Legal

Privacy Policy

Effective October 4, 2026

This policy explains what Altnull collects when you visit altnull.com or altnull.ai (the website) and when your firm uses Altnull's Context OS (the service). The service is operated by [LEGAL ENTITY NAME] ("Altnull", "we" or "us").

1. Website visitors

The website has no accounts, no analytics and no advertising trackers. It does not set cookies of its own.

• Hosting. The site is delivered by Cloudflare, which processes IP addresses and request details to serve pages and to protect the site from abuse. Cloudflare may use limited technical cookies or similar mechanisms for security.
• Fonts. The site loads fonts from Google Fonts, so Google receives your IP address and browser details when a page loads.
• Email. If you write to us, we receive your email address and your message, and we use them to reply and to keep a record of the conversation.

If we add analytics or cookies later, we will update this page first.

2. When your firm uses Altnull

These items apply to people at firms that sign up for the service or a pilot.

Account information

Name, work email address, firm name and role. If your plan is paid, a billing contact and billing details handled by our payment provider.

Connection to your Google account

When you connect Google Workspace, Google gives us OAuth tokens that let the service act within the permissions you approve. We store references to those tokens, never your Google password. We request the minimum permissions the service needs:

• [List the exact Gmail and Drive scopes requested and one plain sentence on what each is used for.]

Content the service reads

With your permission, the service reads email messages and threads for the client accounts your firm has set up, and the context files in the Drive folder you choose. We use that content to match each thread to a client and project, extract facts, and create draft replies in your Gmail drafts.

Context files the service writes

Client dossiers, project portfolios and playbooks are written to your Drive as Markdown. Each stored fact records its source, capture date, confidence and whether a person confirmed it. A person at your firm can read and edit these files, and a person's edit takes priority over a later automatic change.

Usage and operational data

Account IDs, routing identifiers, OAuth token references, counts, durations, token totals and error data. Our application logs exclude message bodies by default. Firm-wide analytics run on this kind of metadata, not on message content.

Draft quality data

To measure whether drafts are useful, we compare the draft we created with the message your team sent in the same thread and calculate quality scores. [Confirm: we keep only the scores and not the message text.] We use this only to evaluate and improve the service for you, and only as set out in your pilot agreement.

3. Google user data

Altnull's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, that means:

• We use Google user data only to provide and improve the user-facing features of the service that you can see, such as grounded draft replies and the context files in your Drive.
• We do not transfer Google user data to others except to provide those features, to comply with the law, or as part of a merger or sale where you are notified.
• We do not use Google user data for advertising, and we do not sell it.
• People at Altnull do not read your Google user data unless you ask us to for support, it is needed for security or abuse investigation, the law requires it, or the data is aggregated and anonymized for internal operations.
• We do not use Google user data to develop, improve or train generalized AI or machine learning models.

4. How we use information

• To run the service: identify the client and project, write facts with provenance, and create drafts.
• To keep the service secure, prevent abuse, and keep an audit log of every read and write to client files.
• To support you, answer questions and send service notices.
• To measure quality and cost using metadata and the scores described above.
• To meet legal obligations and enforce our terms.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

5. AI providers and subprocessors

We use other companies to run the service. Content sent to an AI model provider is limited to what is needed for the task, such as the thread being answered and that client's context. Each provider processes it under business or API terms. Before a pilot starts, we confirm each provider's retention and training terms in writing, and we only use providers whose terms do not allow training on your content. [Confirm per provider before launch.]

We will update this list when it changes and tell customers [30] days before adding a provider that handles content.

6. How long we keep data

Content may also sit briefly in backups or in a provider's own logs as described in their terms. We do not claim that no sensitive data is ever at rest anywhere.

7. Security

• Encryption in transit and at rest.
• Least-privilege access to your Google account and to Altnull systems.
• Client separation: each client's information is stored and retrieved on its own, so one client's details are not used in another client's work, and we test this before releases.
• An audit log of every read and write to client files.

We have not completed a formal certification such as SOC 2. If that changes, we will say so. No system is perfectly secure. If a breach affects your data, we will notify you as the law and your agreement require.

8. Your choices and rights

• Disconnect. You can remove Altnull's access at any time in your Google Account permissions. The service then stops reading your data.
• Delete. Ask us to delete your account and the data we hold. We will do so within [30] days, except where the law requires us to keep something.
• Keep your files. The Markdown context files in your Drive belong to you and remain after you leave.
• Access and correction. You can ask for a copy of personal information we hold about you or ask us to correct it.

Depending on where you live, such as California, the European Economic Area or the United Kingdom, you may have additional rights to access, correct, delete, export or object to processing. Write to us at the address below and we will respond within the time the law allows.

9. Your clients' information

Your firm decides which email and files the service processes. Information about your clients and their staff is personal information we handle on your behalf. For that information we act as your service provider (processor) and use it only to provide the service and as your agreement says. If someone who deals with your firm asks us about their information, we will refer them to you. A data processing addendum is available on request. You are responsible for any notices to your own clients that the law or your contracts require.

10. Children

The website and service are for businesses and are not directed to anyone under 16. We do not knowingly collect personal information from children.

11. Where data is processed

We process data in the United States [confirm hosting region]. If you use the service from another country, your information will be transferred to and processed in the United States.

12. Changes

When we make changes, we will update the date at the top. For material changes, we will email account holders before they take effect. Features that read new kinds of data, such as call transcripts or chat tools, will be added to this policy before they launch.

13. Contact

[LEGAL ENTITY NAME]
[MAILING ADDRESS]
Email: hello@altnull.com