Privacy Policy

1. Who We Are

Company name: WEB THEMES DEVELOPMENT LLC

Brand name: Alter

Address: Afrosiyob ko'chasi, 4 A-uy, Mirabad district, Tashkent

Contact email: [email protected]

If you have any questions about this Privacy Policy or our handling of your data, please contact us at the email address above.

2. About the Service

Alter is a customer relationship management (CRM) platform that helps service businesses (such as beauty salons) manage incoming customer messages on Instagram, Telegram, and WhatsApp. The Service includes an AI assistant that generates replies on behalf of the business based on a knowledge base configured by the business owner. The Service also stores booking information and conversation history so the business owner can review and manage all customer interactions in one place. In this Privacy Policy we distinguish between two groups of people whose information we may process:

• Business Users — owners and authorized employees of the businesses that subscribe to and use Alter.
• End Customers — individuals who message a business through Instagram, Telegram, or WhatsApp and whose messages are processed by the Service on behalf of that business.

3. Information We Collect

4. Platform Data from Meta

Information we receive from Meta's platforms (including Instagram and Facebook) is referred to in this Policy as Platform Data. We use Platform Data only as permitted by Meta's Platform Terms and Developer Policies. Specifically:

• We use Platform Data only to provide the Service to the Business User who connected their account.
• We do not use Platform Data for advertising, audience building, lookalike audiences, or any marketing purposes.
• We do not use Platform Data to train artificial intelligence or machine learning models.
• We do not sell Platform Data, and we do not share Platform Data with third parties except the limited service providers described in Section 6.
• We do not access, store, or process any Platform Data beyond what is necessary to provide the Service.

5. How We Use Information

We use the information described above to:

1. Provide, maintain, and improve the Service.
2. Receive incoming messages from End Customers on Instagram, Telegram, and WhatsApp and route them into the Business User's dashboard.
3. Generate AI-assisted replies on behalf of the business, based on the knowledge base configured by the Business User.
4. Send replies and other communications back to End Customers through the relevant messaging platform on behalf of the business.
5. Maintain conversation history and booking records so the Business User can review, manage, and follow up on customer interactions.
6. Authenticate Business Users, prevent fraud and abuse, and protect the security and integrity of the Service.
7. Process subscription payments and manage billing.
8. Communicate with Business Users about their account, the Service, and important changes.
9. Measure the effectiveness of our advertising and website traffic (see Section 7).
10. Comply with legal obligations.

We process this information based on the following legal grounds: performance of the contract with the Business User, our legitimate interests in operating and improving the Service, the consent given by the Business User when connecting their messaging accounts, and compliance with applicable law.

6. Sharing Information with Third Parties

We do not sell personal information. To provide the Service, we share information only with the following categories of service providers (sub-processors), and only to the extent necessary. Advertising and analytics services are described separately, in Section 7:

We may also disclose information when required to do so by law, by valid legal process, or to protect the rights, property, or safety of the Service, our Business Users, or others.

We do not transfer Platform Data received from Meta to third parties other than the sub-processors listed above, and only as strictly necessary to provide the Service.

7. Advertising and Analytics

We advertise Alter and measure how our website and app perform. For this we use the services listed below. They receive data about website visitors and Business Users — business owners and staff. Data of businesses’ End Customers, message content and Meta Platform Data are not shared with these services.

The iOS app. We do not ask for tracking permission (App Tracking Transparency) and do not use the device advertising identifier (IDFA). Activity in the iOS app is not linked to your account, and for businesses registered in the iOS app we do not share the phone number, email or IP address with Meta.

Legal basis — our legitimate interest in measuring the effectiveness of our advertising and improving our website and app. The companies listed also process this data under their own privacy policies and may store it outside Uzbekistan (see Section 13).

How to opt out. Block cookies in your browser settings or with an ad blocker. On Android, reset or delete your advertising ID (Settings → Google → Ads). You can manage Meta advertising in the ad settings of your Facebook or Instagram account. To stop us from sharing data about you with Meta from our server, write to us at the address in Section 1.

8. Push notifications & diagnostics

The Alter mobile app can send push notifications about business events (new bookings, tasks, payments). To deliver them we process device identifiers. The Alter client app sends notifications about your bookings: confirmations, reschedules, cancellations and visit reminders.

• Device push tokens — processed via Apple Push Notification service (Apple Inc.) and Firebase Cloud Messaging (Google LLC) solely to deliver notifications.
• Notification preferences — you can switch notification categories off in the app or in the device system settings; the token is deleted on sign-out.
• Crash data — technical crash reports may be collected to keep the app stable (they contain none of your business data).
• This data is never used for advertising and never shared with third parties for marketing.

9. Data Retention

We retain information only as long as needed to provide the Service:

• Business User accounts: for the duration of the active subscription. After cancellation, account data is retained for up to 30 days for backup and recovery, then permanently deleted.
• Messages and conversation history: for the duration of the Business User's active subscription, unless the Business User chooses to delete specific conversations earlier.
• Booking records: for the duration of the active subscription, plus a reasonable archival period for the business's own records.
• Authentication tokens: until the Business User disconnects the relevant messaging account, revokes access on the platform side, or cancels the subscription.

When you or a Business User requests deletion (see Section 11), we delete the relevant data within 30 days, except where we are required by law to retain it longer.

10. Data Security

We use reasonable technical and organizational measures to protect information:

• All data in transit between users, our servers, and third-party services is encrypted using TLS 1.2 or higher.
• Data at rest is stored in encrypted databases.
• Access to production systems is restricted to authorized personnel and protected by strong authentication.
• Access to data is logged for audit purposes.

No method of transmission or storage is 100% secure, but we work continuously to protect your information against unauthorized access, alteration, disclosure, or destruction.

11. Your Rights and Choices

Depending on applicable law, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information, subject to legal retention requirements.
• Object to or restrict certain processing of your information.
• Withdraw consent that you previously gave.
• Disconnect any connected messaging account at any time, which immediately stops Alter from receiving new messages on that account.

Business Users can exercise most of these rights directly from the dashboard (delete account, disconnect Instagram / Telegram / WhatsApp, delete conversations) or by contacting us.

End Customers who wish to know what information about them is stored in Alter, or to request deletion, should contact the business they messaged. Because the messages are sent to that business, the business is the primary controller of that conversation. We will support businesses in fulfilling such requests, and End Customers may also contact us directly at the email address in Section 1; we will respond within 30 days. Clients with their own Alter account can edit their profile data or delete the account entirely themselves, under Profile → Personal data in the cabinet or the mobile app.

12. Children's Privacy

The Service is intended for use by businesses and adults. We do not knowingly collect personal information from children under 13 (or under the minimum age required by applicable law). If you believe a child has provided information to us, please contact us and we will delete it.

13. International Data Transfers

We are based in Uzbekistan, and our service providers may process data in countries outside Uzbekistan (for example, the European Union or the United States). Where data is transferred internationally, we rely on appropriate safeguards offered by the relevant providers, such as standard contractual clauses and the providers' published data processing agreements.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify Business Users by email or through the Service. Continued use of the Service after the updated Policy takes effect means you accept the changes.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your information, please contact us:

WEB THEMES DEVELOPMENT LLC

Afrosiyob ko'chasi, 4 A-uy, Mirabad district, Tashkent

Email: [email protected]

Phone: +998 97 707 55 74

Telegram: @madina_alter