Privacy Policy
Effective September 24, 2026
Altyst is a B2B commercial-real-estate underwriting tool. This Privacy Policy explains what we process, why, how we protect it, and the choices and rights you have. It describes our actual behavior — we do not promise here anything the product does not do. The Service is offered to customers in the United States. Questions: support@altyst.ai.
We do not sell your personal information, and we do not use it for cross-context behavioral advertising. We do not use Your Content to train third-party or foundation AI models.
1. Data we process — at a glance
| Data | Collected? | Purpose | Linked to you | Shared with |
|---|---|---|---|---|
| Email, name | Yes | Sign-in, notifications, org membership | Yes | Auth/email subprocessors only |
| Sign-in credentials | No password is collected — sign-in is your Google or Microsoft account (OpenID Connect); we receive your email, name, and a provider account identifier | Authenticate you | Yes | Your identity provider participates in sign-in |
| Listing links you paste | Yes | Retrieve that public listing page (via our AI subprocessor's fetching service) to propose editable assumptions | Yes | AI subprocessor, per request |
| Organization + role | Yes | Access control, tenant isolation | Yes | No |
| Deals, assumptions, notes you enter | Yes | Provide the underwriting service | Yes | Your organization only, except each deal's property address (next row) |
| A deal's property address and property type | Yes | Research the location (zoning, rules that change the numbers, market context) and show flood-zone and census facts beside the model | Yes | AI subprocessor, automatically when a deal that has an address is opened; the U.S. Census Bureau and FEMA public lookup services, for a U.S. address |
| Documents you upload (OMs, rent rolls, T-12s, etc.) | Yes | Extract figures for your model | Yes | AI extraction subprocessor, per request |
| Derived data (extracted figures, results, exports) | Generated | The output you asked for | Yes | No |
| Operational metadata (request/job IDs, activity log, timestamps, errors) | Yes | Operate, secure, and debug the Service | Yes | Hosting/observability subprocessors |
| Payment details | Not collected by Altyst | — | — | Handled entirely by Stripe (merchant of record); we never see card numbers |
| Raw document contents, extracted text, AI prompts/responses, secrets | Not logged | — | — | No |
| Precise geolocation, biometrics, contacts, advertising IDs | Not collected | — | — | No |
2. How we use data
To provide the Service: authenticate you, store and retrieve your work, extract data from your documents (which may involve our AI subprocessor), research the location of a deal's property, compute deterministic underwriting, generate exports, and operate, secure, support, and improve the platform. Financial outputs are produced by a deterministic engine — AI assists with extraction and narrative only. See the AI Use Disclosure.
3. Legal bases (EEA/UK, where applicable)
Where GDPR/UK GDPR applies, we process personal data to perform our contract with you (providing the Service), for our legitimate interests (securing and improving the Service, preventing abuse), to comply with legal obligations, and with consent where required. For most customer content, your organization is the controller and Altyst is a processor acting on its instructions — see the Data Processing Addendum.
4. Sharing
We share data only with the subprocessors listed in the Subprocessors page, each limited to what its function requires (hosting, object storage, AI extraction and research, payments, email). Your deals and documents are visible only to authorized members of your organization. A deal's U.S. property address is also looked up in public government services (the U.S. Census Bureau and FEMA) to show flood-zone and census facts; they receive the address and nothing else about the deal. We may disclose data if required by law or to protect rights, safety, and the integrity of the Service, and in connection with a merger or asset sale (with notice). We do not sell personal data.
5. Security and tenant isolation
Each organization's data is isolated: access is authorized on every request (deny-by-default), object-storage keys are org-scoped, and PostgreSQL row-level security provides defense in depth. Transport is encrypted (HTTPS/TLS); storage is encrypted at rest; sign-in is delegated to your Google or Microsoft account over OpenID Connect, so we never receive or store your password (accounts created before SSO may retain a legacy credential, stored only as a bcrypt hash); secrets live only in provider-managed configuration, never in the client. No method is perfectly secure, but we work to protect your data and to notify you of material incidents as required by law. Report concerns to support@altyst.ai.
6. Retention and deletion
See the Data Retention Policy. You (or your admin) can delete a document or project at any time; deletion removes the associated records and schedules purge of stored objects. Deleted data may persist briefly in encrypted backups until they age out, and as part of our restore runbook we check the deletion ledger and re-apply completed deletions before returning a restored system to service, so deleted data does not reappear.
7. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. To exercise a right, contact your workspace administrator or email support@altyst.ai; we will verify and respond within the time the applicable law requires. You will not be discriminated against for exercising a right.
California (CCPA/CPRA)
In the last 12 months we collected the categories in Section 1 (identifiers, account and commercial information, internet/network activity metadata, and the content you upload). We use it for the business purposes described above. We do not sell or "share" personal information as those terms are defined by the CPRA, and we do not use sensitive personal information to infer characteristics. California residents may request to know, delete, or correct, and may appeal a decision; submit requests to support@altyst.ai. You may use an authorized agent.
EEA/UK
You may lodge a complaint with your supervisory authority. International transfers rely on appropriate safeguards (for example, Standard Contractual Clauses) where required.
8. Children
The Service is for business use and is not directed to children under 16, and we do not knowingly collect their personal data.
9. Changes and contact
We will post changes here with an updated effective date and notify you of material changes. Contact us at support@altyst.ai.
Altyst — commercial real-estate underwriting software. Effective September 24, 2026. Version 1.6. Questions about this document: support@altyst.ai.