Steam	Steam ID, ownership checks, Steam orders	USA
Professional advisers, authorities	Accountant, lawyers, tax and consumer authorities, courts	As required by law or to defend our rights	Portugal / EU

Steam data (your Steam ID, persona name, avatar, ownership and order information) is stored in our database in [to be added].

If the business is sold or incorporated, your data may be transferred to the successor under the same protections; we will notify you.

7. International transfers

Most of our providers are in the United States. Where personal data leaves the EU/EEA we rely on:

the EU–US Data Privacy Framework for providers certified under it; and/or
the European Commission's Standard Contractual Clauses (2021/914) included in the providers' data-processing agreements, with supplementary measures such as encryption in transit and at rest.

You can ask us for a copy of the relevant safeguards.

8. How long we keep data

Data	Retention
Account, conversations, memory, Sparks ledger	For as long as your account exists. When you delete your account, the account is deactivated immediately and these data are permanently erased 30 days later, except the records listed below.
Trial Pack record: your Steam ID (the 64-bit number itself) and your Altless account ID, with a reference to the Trial Pack order	Created when an account that has Steam linked is deleted (by you or by us), if a Trial Pack was bought or is being bought with that account or Steam account. It keeps the rule of one Trial Pack per account and one per Steam account. Legal basis: legitimate interest in preventing abuse of the Trial Pack (Art. 6(1)(f)). Kept for as long as this rule applies, including after account deletion.
Voice audio	Not stored by us after transcription. Provider retention as described in section 5.
Shared answer cache (de-personalised)	Until outdated or removed; contains no personal data.
Billing and tax records (orders, invoices, refunds)	10 years after the end of the tax year, as required by Portuguese tax and accounting law, even after account deletion.
Purchase confirmations, the email journal, withdrawal statements and withdrawal refunds	As long as the billing and tax records of the order (above), including after account deletion: when the account is erased, the link to it is removed. The email address in these records is stored only as a hash.
Mark “address does not accept our emails”	Applies until it is cleared, which we do when you contact support. The record of the mark (address hash, reason, dates) is kept as long as the order records; when the account is erased, the link to it is removed.
Purchase block list entry	The hash of the email address, the card fingerprint and the customer ID are kept while the entry is active and erased when it is removed; the reason, the dates and who added and removed the entry remain. If you delete your account, the entry stays: the link to the account is removed, but the email hash, the card fingerprint and the customer ID of an active entry are kept — otherwise signing up again would get around the list. An exception for an account (“this account may buy”) is deleted with the account.
Record of a stopped payment	As long as the billing and tax records of the order, including after account deletion (the link to the account is removed). Removing the block-list entry does not erase it.
Technical logs and IP addresses	Up to 30 days, longer only if needed to investigate a security incident.
Support emails and complaints	3 years after closure (limitation period), longer if a dispute is ongoing.
Waitlist	Until you unsubscribe or ask for deletion.
Backups	Kept by our database provider for a limited period and rotated automatically; erased data disappears from backups when they rotate.

9. Security

We use TLS encryption in transit, encryption at rest with our hosting providers, access controls and audit logging, and we keep the number of people with access to production data to a minimum (currently the founder only). Payment card data never reaches our systems. No system is perfectly secure; if a breach is likely to put your rights at risk we will notify you and the supervisory authority as the law requires.

10. Your rights

Under the GDPR you have the right to:

access your personal data and get a copy;
rectify inaccurate data;
erase your data ("right to be forgotten") — the simplest way is to delete your account in the App; you can also delete individual memory items and remove conversations from your history;
restrict or object to processing based on legitimate interests;
data portability — receive the data you provided in a machine-readable format;
withdraw consent at any time where processing is based on consent (e.g. marketing emails), without affecting prior processing;
not be subject to decisions based solely on automated processing with legal or similarly significant effects;
complain to a supervisory authority. In Portugal this is the CNPD — Comissão Nacional de Proteção de Dados, Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt. You can also complain to the authority of the EU country where you live or work.

To exercise your rights, email [to be added] from the address linked to your account, or use the controls in the App. We answer within one month (extendable by two months for complex requests, in which case we will tell you). We may ask you to verify your identity. Exercising your rights is free unless requests are manifestly unfounded or excessive.

Deleted accounts. After you delete your account, we cannot restore it and will decline sign-in attempts for it. Records we are legally required to keep and the Trial Pack record (section 8) are retained in restricted storage and used only for those purposes.

11. Children

The Service is not directed at children, and users must be at least 18 years old. Portuguese law sets 13 as the age of digital consent, but we do not rely on children's consent and do not accept users under 18. We ask for your date of birth when you first sign in, whether with email or with Steam (see section 3, Age confirmation), and we do not knowingly collect data from anyone under 18.

If we learn that a user is under 18, we block the account and delete the personal data associated with it within [to be added] days, except for records we must keep by law. If you believe a person under 18 is using the Service or has given us personal data, email [to be added] and we will act on it.

United Kingdom. We have assessed whether children are likely to access the Service, with regard to the ICO's Children's Code (Age-Appropriate Design Code). Because the Service is restricted to users aged 18 and over, requires an age confirmation at first sign-in, is not designed or marketed to children and has no free plan, we have assessed that children are not likely to access it. We keep this assessment documented and review it periodically.

12. Cookies and similar technologies

Site: we use only strictly necessary cookies (for example, to keep you signed in through Clerk) and cookie-less analytics. We do not use advertising or cross-site tracking cookies, so no cookie banner is required. If this changes we will ask for consent first.
App: the App stores your sign-in token and settings locally on your device. It does not use third-party tracking SDKs.