Privacy Policy

This Privacy Policy explains how SIA “ALTABRIG” processes personal data when you visit altabrig.com, create or use an ALTABRIG Tools account, purchase a plan or paid job, contact us, or use our document, image and transcription modules.

The Service currently includes Compress PDF, PDF Workspace, Create Fillable PDF, Enhance PDF, Anonymize & Redact, Extract Data, Resize Image, Compress Image, Convert Image, Office Metadata, Document Compare, Document to Markdown and Transcribe, together with account, billing, support, security and administration functions.

This Policy also explains cookies and browser storage and contains Data Processing Terms for business customers where ALTABRIG acts as a processor.

The controller for account, website, billing, support, security and Service-management personal data is:

SIA “ALTABRIG” Registration number: 40203471961 Legal address: Robežu iela 27, Aizpute, Dienvidkurzemes novads, LV-3456, Latvia Email: support@altabrig.com

Contact us through /contact for privacy questions or to exercise your rights.

ALTABRIG has not stated that it has appointed a data protection officer. Do not address correspondence to a DPO unless one is formally appointed and this Policy is updated.

ALTABRIG is a controller where we decide why and how personal data is processed, for example account creation, billing, security, support, usage limits and Service improvement.

Where a business customer uploads documents, audio, video or other content containing third-party personal data and determines the purpose of that processing, the business customer is normally the controller and ALTABRIG acts as a processor to provide the requested tool. The Data Processing Terms in section 22 apply unless a separate signed agreement takes precedence.

You must have authority and a lawful basis to upload and process personal data relating to other people and must provide any required notices.

We aim to:

• collect only data reasonably needed for the Service;
• use data for specified, lawful purposes;
• keep information accurate where relevant;
• retain data no longer than necessary;
• restrict access and protect confidentiality;
• provide transparent controls for access, export and deletion;
• avoid using uploaded content for advertising or unrelated model training.

We do not sell personal data.

Depending on how you use the Service, we may process:

5.1 Account and identity data

• name;
• email address;
• account and workspace identifiers;
• authentication provider identifiers;
• role, plan and account status;
• language and preferences;
• policy-version and contract-formation information where available.

5.2 Billing and subscription data

• Stripe customer, checkout, subscription and payment-status identifiers;
• billing address, country, currency and tax information;
• plan, renewal and cancellation information;
• invoices, receipts and transaction records.

Payment-card details are submitted to the payment provider and are not intended to be stored as full card numbers in the ALTABRIG application database.

5.3 Uploaded and generated content

• PDF files;
• DOCX, XLSX and PPTX files and other supported office-document inputs;
• images, audio and video;
• text, form-field definitions and user instructions;
• file names and file metadata;
• document properties, comments, tracked changes and hidden content;
• OCR text, word geometry, confidence data and review regions;
• redaction/anonymization findings, review decisions and sanitized outputs;
• extracted fields, tables, source evidence, user corrections and export files;
• Markdown conversions and conversion warnings;
• resized, compressed or converted image results;
• transcripts, speaker labels, timestamps and corrections;
• summaries, topics, action items, translations and analytics where the selected feature provides them;
• generated PDFs, corrected-text exports, comparison results and cleaned files.

Your content may contain personal data about you or other people.

5.4 Technical, usage and security data

• IP address and approximate network location where needed for security;
• browser, device and operating-system information;
• session, authentication and CSRF data;
• routes, module actions, usage amounts and limits;
• timestamps, request and error identifiers;
• security, fraud and abuse events;
• bounded diagnostics that exclude content where designed to do so.

5.5 Support and correspondence

• email address and contact details;
• messages and support history;
• information you voluntarily provide;
• attachments only where you choose to send them or where we request them through an appropriate method.

Do not send confidential source files through ordinary email unless specifically requested through an approved secure channel.

We process personal data for the following purposes:

6.1 Providing the Service and performing the contract

To create and secure accounts, process files, produce outputs, apply plans and limits, provide subscriptions, deliver downloads, save permitted work, support cancellation and deletion, and respond to service requests.

Legal basis: performance of a contract or steps requested before entering into a contract.

6.2 Billing, tax and accounting

To administer subscriptions, payments, invoices, refunds, cancellation and mandatory financial records.

Legal basis: performance of a contract and compliance with legal obligations.

6.3 Security, fraud prevention and Service integrity

To authenticate users, prevent abuse, enforce limits, investigate incidents, protect users, maintain logs and establish or defend legal claims.

Legal basis: legitimate interests in secure and reliable operation, and legal obligations where applicable.

6.4 Support and communications

To respond to questions, provide notices about the Service or policies, and maintain a reasonable support history.

Legal basis: performance of a contract, legitimate interests and legal obligations. Optional marketing would require a separate lawful basis and is not part of the accepted product described by this Policy.

6.5 Compliance and legal claims

To respond to lawful requests, enforce Terms, protect rights and comply with law.

Legal basis: legal obligation and legitimate interests.

6.6 Consent-based processing

We use consent only where it is genuinely optional and legally appropriate. You may withdraw consent at any time without affecting prior lawful processing.

Acknowledging this Privacy Policy is not consent to all processing.

7.1 Compress PDF

Compress PDF receives PDF files and produces compressed PDFs. Temporary server-side content is used only to perform the requested job. The Service attempts to remove temporary files and generated results when processing finishes, fails or is cancelled, but interrupted content may remain until operational cleanup.

We may retain minimal account, usage, limit, security and error metadata that does not include the document content.

7.2 PDF Workspace

PDF Workspace may store documents and workspace state locally in your browser using technologies such as IndexedDB or local storage. Browser-local documents remain on your device until you clear the workspace where that option is available or clear the relevant browser/site storage.

ALTABRIG cannot remotely erase browser-only data stored on another device that is not connected. If you use a server-side tool from the workspace, that processing follows the retention rule for the relevant module.

7.3 Create Fillable PDF

Create Fillable PDF can normalize supported PDFs, office documents and images into a working PDF, detect candidate form fields and export an interactive PDF. Server-side normalization and field detection use ALTABRIG-controlled components such as PDF/OpenXML processing, local LibreOffice where conversion is needed, Poppler and local Tesseract OCR. The accepted workflow does not require an external OCR or AI provider.

Normalization and OCR detection use isolated temporary working directories that are removed on terminal processing paths. Queued normalization or detection requests and results are also subject to the global queue lifecycle described in section 11. Interactive PDF export is returned with no-store response controls.

7.4 Enhance PDF

Enhance PDF processes PDFs to improve scanned pages, create searchable PDF output, expose OCR review data and, where selected, create corrected-text DOCX, DOC or PDF exports. The accepted engine uses ALTABRIG-controlled Poppler, local Tesseract OCR, Sharp/libvips, PDF-lib and local LibreOffice for supported corrected-text conversions.

The accepted processing report records zero external document uploads, zero external OCR API calls and zero AI-provider calls for this module. Each processing/export operation uses an isolated temporary directory and removes its scratch files on terminal paths. Queued requests and results are subject to the global queue lifecycle described in section 11.

7.5 Anonymize & Redact

Anonymize & Redact accepts supported PDF, JPEG and PNG input and uses ALTABRIG-controlled processing such as qpdf, Poppler, local Tesseract, Sharp, PDF-lib and local barcode decoding to propose and verify redactions. Automatic candidates require review, and final verification re-checks the sanitized output before a download is released. DOCX redaction is not part of the accepted module.

Source bytes and page rasters are written only to isolated service scratch locations for processing and are removed on terminal paths. The accepted logging design does not place raw finding values or document names in product logs, admin telemetry or queue progress. Queued request/result files follow the global queue lifecycle described in section 11.

7.6 Extract Data

Extract Data accepts supported PDF, JPG/JPEG, PNG and DOCX input. It uses ALTABRIG-controlled deterministic parsing, Poppler, local Tesseract OCR, Sharp and bounded OpenXML/ZIP processing to extract reviewable fields, tables and source evidence. The accepted V1 design does not send document content to a cloud AI or external OCR service and does not log document text.

Personal extraction templates contain schema definitions only and are stored in browser storage under an owner-specific namespace; they do not store extracted document values. Server-side batch request/result files follow the global queue lifecycle described in section 11, and per-job temporary parsing directories are removed on terminal paths.

7.7 Resize Image

Resize Image sends the selected supported image through ALTABRIG-controlled server processing using Sharp/libvips. The accepted module design contains no external image-processing provider and no separate persistent store for image content. If the request is executed through the global queue, its request/result files follow the queue lifecycle described in section 11. Operational usage metadata may be retained separately from image content.

7.8 Compress Image

Compress Image uses the same ALTABRIG-controlled image-processing engine to reduce supported image file size while preserving the requested dimensions and format behaviour. The accepted module design contains no external image-processing provider and no separate persistent store for image content. Global queue request/result retention may apply as described in section 11, while operational usage metadata may be retained separately.

7.9 Convert Image

Convert Image uses the ALTABRIG-controlled Sharp/libvips engine to convert supported image formats and apply the selected conversion behaviour. The accepted module design contains no external image-processing provider and no separate persistent store for image content. Global queue request/result retention may apply as described in section 11, while operational usage metadata may be retained separately.

7.10 Office Metadata

Office Metadata processes supported office documents to display or change metadata, comments, tracked changes and hidden content. Server-side inputs and completed outputs may remain until you use an available deletion control or operational cleanup removes them. A period displayed by the module is not a guaranteed automatic-deletion deadline unless the current Service expressly states that it is technically enforced.

7.11 Document Compare

Document Compare processes supported document pairs and generates change data, redlines and comparison outputs. Server-side inputs and completed results may remain until you use an available deletion control or operational cleanup removes them. A period displayed by the module is not a guaranteed automatic-deletion deadline unless the current Service expressly states that it is technically enforced.

Visual-only documents may use a limited fallback where text or coordinates cannot be reliably extracted. The Service does not promise OCR unless a feature expressly states otherwise.

7.12 Document to Markdown

Document to Markdown accepts supported PDF and DOCX input and creates deterministic Markdown with source evidence and explicit layout-loss warnings. It uses ALTABRIG-controlled PDF/OpenXML parsing and local Poppler/Tesseract OCR fallback where needed. It does not use generative AI or cloud OCR for the accepted V1 workflow and does not translate, summarize or improve the source words.

Temporary processing directories are removed on terminal paths. The browser presents the returned Markdown as inert text and creates downloads as private browser blobs rather than public predictable result URLs. Server-side queued request/result files follow the global queue lifecycle described in section 11.

7.13 Transcribe

Transcribe processes audio, video, transcript text and instructions to create transcripts, speaker information, translations, summaries and analytics.

Retention varies with current technical behaviour and the features available to the user. Saved jobs, derived transcripts, analytics and temporary processing chunks may remain until you delete supported content or operational cleanup removes them. A period displayed by the module is not a guaranteed automatic-deletion deadline unless the current Service expressly states that it is technically enforced.

Transcribe may send audio or extracted audio, transcript text, processing instructions and limited technical metadata to OpenAI API services for transcription, diarisation, translation, summarisation and related analysis.

ALTABRIG does not intentionally opt in to using customer content to train OpenAI models. OpenAI states that data submitted through its API is not used to train or improve models by default unless the API customer explicitly opts in.

Provider-side retention depends on the API endpoint, feature and account configuration. Certain API content may be retained for up to 30 days for abuse monitoring, while some audio transcription endpoints may have different or no application-state retention. ALTABRIG does not claim contractual Zero Data Retention unless that setting is separately verified and this Policy is updated.

OpenAI processing may involve international transfers as described in section 12.

AI outputs may be inaccurate. Review them before reliance or publication.

We disclose data only where necessary for the Service, security, payment, support or law. Recipients may include:

• OpenAI for Transcribe processing;
• Stripe for payment, billing and subscription management;
• Supabase for authentication and database services where configured;
• Google if you choose Google sign-in or another Google-connected feature;
• hosting, cloud, database, storage, content-delivery, security and backup providers;
• email or support infrastructure used to communicate with you;
• professional advisers, auditors or authorities where reasonably necessary and lawful;
• a successor in a merger, reorganisation or transfer of the Service, subject to law and appropriate notice.

We do not sell personal data and do not disclose uploaded content for third-party advertising.

Providers process data under their applicable contracts, privacy terms and ALTABRIG instructions where they act as processors.

The accepted Service does not use uploaded document, audio, video or transcript content for advertising.

ALTABRIG does not use Your Content to train its own general-purpose AI model and does not intentionally opt in to third-party API training with Your Content.

If this practice changes, we will update the Policy and obtain any required consent or other lawful basis before the new processing begins.

We retain personal data only as long as reasonably necessary for the purpose, contract and legal obligations.

11.1 Content and outputs

Current module behaviour is described in section 7. Any period displayed in the Service is informational unless the current Service expressly states that it is a technically enforced deletion deadline.

Several server-side document/image workflows use the global job queue. The queue stores access-restricted request and result files for the job lifecycle. After a job reaches a terminal state, those files are removed by the configured terminal-retention cleanup. At the date of this Policy, the queue configuration has a 24-hour default terminal-retention period, but a stricter module control or later production configuration may remove content sooner. The current Service interface and technical controls determine the applicable operational period.

Separate scratch directories used by Create Fillable PDF, Enhance PDF, Anonymize & Redact, Extract Data and Document to Markdown are intended to be removed on terminal processing paths independently of the queue-retention window.

PDF Workspace browser-local content remains on the relevant device until the user clears the workspace or browser/site storage. Image Tools do not use a separate persistent image-content store in the accepted design, although queue request/result retention can still apply to a queued image job.

11.2 Account data

Account data is retained while the account is active. Deleting the core account may disable account access, but it does not currently guarantee deletion from every module store. Before deleting the account, separately delete supported module content that you want removed. ALTABRIG processes valid deletion requests in accordance with applicable law and may retain data required or permitted for legal, accounting, fraud, security or dispute purposes.

11.3 Backups

If backups are used, deleted data may remain in protected backup copies until overwritten under the applicable provider and operational processes. This Policy does not promise a fixed backup-deletion period or claim that a particular backup cycle has been independently verified. Backups are not intended to be restored to ordinary active use after deletion. If a disaster-recovery restore temporarily reintroduces deleted data, a valid deletion request must be addressed again.

11.4 Billing, tax and accounting

Billing and transaction records are retained for the period required by applicable accounting, tax and legal rules.

11.5 Security and diagnostics

Security and audit logs are retained for as long as reasonably necessary for security, fraud prevention, an active incident, a legal claim or a legal duty.

Privacy-safe provider-rejection diagnostics are retained for seven days and are limited to 100 events under the accepted control design.

11.6 Support

Support correspondence is normally retained for up to 24 months after resolution and may be retained longer where reasonably needed for a dispute or legal obligation.

11.7 Usage and contract information

Usage/limit records are normally retained no longer than 12 months after the relevant period unless needed for billing, fraud, security, dispute or law.

Policy-version and contract-formation information, where available, may be retained for the contract duration and the applicable limitation or claims period. The current Service does not create a separate record of each Terms or Privacy response.

ALTABRIG is established in Latvia, but service providers may process personal data in the European Economic Area and other countries.

Where personal data is transferred to a country without an adequacy decision, ALTABRIG uses an applicable lawful transfer mechanism where required, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where appropriate, or another valid legal basis.

We do not promise that all processing occurs only in the EEA.

Contact us for reasonable information about the current transfer mechanism relevant to your data.

13.1 What these technologies do

Cookies and similar storage help authenticate users, protect requests, remember preferences and store browser-local workspace data.

13.2 Strictly necessary cookies

Authentication/session cookies are used to sign you in, maintain the session and apply account permissions. Security and CSRF cookies help prevent unauthorised requests and attacks.

These are necessary to provide the requested Service and cannot be disabled through an optional-consent control without affecting functionality. You may block them in your browser, but protected features may stop working.

13.3 Preferences

The Service may use first-party local storage or similar storage for interface preferences, such as review mode or display choices. These preferences can be cleared through browser controls and, where provided, ALTABRIG settings.

13.4 PDF Workspace local data

PDF Workspace may use IndexedDB and local storage to save documents and workspace state on your device. This data is not a server account record merely because you are signed in. Clear the workspace where that option is available or clear browser/site storage on each relevant device to remove it.

13.5 Analytics and marketing

The accepted Service does not activate advertising or marketing trackers and does not activate an analytics tracker merely because an unused preference control exists.

If optional analytics or marketing technology is introduced later, it will not be set before the required consent, and this section and the relevant controls will be updated.

13.6 Current storage categories

Current first-party storage may include authentication, session and request-security cookies; local storage used for interface preferences; and IndexedDB or local storage used by PDF Workspace. Exact names and duration can vary with the feature and browser. Your browser’s site-data controls show the storage currently present on that device.

We use technical and organisational measures designed to protect personal data, including access controls, authentication, encrypted network connections in production, ownership isolation, restricted privileged credentials, security testing, cleanup controls and incident procedures.

No method of storage or transmission is completely secure. We do not guarantee absolute security or claim a certification that we have not obtained.

You are responsible for protecting your credentials, devices and exported files and for maintaining independent copies of important source material.

You may delete supported content through the relevant module and may request deletion through the available account controls or by contacting support.

Deleting the core account may disable account access, but it does not currently guarantee deletion from every ALTABRIG module store. Before deleting the account, separately delete supported module content that you want removed. Clear the relevant workspace or browser/site storage on every device where PDF Workspace content was saved; server-side account deletion cannot remotely erase browser-only data on another device.

ALTABRIG processes valid deletion requests in accordance with applicable law and may retain information required or permitted for legal, accounting, fraud, security or dispute purposes. Data in backups, where used, may remain until overwritten under the applicable provider and operational processes; no fixed backup-deletion period is promised.

Deletion is generally irreversible. Export needed content first.

Subject to applicable law, you may have the right to:

• receive information about processing;
• access your personal data;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• receive portable data in a structured, commonly used and machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• lodge a complaint with a supervisory authority.

You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where legally permitted with appropriate safeguards.

ALTABRIG does not use Transcribe outputs to make such decisions for you. You must not use the Service as the sole basis for unlawful automated decisions about another person.

To exercise a right, contact support@altabrig.com or use /contact. We may ask for proportionate information to verify your identity. We normally respond within one month, subject to lawful extensions.

You may lodge a complaint with the Latvian Data State Inspectorate or another competent supervisory authority in the country where you live or work or where the alleged infringement occurred.

We encourage you to contact us first so we can try to resolve the issue.

The Service is not directed to children. We do not knowingly provide accounts to persons who lack legal capacity to agree to the Service.

If you believe a child’s personal data has been provided unlawfully, contact us so that we can investigate and take appropriate action.

ALTABRIG may use automated systems to process documents, create transcripts, detect speaker turns, translate text and generate summaries or analytics.

These operations produce user-requested outputs and do not by themselves make legal or similarly significant decisions about individuals.

AI outputs can be wrong or incomplete. Voice/prosody measures are technical indicators and are not reliable determinations of emotion, personality, honesty, health or mental state.

We may update this Policy when the Service, providers, law or processing practices change.

The version and effective date are shown at the top. We will provide appropriate notice of material changes and request acknowledgement or consent where legally required.

Where contract-formation information is available, ALTABRIG may retain it for legitimate legal and compliance purposes. The current Service does not separately record each policy presentation or response merely because this Policy is updated.

SIA “ALTABRIG” Registration number: 40203471961 Robežu iela 27, Aizpute, Dienvidkurzemes novads, LV-3456, Latvia Email: support@altabrig.com Contact page: /contact

22.1 Application

These Data Processing Terms apply where ALTABRIG processes personal data contained in customer content solely on behalf of a business customer that determines the purposes and essential means of processing (“Customer”).

The Customer is the controller and SIA “ALTABRIG” is the processor for that processing. For ALTABRIG’s own account, security, billing and legal purposes, ALTABRIG remains a controller as described above.

A separately signed data-processing agreement takes precedence where it expressly conflicts with these terms.

22.2 Subject matter and duration

The subject matter is the processing necessary to provide the selected ALTABRIG Tools modules, support, security, deletion and related contractual services.

Processing continues for the duration of the Customer’s use and the applicable retention/deletion period, subject to legal retention duties.

22.3 Nature and purpose

Processing may include receiving, hosting, transmitting, organising, extracting, transforming, comparing, compressing, transcribing, translating, analysing, exporting, securing and deleting data according to documented Customer instructions expressed through use of the Service and these Terms.

22.4 Personal-data and data-subject categories

Data may include identity and contact data, document and file content, audio/video, transcripts, metadata, comments, tracked changes, hidden content, professional information and any other personal data the Customer chooses to submit.

Data subjects may include the Customer’s staff, clients, suppliers, counterparties, meeting participants, document authors and other persons whose data is contained in Customer content.

The Customer must not submit special-category, criminal-offence or similarly restricted data unless it has assessed the lawfulness, safeguards and suitability of the Service and provided any required instructions.

22.5 Customer instructions and obligations

ALTABRIG processes Customer personal data only on documented instructions, including the functional instructions submitted through the Service, unless law requires otherwise.

The Customer is responsible for:

• lawfulness, fairness and transparency toward data subjects;
• the legal basis for collection and submission;
• notices, permissions and recording consent where required;
• data minimisation and accuracy;
• responding to data-subject requests unless ALTABRIG assistance is needed;
• not instructing unlawful processing.

ALTABRIG will inform the Customer if, in our reasonable view, an instruction infringes applicable data-protection law, unless prohibited from doing so.

22.6 Confidentiality

Persons authorised by ALTABRIG to process Customer personal data are subject to confidentiality obligations and access restrictions.

22.7 Security

ALTABRIG maintains appropriate technical and organisational measures considering the nature of processing, including access control, authentication, encrypted transport in production, ownership isolation, operational deletion controls, vulnerability/security testing and incident handling.

No security measure eliminates all risk.

22.8 Subprocessors

The Customer gives general authorisation for ALTABRIG to use subprocessors necessary to provide the Service, including the provider categories named in section 9.

ALTABRIG will maintain a current subprocessor record and, where required, provide notice of a material new subprocessor so the Customer can raise a reasonable data-protection objection.

ALTABRIG remains responsible for requiring subprocessors acting as processors to provide materially equivalent data-protection obligations.

22.9 International transfers

International transfers are governed by section 12. Where required, ALTABRIG or the relevant provider uses an adequacy decision, Standard Contractual Clauses or another valid mechanism.

22.10 Assistance

Taking into account the nature of processing and information available, ALTABRIG will provide reasonable assistance with:

• data-subject requests;
• security and personal-data-breach obligations;
• data-protection impact assessments and prior consultation where required;
• information needed to demonstrate compliance.

Assistance that requires material work beyond the standard Service may be subject to reasonable fees where lawful and agreed in advance.

22.11 Personal-data breaches

ALTABRIG will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data and will provide available information reasonably needed for the Customer’s obligations.

Notification does not constitute an admission of fault or liability.

22.12 Return and deletion

During the Service, the Customer may export supported content and delete supported content through available controls.

At termination or account deletion, the Customer should export needed content and separately delete supported module content. Deleting the core account does not currently guarantee deletion from every module store. ALTABRIG will address a valid deletion or return instruction where technically available and in accordance with applicable law. Data may remain in protected backups until overwritten and may be retained where law requires, with access restricted to the retention purpose; no fixed backup-deletion period is promised.

22.13 Audit information

ALTABRIG will make available information reasonably necessary to demonstrate compliance with these Data Processing Terms. Audits must be proportionate, protect other customers and security, avoid unnecessary disruption, and normally begin with documentation or independent reports where available.

The Customer may not access systems, source code or data relating to other users.

22.14 Order of precedence

For processor activity, these Data Processing Terms take precedence over inconsistent general Service wording. A signed data-processing agreement takes precedence over these terms to the extent of an express conflict.

ALTABRIG operates an optional Partner Program for affiliates, creators, agencies and other approved referral partners. This section supplements the Privacy Policy for Partner Program activity and first-party referral attribution. Where this section is more specific about Partner Program data or cookies, this section controls for that activity.

23.1 Data processed for Partner Program activity

Depending on the activity, ALTABRIG may process partner application and profile information, partner type, country, acquisition channels, Partner Program Terms version and acceptance time, partner referral slug, campaign and creative identifiers, payout and tax-review status, masked payout destination, audit events, fraud-review information, and financial commission and payout records.

For a consented referral visit, ALTABRIG may process a random first-party attribution token in hashed form on the server, the approved partner identifier, first-touch and expiry timestamps, the ALTABRIG landing path, limited UTM parameters and the referring host where available. The referral attribution record is not intended to contain uploaded customer document content.

23.2 Purpose and legal bases

ALTABRIG uses Partner Program data to receive and review applications, administer approved partners, attribute eligible customer signups and subscription revenue, calculate and reconcile commissions, manage payouts, prevent self-referrals and other abuse, maintain financial and audit records, and resolve disputes.

Partner application, administration and payout processing are based on steps requested before entering into a Partner Program arrangement, performance of that arrangement, legitimate interests in accurate attribution, fraud prevention and service integrity, and legal obligations for accounting, tax or claims where applicable.

The optional first-party referral attribution cookie is set only after the visitor has enabled Partner referral attribution in the cookie controls. Consent may be withdrawn at any time for future referral tracking.

23.3 First-party referral attribution cookie

When Partner referral attribution is enabled, ALTABRIG may store a first-party attribution cookie for up to 60 days from the eligible first touch. The cookie contains a random token rather than the partner identity or customer content. ALTABRIG stores only a hash of that token in the attribution database together with the limited referral metadata described above.

The first eligible Partner Program touch within the attribution window is preserved before signup. If an eligible signup occurs, attribution ownership is locked to that signup according to the Partner Program rules and is not silently overwritten by a later referral.

If Partner referral attribution is not enabled, ALTABRIG does not create a new referral attribution record or referral click record from the ref parameter. If consent is withdrawn, the application removes the active referral attribution cookie on a subsequent request and does not use it for a later signup lock.

This first-party referral mechanism is not used for cross-site advertising, third-party ad targeting or sale of personal data.

23.4 Retention

An unconsumed referral attribution is limited to its attribution window and associated operational cleanup. A signup attribution that has already been validly locked, and related commission, reversal, payout, fraud and audit records, may be retained longer where reasonably necessary to administer the Partner Program, reconcile payments, comply with accounting or tax duties, prevent fraud, resolve disputes, or establish or defend legal claims.

23.5 Partner communications

ALTABRIG may send operational Partner Program communications such as application receipt or decision notices, approved-partner information, first paid-conversion notices and payout notifications where the delivery infrastructure is enabled. These service communications are distinct from optional promotional marketing. ALTABRIG does not treat Partner Program participation as blanket consent to unrelated marketing.

23.6 Partner dashboard privacy

The partner-facing cabinet is designed to show aggregate referral and commission information needed by the partner without exposing referred customers’ document content or unnecessary customer personal data. ALTABRIG may provide additional information to an authorised administrator where necessary for support, fraud review, accounting, legal compliance or dispute resolution.

23.7 Cookie controls

The current cookie settings distinguish essential storage, optional analytics and optional Partner referral attribution. Choosing “Essential only” disables optional analytics and Partner referral attribution. Choosing “Accept all” enables the optional categories shown by the control. The visitor can reopen cookie settings and change these preferences later.