Privacy Policy
Effective July 26, 2026
Altyst is a B2B commercial-real-estate underwriting tool. This Privacy Policy explains what we process, why, how we protect it, and the choices and rights you have. It describes our actual behavior — we do not promise here anything the product does not do. The Service is offered to customers in the United States. Questions: support@altyst.ai.
We do not sell your personal information, and we do not use it for cross-context behavioral advertising. We do not use Your Content to train third-party or foundation AI models.
1. Data we process — at a glance
| Data | Collected? | Purpose | Linked to you | Shared with |
|---|---|---|---|---|
| Email, name | Yes | Sign-in, notifications, org membership | Yes | Auth/email subprocessors only |
| Password | Stored hashed (bcrypt); plaintext never stored or seen | Authenticate you | Yes | No |
| Organization + role | Yes | Access control, tenant isolation | Yes | No |
| Deals, assumptions, notes you enter | Yes | Provide the underwriting service | Yes | Visible only to your organization |
| Documents you upload (OMs, rent rolls, T-12s, etc.) | Yes | Extract figures for your model | Yes | AI extraction subprocessor, per request |
| Derived data (extracted figures, results, exports) | Generated | The output you asked for | Yes | No |
| Operational metadata (request/job IDs, activity log, timestamps, errors) | Yes | Operate, secure, and debug the Service | Yes | Hosting/observability subprocessors |
| Payment details | Not collected by Altyst | — | — | Handled entirely by Stripe (merchant of record); we never see card numbers |
| Raw document contents, extracted text, AI prompts/responses, secrets | Not logged | — | — | No |
| Precise geolocation, biometrics, contacts, advertising IDs | Not collected | — | — | No |
2. How we use data
To provide the Service: authenticate you, store and retrieve your work, extract data from your documents (which may involve our AI subprocessor), compute deterministic underwriting, generate exports, and operate, secure, support, and improve the platform. Financial outputs are produced by a deterministic engine — AI assists with extraction and narrative only. See the AI Use Disclosure.
3. Legal bases (EEA/UK, where applicable)
Where GDPR/UK GDPR applies, we process personal data to perform our contract with you (providing the Service), for our legitimate interests (securing and improving the Service, preventing abuse), to comply with legal obligations, and with consent where required. For most customer content, your organization is the controller and Altyst is a processor acting on its instructions — see the Data Processing Addendum.
4. Sharing
We share data only with the subprocessors listed in the Subprocessors page, each limited to what its function requires (hosting, object storage, AI extraction, payments, email). Your deals and documents are visible only to authorized members of your organization. We may disclose data if required by law or to protect rights, safety, and the integrity of the Service, and in connection with a merger or asset sale (with notice). We do not sell personal data.
5. Security and tenant isolation
Each organization's data is isolated: access is authorized on every request (deny-by-default), object-storage keys are org-scoped, and PostgreSQL row-level security provides defense in depth. Transport is encrypted (HTTPS/TLS); storage is encrypted at rest; passwords are hashed with bcrypt; secrets live only in provider-managed configuration, never in the client. No method is perfectly secure, but we work to protect your data and to notify you of material incidents as required by law. Report concerns to support@altyst.ai.
6. Retention and deletion
See the Data Retention Policy. You (or your admin) can delete a document or project at any time; deletion removes the associated records and schedules purge of stored objects. Deleted data may persist briefly in encrypted backups until they age out, and as part of our restore runbook we check the deletion ledger and re-apply completed deletions before returning a restored system to service, so deleted data does not reappear.
7. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. To exercise a right, contact your workspace administrator or email support@altyst.ai; we will verify and respond within the time the applicable law requires. You will not be discriminated against for exercising a right.
California (CCPA/CPRA)
In the last 12 months we collected the categories in Section 1 (identifiers, account and commercial information, internet/network activity metadata, and the content you upload). We use it for the business purposes described above. We do not sell or "share" personal information as those terms are defined by the CPRA, and we do not use sensitive personal information to infer characteristics. California residents may request to know, delete, or correct, and may appeal a decision; submit requests to support@altyst.ai. You may use an authorized agent.
EEA/UK
You may lodge a complaint with your supervisory authority. International transfers rely on appropriate safeguards (for example, Standard Contractual Clauses) where required.
8. Children
The Service is for business use and is not directed to children under 16, and we do not knowingly collect their personal data.
9. Changes and contact
We will post changes here with an updated effective date and notify you of material changes. Contact us at support@altyst.ai.
*Altyst — commercial real-estate underwriting software. Effective July 26, 2026. Version 1.3. Questions about this document: support@altyst.ai.*