Privacy Policy

At a glance

• Controller: Alethe s.r.o., Sládkova 1728/17, 360 01 Karlovy Vary, Czech Republic, IČO 09531025, registered in the Commercial Register kept by the Regional Court in Plzeň, Section C, Insert 39786
• Contact: info@alethe.eu
• Data Protection Officer (DPO): Not appointed — we do not meet the Art. 37 GDPR thresholds (we do not engage in large-scale systematic monitoring or large-scale processing of special-category data). Privacy queries: info@alethe.eu.
• Main purpose of processing: Operate the Alethe AI agent platform (app.alethe.eu) and deliver AI automation services to business clients under contract.
• Supervisory authority for complaints: Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, https://uoou.gov.cz

1. Who we are

Alethe s.r.o. (referred to as "we", "us", "our") operates the Alethe AI agent platform at app.alethe.eu and the public website at alethe.eu. We are the data controller for personal data processed via these properties. Our registered office is Sládkova 1728/17, 360 01 Karlovy Vary, Czech Republic. You can contact us at info@alethe.eu.

This Privacy Policy covers data we process as Controller — visitors to our marketing site, users we contact directly, and the admin / billing accounts our business customers use to log into Alethe. Personal data we process as Processor on behalf of a business customer (their leads, their customers, their members, their employees handled through Alethe) is governed by our Data Processing Agreement (DPA) — see Section 13 below.

2. What data we collect

We do not intentionally collect special-category data (Art. 9 GDPR — health, biometric, political opinion, religion, ethnic origin, etc.). If you submit such data via free-text fields or AI chats, we treat it under heightened security but do not solicit it.

3. Why we process it (purposes + legal basis)

4. How long we keep it (retention)

When the retention period ends we delete or anonymise the data.

5. Who we share it with (recipients + subprocessors)

We share personal data only with:

• Subprocessors acting on our instructions — full list with country of processing on our Subprocessors page
• Authorities when legally required (court order, regulator request) — we will notify you unless legally prohibited
• Analytics (consent-gated): Google LLC — Google Analytics 4 on the marketing site alethe.eu only (United States; DPF + 2021 SCCs; loaded only after you give Analytics consent); PostHog, Inc. — PostHog on alethe.eu and on app.alethe.eu, each site with its own project (EU cloud hosted in Frankfurt, Germany; PostHog, Inc. is a US company: DPF + 2021 SCCs; loaded only after you give Analytics consent). On app.alethe.eu, session recordings mask all text and inputs, hide images and record no network content; PostHog never runs on the booking, form, quote, invoice or client-space pages; and a signed-in user is identified by an internal account number, not by name or e-mail
• Marketing pixel (marketing site alethe.eu only, consent-gated): Meta Platforms Ireland Ltd. and Meta Platforms, Inc. — Meta Pixel, loaded only after you give Marketing consent. For the pixel's collection and transmission of your data on alethe.eu, we and Meta act as joint controllers (CJEU C-40/17 Fashion ID); Meta's privacy policy: https://www.facebook.com/privacy/policy/
• No data brokers under any circumstances; other than the consent-gated Meta Pixel on the marketing site, no advertising networks — app.alethe.eu shares data with no advertising tracker

Top-line subprocessor categories (full list on our Subprocessors page):

• Hosting: Hostinger (Germany, with disk images in Lithuania)
• Encrypted backups: Backblaze (Netherlands); backups are encrypted before upload
• Payments: Stripe Payments Europe Ltd (Ireland) + Stripe Inc. (US, DPF + 2021 SCCs)
• Cloud services, sign-in and email: Google Cloud / Google LLC (EU and US)
• Network transit: Cloudflare
• AI models: OpenRouter (US — 2021 SCCs), which selects the company that runs each model, including for audio transcription; Scaleway (France) for organisations in EU-hosted mode. Google, OpenAI and Anthropic for AI services in Allow outside EU mode
• Image and video generation: OpenRouter, fal.ai (including models fal forwards to a further third-party host) and Higgsfield, whichever is cheapest among the providers your organisation's data mode allows
• Voice generation: ElevenLabs; Fish Audio
• Web search and research: Linkup Technologies SAS (France, processing in the EU) by default; Brave Search for image search; Apify (Czech Republic) for web data extraction
• Error tracking: a self-hosted, Sentry-protocol-compatible endpoint on our own VPS (not a third-party subprocessor)
• Integrations (only if you enable them): Meta (Facebook/Instagram), Shopify, Slack, Google Workspace, and Pexels and Unsplash image search with your organisation's own key

We require a Data Processing Agreement meeting Art. 28(3) GDPR to be in place with a subprocessor before it receives personal data from the platform. Two do not offer one: Higgsfield and Fish Audio. Their terms also allow them to use requests to improve their models. We use them only for organisations in Allow outside EU mode whose administrator acknowledged exactly that in the product, and never for EU-hosted organisations.

News headlines. Alethe keeps a shared collection of headlines from public news feeds, so that each customer can follow the sources they choose. We read only each feed's headline, link, publication time and a short excerpt; never article pages. News can name people. We process these headlines as controller on the basis of our legitimate interest in offering a news overview (Art. 6(1)(f) GDPR). Telling every person named in the news individually would be impossible or take disproportionate effort, so under Art. 14(5)(b) GDPR this paragraph is how we inform them. Excerpts are deleted after 7 days and headlines after 30 days; we build no profiles of people named in the news. To ask us to remove a story, write to feeds@alethe.eu; we answer within 2 working days. Which sources a customer follows is part of that customer's account data and is deleted with the account.

6. International transfers

Where we transfer personal data outside the EEA we rely on:

• Adequacy decisions of the European Commission (currently includes UK, Switzerland, Canada commercial, Japan, Israel, NZ, S. Korea, Uruguay, and others — see the Commission's adequacy-decisions list).
• EU-US Data Privacy Framework (DPF) for transfers to DPF-certified US recipients (verify active status at https://www.dataprivacyframework.gov).
• 2021 Standard Contractual Clauses (SCCs) signed with the recipient otherwise, with parallel SCCs maintained as fallback for DPF-certified recipients pending Schrems III resolution.

For each non-EEA transfer we conduct a Transfer Impact Assessment documenting destination country law and supplementary measures (encryption, EU-held keys where applicable).

AI model providers beneath OpenRouter. Our transfer of AI requests to OpenRouter, Inc. (United States) relies on the 2021 EU Standard Contractual Clauses (Module 2). OpenRouter then passes each request to the model provider it selects. Those providers are OpenRouter's sub-processors, bound through OpenRouter's data processing agreement, under which OpenRouter remains liable for them; we have no contract with them directly. Depending on the model and on your organisation's settings, the provider may be headquartered in the United States, the EU, Israel (which the European Commission recognises as providing adequate protection), Singapore or China (neither of which has an EU adequacy decision). OpenRouter publishes where a provider is headquartered, which is not always where a request is processed.

7. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure ("right to be forgotten") (Art. 17)
• Restriction of processing (Art. 18)
• Portability of data to another controller (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, where consent is the basis (Art. 7(3))
• Not be subject to automated decision-making producing legal effects (Art. 22)

To exercise any right, email info@alethe.eu. We respond within 30 days (extendable by 60 days for complex requests, with notice).

8. Automated decision-making

We do not use automated decision-making producing legal or similarly significant effects on you within the meaning of Art. 22 GDPR. AI agents on the platform produce outputs based on your instructions, but the decision to act on those outputs is taken by you or your authorised users, not by the AI.

If we ever introduce a feature that would constitute Art. 22 decision-making (e.g. automated account suspension based on risk scoring with legal effect), we will update this section and offer a human-review right.

9. Cookies

See our separate Cookie Policy for details on cookies and similar technologies.

10. AI features

This service includes AI-powered features (chat with agents, content generation, classification, recommendations). For full details on what the AI does, your role in interactions with it, how AI-generated content is marked, and our role under the EU AI Act (we are a deployer of third-party models, not a provider), see our separate AI Transparency Notice.

We do not use your conversations or content to train shared AI models. That is our promise about what Alethe does.

It is not a promise we can make for every provider. Where an AI provider offers an API-tier training opt-out we apply it, except on a free model route an organisation owner explicitly enables (below). OpenAI, Anthropic and Google default to opt-out for API customers. The setting Models without zero data retention (below) does not change this: it never permits training. We do not hold a negotiated no-training commitment with every provider — in particular, our media-generation supplier's no-training commitment engages only under an enterprise contract we do not currently hold, and its self-serve terms permit use of anonymised or aggregated derivatives. We will not agree to a provider using your content in identifiable form to train, except Higgsfield and Fish Audio, which we use only for organisations whose administrator acknowledged that their terms allow it (see Section 5). We name the providers on our Subprocessors page.

How we route AI text requests, and the two settings that change it. For AI chat and agent requests (text generation), we ask OpenRouter, our AI routing provider, to use only endpoints that support Zero Data Retention (the model provider does not keep your prompts and responses) and that do not collect data for training. This is the default for every organisation and it stays the default. Two settings, both off unless your organisation switches them on, change it:

• Models without zero data retention. Some models have no endpoint that supports Zero Data Retention, so they are unavailable by default. An owner or administrator of an organisation may switch this setting on, after reading and acknowledging a versioned notice shown in the product. Then: a model that has a Zero Data Retention endpoint is still sent only to such an endpoint; a model without one may be sent only to a model provider that, according to OpenRouter's published provider data policy, does not use inputs for training and keeps prompts and responses for no more than 30 days, or does not keep them; training is never permitted, because every such request still tells OpenRouter to deny data collection for training; and the personal-data masking we apply before a request leaves our systems still applies. The setting cannot be used by an organisation in EU-hosted mode, and it stops having any effect if the organisation switches to EU-hosted mode. It can be switched off at any time with immediate effect for later requests. Switching it off cannot recall data already sent: the provider keeps it under its own terms, for no more than 30 days.
• Free model routes. An organisation owner may instruct us, through a versioned setting and an explicit warning shown in the product, to make free model routes available even when the serving provider does not support Zero Data Retention and may collect data for training or service improvement. This applies only to models explicitly identified as free. Do not send personal, confidential, regulated, client or company-sensitive data through a free route. The instruction is revocable but cannot recall data already sent. This setting has been available since September 2026; this Policy did not describe it until this version.

The providers that can receive requests under either setting are selected by OpenRouter and are OpenRouter's sub-processors, not ours; they are described, with their headquarters and retention, in our Data Processing Agreement, which you can request at info@alethe.eu. Some are headquartered outside the EU/EEA, including in the United States, Israel and Singapore; Section 6 explains the transfer. Requests that build search indexes (embeddings) and re-rank search results are sent to OpenRouter without the Zero Data Retention requirement; this does not depend on either setting.

11. B2B customer data — controller vs processor

Alethe is a two-shape data processor:

• (a) Data we process as Controller: your admin account, your billing, our direct relationship with you. This Privacy Policy governs that data.
• (b) Data we process as Processor on behalf of B2B customers: the leads, contacts, customers, members, or employees that our business customers bring into the platform to work with via AI agents — including personal data your agents acquire via in-platform data-acquisition tools (web scraping, contact lookup). For all of it you are the Controller: you remain responsible for the lawful basis and for informing the people concerned (GDPR Art. 14) — see the Acceptable Use Policy §6A. That processing is governed by our Data Processing Agreement (DPA) — see Section 13.

If you are an end-user (member, customer, lead) whose data was loaded into Alethe by one of our business customers, that customer is the Controller of your data. Contact that organisation first for any GDPR request. We will assist them — and you — but the primary controller relationship is with them.

11a. Meta Platform Data (connected Facebook, Instagram & Threads accounts)

When you connect your Facebook Page, Instagram professional account, Threads profile, or Meta Ads account to Alethe, we receive data from Meta's APIs ("Platform Data") strictly to operate the service for you:

• What we receive: page/profile metadata, the content you publish or schedule through Alethe, comments on your posts and ads, your ad account structure (campaigns, ad sets, ads, audiences), and performance insights.
• Why we process it: solely to provide the features you use — planning and publishing content, creating and managing your ad campaigns, reading your insights, and moderating comments — on your instruction and for your own accounts.
• How it is protected: access tokens are encrypted at rest (AES-256-GCM), scoped to your organisation with row-level isolation, and used only for the assets you connected.
• What we never do: we do not sell Platform Data, do not share it with third parties beyond the subprocessors needed to run the service (Section 5), do not use it for our own advertising, and do not build profiles unrelated to the service you requested.
• Deletion: disconnect the integration in the app, remove the Alethe app in your Facebook settings (this triggers Meta's signed data-deletion callback to us), or email us — full steps in the Data Deletion Instructions. Access tokens are deactivated and cryptographically erased immediately.
• Roles: for Platform Data relating to your connected accounts we act as your processor (Section 11(b)); you remain the controller of your pages, ads and audiences.

12. Marketing site and contact forms

The public marketing site at alethe.eu collects:

• Contact form submissions (name, email, message) — kept until the conversation closes + 12 months
• Newsletter signups (email, consent timestamp) — kept until you unsubscribe
• Google Analytics 4 (Google LLC, United States; DPF + 2021 SCCs) — with your prior Analytics consent only; IP anonymisation enabled; analytics data retained up to 14 months
• PostHog (PostHog, Inc., United States; EU cloud hosted in Frankfurt, Germany; DPF + 2021 SCCs) — with your prior Analytics consent only; page views, clicks, heatmaps and session recordings of this site, with every form field masked; IP address not stored; events retained up to 1 year, session recordings up to 1 month
• Meta Pixel (Meta Platforms Ireland Ltd. and Meta Platforms, Inc.) — with your prior Marketing consent only; cookies _fbp / _fbc (~90 days). For the pixel's data collection on alethe.eu, we and Meta are joint controllers for the collection and transmission stage (CJEU C-40/17 Fashion ID); Meta's own processing is governed by its privacy policy: https://www.facebook.com/privacy/policy/

app.alethe.eu (the platform) sets no marketing trackers. With your prior Analytics consent it uses PostHog (its own project, separate from this site's; same company, hosting and transfer basis as above): page views, clicks, heatmaps and session recordings in which all text and inputs are masked, images are hidden and no network content is recorded. PostHog never runs there on the booking, form, quote, invoice or client-space pages, and a signed-in user is identified by an internal account number, not by name or e-mail. Events are retained up to 1 year and session recordings up to 1 month. One cookie choice covers alethe.eu and app.alethe.eu; you can change it on either site under "Cookie preferences".

You can unsubscribe from any marketing email via the link in the footer or by emailing info@alethe.eu.

13. Business customer DPA

If you are a B2B customer onboarding to Alethe, that processing is governed by our Data Processing Agreement (provided at onboarding; request a copy at info@alethe.eu). It is offered pre-signed.

14. Complaints

You can lodge a complaint with your local supervisory authority. Ours (for the Czech operating entity) is:

• Úřad pro ochranu osobních údajů (ÚOOÚ)
  Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
  https://uoou.gov.cz · posta@uoou.cz

If you live in another EU member state, you can also complain to your local DPA.

15. Changes to this policy

We update this policy when our processing changes. Material changes are notified by email to active account holders at least 30 days before they take effect. The "Last updated" date at the top of this document always reflects the current version.