Privacy Policy

Elative Solutions OÜ is committed to protecting your privacy and ensuring the security of your personal information. By using the Sites or Apps, you acknowledge that you have read and accepted this Privacy Policy. If you do not agree, please discontinue use immediately.

1. Who We Are

Elative Solutions OÜ, a company registered in Estonia, acts as the Data Controller for personal data collected through our Sites and Apps. We are committed to compliance with GDPR (General Data Protection Regulation), CCPA (California Consumer Privacy Act), CPRA (California Privacy Rights Act), and PIPEDA (Personal Information Protection and Electronic Documents Act, Canada).

If you have any questions regarding your privacy, you may contact us at:

• Legal Entity: Elative Solutions OÜ
• Email: legal@elative.solutions
• Postal Address: Ahtri tn 12, Kesklinna linnaosa, Harju maakond, 10151 Tallinn, Estonia, EU

2. Mobile Apps Scope

This section describes data handling specific to the Altitude Club mobile experience and the Altitude Pulse mobile app (iOS and Android).

What we collect in the mobile apps

• Account data: email and name when you create an account
• Phone number (optional): used for CRM enrichment and account recovery if you provide it
• Your written content: reflections, notes, and assistant prompt responses you write inside the app are stored privately on your account. We do not train models on, sell, or share these freeform entries. Where you use the Altea assistant, your messages are processed to generate responses to you and are handled as described in section 2A.
• Engagement events: which screens you opened, when, and basic interaction counts. Used to personalise your experience and measure platform health.
• Push notification token: a device-level identifier issued by Apple or Google when you allow notifications. Linked to your account so we can send the right notification to the right device.
• Anonymised session interactions: taps, scrolls, and screen views (see section 6).
• Crash and performance metrics: anonymous diagnostic data (see section 8).

What we do not collect in the mobile apps

• Contacts, calendars, photos, microphone, or location, unless a feature explicitly requests permission and you grant it
• Health, biometric, or sensitive personal data
• Content of sensitive form fields such as passwords or payment details (these are masked in session analytics)

Mobile app data processors

Mobile app data is processed by Supabase (database and authentication), OneSignal (push notifications), Microsoft Clarity (anonymised session analytics), GoHighLevel (CRM enrichment), and, for the Altea assistant, the AI providers listed in section 12. The full subprocessor list is in section 12.

2A. Altea AI Assistant, Business Connections, and Uploaded Data

The Altitude Club service includes Altea, an AI business assistant. To give you advice grounded in your own business, Altea can work with business data you choose to connect or upload. This section explains exactly how that data is handled. Providing this data is always your choice, and you can withdraw it at any time.

a. What Altea processes

• Your conversations with Altea: the messages you send and the assistant's replies. Altea keeps a per-user memory to provide continuity (retention is described in section 13).
• Connected business accounts (Business Connections): if you connect a third-party account of yours, we read a bounded set of business metrics from it to ground Altea's answers. Every connector is read-only and requests the least scope the provider offers; we never request write access. The accounts you can connect today are:
  • Web and search analytics: Google Analytics 4 and Google Search Console (Google analytics.readonly and webmasters.readonly)
  • Advertising: Meta Ads and Google Ads (spend, campaigns, results, cost per result)
  • Your own social presence: your Facebook Page and the Instagram Business account linked to it (your own posts, their engagement, follower counts, and Instagram insights)
  • Visitor behaviour analytics: Microsoft Clarity
  • CRM and pipeline: your white-label CRM, HubSpot, or Pipedrive (contacts, pipeline, calendar, conversations)
  • Email marketing platforms: list growth, opens, and clicks
  • Commerce and payments: Stripe, PayPal, Shopify, WooCommerce, ClickFunnels, and course platforms (orders, revenue, refunds, enrolments)
  • Calendar and booking tools: calls booked, shows, and no-shows
  • Your WordPress site: site health signals such as plugin and update posture and publishing activity
  • Meeting notetakers: bounded summaries only, as described in section 2C
  Further connectors may be offered later under the same read-only, least-scope model, and will be disclosed here when they launch.
• Uploaded files: spreadsheets and documents you upload (xlsx, xls, csv, pdf, doc, docx). Each file is stored privately, parsed into structured business data, and indexed so Altea can retrieve the relevant parts when you ask a question.
• Meeting summaries from your notetaker: if you connect a meeting notetaker account of yours (such as Fireflies, Fathom, or Granola), we read bounded AI-generated summaries of your recorded calls, never full transcripts, as described in section 2C.

Google user data (Limited Use disclosure). Where a Business Connection or sign-in involves Google user data (for example Google Analytics, Google Search Console, Google Drive, or Sign in with Google), our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In short: we use Google user data only to provide and improve the user-facing features of Altea for you, we do not transfer it to third parties except as necessary to provide those features or as required by law, we do not use it for advertising, and we do not allow humans to read it except with your consent, for security purposes, to comply with law, or as part of aggregated and anonymised internal operations.

Meta Platform Data. If you connect a Meta account, we act on your instruction to read only your own business assets through Meta's APIs: your ad account performance (spend, campaigns, results, cost per result), the list of Facebook Pages you manage, your own Page's posts and their engagement, the Instagram Business account linked to your Page, and that account's insights. We do not read your personal Facebook profile beyond the basic public profile Meta returns at authorisation, we do not read other people's content, and we never post, advertise, or make any other change on your behalf through this connection. Meta Platform Data is used only to show you your own performance inside the product and to let Altea answer your own questions about it. We do not sell it, do not use it for advertising, and do not share it with anyone other than the infrastructure and AI sub-processors listed in section 12, which process it solely to provide the service to you. Our use of Meta Platform Data complies with Meta's Platform Terms and Developer Policies. Disconnecting the account in Integrations revokes our access, stops future syncs, and deletes the business data we read from it.

b. How Altea uses your data

Altea works only on your own data, to answer your own questions. Your connected and uploaded business data is isolated to your account at the database level and is never used to answer another user's questions, never pooled with other users' data, and never sold.

c. We do not train AI models on your data

Neither your conversations nor your connected or uploaded business data are used to train our models or any third-party model. We engage AI providers under settings or endpoints that exclude your content from their model training (see section 12).

d. Where your data is processed

To generate a response, the relevant context is sent to AI model providers hosted in the United States (listed in section 12; transfer safeguards in section 15). We do not send your business data to AI endpoints hosted in China.

e. How we protect Business Connections and uploads

• Least scope: connectors request the minimum read-only access needed. We do not request write access to your connected accounts.
• Encrypted tokens: access and refresh tokens are encrypted at rest, are never shown to the assistant, never placed in any AI prompt, and never written to any log the assistant can read.
• Private storage: uploaded files are held in private storage and accessed only through short-lived, owner-scoped links.
• Database-level isolation: your connected and uploaded data is readable only by your account, enforced by database row-level security, not merely by application logic.
• Revocation and deletion: disconnecting a connector revokes our access and stops future syncs. Deleting an upload removes the file and the data derived from it.

f. AI transparency and your rights

You are interacting with an AI assistant. Altea produces suggestions and analysis; it does not make decisions producing legal or similarly significant effects about you without human involvement. Under GDPR Article 22 you may request human review of, and object to, AI-based processing by contacting legal@elative.solutions. Altea may make mistakes, and its output does not constitute professional, financial, legal, medical, tax, or investment advice (see our Terms and Conditions).

2B. How Altea Builds Its Understanding of Your Business (Enrichment)

In addition to the accounts you connect and the files you upload (section 2A), Altea builds a working understanding of your business, called your business brief, from a small set of additional sources. Every source is either provided by you or publicly available, relates to your business (never to other members' businesses), and produces individual facts you can review, correct, or remove at any time (see subsection e).

a. Sources you provide directly

• Your own website. When you give us your business website address, you instruct us to read a bounded number of its public pages to learn what your business offers, who it serves, and which tools it uses. We read your site the way any visitor's browser would; we do not bypass logins or access non-public areas.
• Your sign-in profile. If you sign in with a third-party identity provider (for example Google), we read only the basic profile information that provider shares at sign-in, such as your name, to personalise your account. We do not request additional scopes for this purpose.
• Your public channels linked from your own site. Where your website links to a public channel of yours (for example a YouTube channel), we may read that channel's public statistics, such as subscriber and video counts, the same way any visitor could.
• Your activity inside the service. Your conversations with Altea and your own posts and comments in the community may contribute facts to your brief, as described in section 2A.

b. Public external sources (only where offered and enabled)

To give you an outside-in picture of your business, Altea may additionally read a limited set of public external sources about your business. Where offered, this covers:

• Public reviews of your business (for example your Google Business Profile rating, review count, and short review excerpts);
• Public advertising archives (for example ad copy your business is running, as published in the Meta Ad Library, a public transparency archive);
• Public web search results about your market and competitive position.

These lookups are keyed to your business only, are bounded (short excerpts, small fixed numbers of results), and every resulting fact is marked with its source in your brief. We do not scrape private profiles, do not perform reverse lookups on individuals, and do not use data brokers.

c. Other people's words in public content

Public reviews and public web results are written by third parties and may contain their words and opinions. Where such content enters your brief, we store only short bounded excerpts, privately on your account, solely to advise you about your own business. This content is never pooled across members, never sold, never used to train AI models, and is deleted with your account. If you are an individual whose public review or public content appears in a member's brief and you object, contact legal@elative.solutions and we will remove it.

d. Legal basis

We process the sources above on the basis of legitimate interests (GDPR Article 6(1)(f)): your interest in receiving advice grounded in your real business, and ours in providing that service. We have carried out a balancing test for the public external sources described in subsection b. You may object at any time (section 21) or simply remove any fact as described below.

e. Review and control

Every fact Altea learns is visible on the "What Altea Knows" page in the app, marked with its source. You can confirm, correct, reject, or delete any fact at any time, and rejected facts stay out of your brief. Closing your account deletes your brief and all facts derived from every source above.

2C. Meeting Summaries from Your Notetaker

If you record your business calls with a meeting notetaker service on your own account (at launch: Fireflies, Fathom, or Granola), you can connect it so Altea learns how you actually talk to clients and what you commit to on calls. This connection is always your choice, and this section explains exactly what is and is not read.

a. Summaries only, never transcripts

We read the AI-generated summary of each meeting (a short overview and top action items, each limited in length) together with basic details: the meeting title, date, duration, and the number of attendees. We never request sentence-level transcripts from your notetaker, so the word-for-word speech of your calls never enters our systems. We store attendee counts, not attendee names.

b. Bounded and continuously replaced

We read at most your 25 most recent meetings within the last 30 days. Each refresh replaces the previous snapshot rather than adding to it, so meeting content never accumulates. Disconnecting the notetaker deletes the derived data, and closing your account deletes it entirely.

c. Other people on your calls

Meeting summaries describe conversations, so they can include contributions from the other people on your calls, in summarised form. This content is visible only inside your own account, is never pooled across members, never sold, and never used to train AI models. Keeping the people on your calls informed that calls are recorded remains your responsibility under the laws that apply to you (see our Terms, section 10E). If you are an individual whose words appear in a member's meeting summaries and you object, contact legal@elative.solutions and we will remove the affected data.

d. Your credential

You connect by pasting a key created in your own notetaker account. It is encrypted at rest, never shown to the AI assistant, never placed in any prompt or log, and used only for read access to your own meetings. You can revoke it at your notetaker provider or disconnect in the app at any time.

e. Legal basis

For you, this processing is part of the contracted service you switch on by connecting the account. For the other participants on your calls, we rely on legitimate interests (GDPR Article 6(1)(f)), with the summaries-only design, the length and meeting caps, and the objection route above as safeguards. Your notetaker provider processes your recordings under your own agreement with them, not ours.

3. Data Collection and Processing

We collect personal data including but not limited to contact information, customer transaction details, user data, technical data, and marketing preferences. We gather this data through direct interactions (such as when you sign up, purchase, or contact support), automated tracking (cookies and analytics), third-party service integrations, and publicly available sources.

Under GDPR, we process data based on contractual necessity, legitimate interest, consent, and legal obligations. Personal data means any information capable of identifying an individual. It does not include anonymised data.

We may process the following categories of personal data:

Communication Data

Any communication you send to us through contact forms, email, text, social media messaging, or any other channel. We process this data to respond to enquiries, maintain records, and comply with legal obligations.

User Content

Reflections, journal notes, assistant prompt responses, and other freeform content you write inside the Altitude Club service, Altea, or the Altitude Pulse app. Stored on your account. Not used for model training, not sold, and not shared. Your freeform reflections are not analysed by humans except where you explicitly request support involving that content. Business data you choose to connect or upload for the Altea assistant is analysed by the assistant on your behalf, to answer your questions, as described in section 2A.

Connected and Uploaded Business Data

Business metrics from accounts you connect (analytics, advertising, your own social accounts, CRM, commerce, payments, booking, and website health, listed in section 2A), bounded meeting summaries from a notetaker you connect (section 2C), and the contents of files you upload for analysis. Processed solely to provide the Altea assistant to you, as described in sections 2A and 2C. Retained until you disconnect, delete, or close your account (see section 13).

Customer Data

Details related to purchases including your name, billing address, delivery address, email address, phone number, and payment details. We process this to supply the goods and services you have purchased and to maintain transaction records.

User Data

Data about how you use our Sites and Apps including interactions with content, session history, and engagement levels. We process this to improve user experience and platform functionality.

Business Infrastructure Data

Where members use our platforms to manage their own coaching or consulting business, we may process data relating to their client contact records, funnel configurations, CRM settings, and automation sequences stored within the platform. This data is processed solely to provide the contracted service. Members retain full ownership of their own client data at all times.

Technical Data

IP addresses, login data, browser details, session lengths, device information, and analytics tracking. This helps us optimise our Sites and Apps and detect security threats.

Marketing Data

Preferences regarding marketing communications, promotions, and advertising.

Phone Numbers and AI Communications

If you provide your phone number, we may use it to send SMS messages, WhatsApp messages, or AI-generated outbound communications based on your stated preferences.

We do not collect sensitive personal data including race, ethnicity, religious beliefs, biometric data, or criminal records, and you must not upload such data to the Altea assistant (see our Terms and Conditions).

4. How We Collect Your Personal Data

We collect data in the following ways:

• Direct interactions: account registration, purchases, newsletter sign-ups, mobile app onboarding, connecting a business account, uploading a file, or contacting customer support
• Automated tracking: cookies, tracking pixels, analytics tools, and mobile SDKs when you interact with our Sites or Apps
• Third-party sources: if you connect third-party platforms such as Google, Facebook, or other Business Connections, we may receive relevant user and business data at the scope you authorise
• Publicly available sources: such as business directories or professional records

5. Use of Cookies and Tracking Technologies

Our Sites use cookies and other tracking technologies to enhance functionality, improve user experience, and support marketing and analytics. When you first visit, a cookie consent banner allows you to accept or reject non-essential cookies. You can also manage cookie preferences through your browser settings. For the full detail, see our Cookie Policy.

a. What Are Cookies

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences, enhance your browsing experience, and improve functionality. Cookies may be first-party (set by our Sites) or third-party (set by advertising or analytics providers).

b. Types of Cookies We Use

• Essential Cookies: necessary for the operation of the Sites, enabling basic functions like page navigation, secure logins, and fraud prevention
• Performance Cookies: collect information about how visitors use our Sites to optimise performance and improve user experience
• Functional Cookies: allow our Sites to remember choices you make, such as language preferences or login details
• Marketing and Advertising Cookies: track your online activity to deliver targeted advertisements relevant to your interests

c. Third-Party Cookies

Some cookies on our Sites are placed by third-party service providers including Google Analytics, Facebook Pixel, and payment providers. These third parties may use cookies in accordance with their own privacy policies, which we recommend reviewing.

d. Managing Cookies

You may adjust your browser settings to block or delete cookies, opt out of third-party tracking through https://optout.aboutads.info, or use our cookie consent banner to manage non-essential cookie preferences. If you disable certain cookies, some parts of our Sites may not function correctly.

6. Session Analytics (Microsoft Clarity)

We use Microsoft Clarity to understand how people move through our websites and apps. Clarity records interaction signals such as taps, clicks, scrolls, screen views, and page paths, and turns them into session replays and heatmaps that show us where a flow is confusing or an interface element is broken.

A session replay reconstructs what happened on screen, so depending on the masking level we apply it may also show text that was displayed on the page or typed into ordinary form fields. Sensitive fields such as passwords and payment details are always masked and are never captured. We do not use Clarity to identify you by name, email, or any other direct identifier, we do not use it to build an advertising profile of you, and we do not sell what it collects.

Clarity runs only after you accept non-essential (performance) cookies through our consent banner, and you can withdraw that consent at any time (see section 5 and our Cookie Policy).

For more information, see the Microsoft Privacy Statement.

7. Push Notifications (OneSignal)

We use OneSignal to deliver push notifications to the Altitude Club and Altitude Pulse mobile apps. When you allow notifications, OneSignal stores a device-level push token issued by Apple Push Notification service or Firebase Cloud Messaging. That token is linked to your account so we can deliver the right notification to the right device, and is removed when you uninstall the app or revoke notification permission in your device settings.

Push tokens are treated as personal identifiers under GDPR and Apple App Privacy guidance. For more information, see the OneSignal Privacy Policy.

8. Crash and Performance Data

Anonymous crash logs and app performance metrics are collected by iOS and Android system services to help us diagnose stability issues and prioritise performance work. This data includes information such as the type of device, operating system version, app version, and the technical context of a crash.

This crash and performance data is not linked to your identity and is treated as Diagnostic Data under Apple App Privacy disclosures.

9. Marketing Communications and Consent

We only send marketing communications with your explicit consent. We use double opt-in for email subscriptions. You may opt out at any time by clicking the unsubscribe link in any email or contacting us at legal@elative.solutions.

SMS Opt-In: by opting in, you agree to receive text messages from us. You may unsubscribe at any time by replying STOP. Opting out of marketing communications will not affect essential service-related communications.

10. Third-Party Advertising and Marketing

We use third-party advertising services including Meta (Facebook and Instagram Ads) and Google Ads to promote our products and services. These platforms may collect and process user data through technologies such as Facebook Pixel and Google Analytics.

If you prefer not to receive personalised advertising, you may opt out through:

• Google Ads Settings: https://adssettings.google.com
• Facebook Ad Preferences: https://www.facebook.com/settings/?tab=ads
• Your Online Choices (EU users): https://www.youronlinechoices.com
• Network Advertising Initiative Opt-Out: https://optout.networkadvertising.org

For California Residents: submit a CCPA Opt-Out Request to legal@elative.solutions with your full name and account email. We will process your request within 30 days.

11. GoHighLevel CRM · Third-Party Infrastructure

Elative Solutions OÜ uses GoHighLevel as the underlying CRM and technical infrastructure for CoachSuite Pro and Altitude Club. GoHighLevel is a third-party software-as-a-service platform that processes certain member and contact data on our behalf as a data processor.

Data processed within GoHighLevel infrastructure may include contact records, CRM entries, automation sequences, funnel configurations, email communications, and SMS messages. GoHighLevel operates servers in the United States. Data transfers from the EU to GoHighLevel are governed by Standard Contractual Clauses (SCCs) in compliance with GDPR and Schrems II requirements.

Members who store their own client data within the platform remain the data controller for that client data. Elative Solutions OÜ processes that data solely as a data processor acting on the member's instruction. Members are responsible for ensuring they have obtained appropriate consent from their own clients before uploading or storing client data within the platform.

12. Subprocessors

We engage the following third-party service providers (subprocessors) to operate our Sites and Apps. Each subprocessor is bound by a Data Processing Agreement and processes data solely on our documented instructions.

Infrastructure, analytics, and communications

• Supabase · authentication, database, and file storage for the Altitude Club, Altitude Pulse, and admin platforms · primary region European Union
• OneSignal · push notification delivery for mobile apps · United States
• Microsoft Clarity · session analytics, session replays, and heatmaps · United States and European Union
• PostHog · product analytics for the web app · European Union (EU cloud)
• Sentry · error and performance monitoring for the web app and admin dashboard · United States
• GoHighLevel · CRM, marketing automation, and Altitude Club mobile app host · United States
• Vercel · web hosting for the Altitude Club web app, Altitude Pulse, and admin dashboards · United States
• Apple · App Store distribution, push notification service, and crash reporting for iOS · United States
• Google · Play Store distribution, Firebase Cloud Messaging, crash reporting for Android, sign-in, the Google Analytics, Google Search Console, and Google Ads Business Connections, and public business lookups for the enrichment feature described in section 2B (Google Places and YouTube Data APIs) · United States
• Stripe · payment processing for web checkout · United States
• Google Analytics · website analytics · United States
• Meta Platforms · the Meta Ads, Facebook Page, and Instagram Business Connections you choose to authorise (section 2A), advertising analytics (Facebook Pixel), WhatsApp messaging, and public Ad Library lookups for the enrichment feature described in section 2B · United States
• Exa Labs · public web search API used, where the enrichment feature described in section 2B is enabled, to gather public market signal about a member's business · United States

AI model and retrieval providers (Altea assistant)

The following providers process your conversation context and, where you have connected or uploaded business data, the relevant retrieved business data, solely to generate Altea's responses to you and to index your data for retrieval. Each is engaged under terms that exclude your content from model training. None is hosted in China.

• Anthropic (Claude) · primary AI generation · United States
• OpenAI · fallback AI generation and text embeddings (data indexing) · United States
• US-hosted inference provider (for example Fireworks AI or Together AI, serving open models such as DeepSeek or Kimi) · cost and redundancy tier · United States

Where data is transferred outside the European Economic Area, transfers are governed by the EU-US Data Privacy Framework where the provider is certified, or by Standard Contractual Clauses with supplementary safeguards.

12A. Internal Quality and Safety Monitoring

To keep the service safe, accurate, and improving, we operate an internal monitoring layer that reviews interactions with the Altea assistant for response quality, safety, and product improvement.

• Inside our own infrastructure. This monitoring runs within our own systems. Your data is not sent to an outside party for this purpose.
• Legal basis. Legitimate interests (GDPR Article 6(1)(f)). We have carried out a balancing test; this monitoring is necessary to operate a safe and reliable AI service and is limited to what is needed for that purpose.
• Minimisation and access control. Access is limited to a minimised and, where appropriate, redacted view of interaction data, under a narrowly scoped role, and is itself audit-logged. Connector access tokens are never exposed to this layer.
• Your rights. You can object to processing based on legitimate interests by contacting legal@elative.solutions (see section 21).

This monitoring is not shown in the product interface, but it is fully disclosed here. We do not conceal it.

13. Data Security and Retention

We implement industry-standard security measures including database row-level security so each user can only access their own data, encryption of sensitive data and access tokens at rest, restriction of AI processing to US-hosted endpoints under no-training terms, controlled access, audit logging of administrative access, and routine security review. We retain personal data for the following periods:

• Account and Transaction Data: 6 years for tax and legal compliance
• Marketing Data: retained until you unsubscribe or withdraw consent
• Analytics and Behavioural Data: 12 months unless removed earlier
• Altea assistant memory: for free trial users, retained for one year; for Altitude Club members, retained for the duration of membership. You can request deletion at any time.
• Connected and uploaded business data: retained until you disconnect the connector, delete the upload, or close your account, after which it is deleted within a reasonable period subject to legal retention duties
• Business brief and enrichment facts (including public-source excerpts, section 2B): retained until you reject or delete the fact in the app or close your account, whichever comes first
• Meeting summaries from a connected notetaker (section 2C): replaced on each refresh (never accumulated), deleted when you disconnect the notetaker or close your account
• Inactive Accounts: deleted after 2 years of inactivity unless required for legal reasons
• Support and Enquiry Data: 12 months after last contact
• Security Logs: 6 months for security monitoring
• AI and safety-monitoring Logs: 6 months unless required for security or fraud prevention
• Email Logs: up to 2 years for legal compliance

14. Account Deletion

You can also request deletion of any account or data record by emailing legal@elative.solutions at any time.

15. International Data Transfers

We are based in the European Union and host primary infrastructure in the EU. We operate globally and your data may be transferred outside the European Economic Area (EEA) to countries including the United States, Canada, Australia, and the United Kingdom, including to the AI model providers listed in section 12. We ensure data protection through the EU-US Data Privacy Framework where the provider is certified, and otherwise through Standard Contractual Clauses (SCCs) under GDPR, with additional safeguards such as encryption, pseudonymisation, and access controls. We have Data Processing Agreements in place with key third-party service providers.

16. CCPA Notice for California Residents

California residents have the following rights under CCPA and CPRA:

• The right to know what personal data is collected
• The right to request deletion of collected personal data
• The right to opt out of data selling or sharing

We do not sell personal data. However, third-party analytics and advertising services may collect data as defined under CCPA. To exercise your rights, email legal@elative.solutions with the subject line CCPA Opt-Out Request. We will process your request within 30 days.

17. PIPEDA Notice for Canadian Residents

Under PIPEDA, Canadian residents have the following rights:

• The right to request access to their personal data
• The right to challenge the accuracy of collected information
• The right to file a complaint with the Office of the Privacy Commissioner of Canada

To exercise your rights under PIPEDA, contact us at legal@elative.solutions.

18. SMS, WhatsApp, and AI-Generated Communications

We may use SMS, WhatsApp, and AI-generated outbound messages to provide service notifications, reminders, marketing promotions, and platform updates. By providing your phone number and opting in, you expressly consent to receive such messages. You may opt out at any time by replying STOP, updating your account preferences, or contacting legal@elative.solutions.

WhatsApp messages may be processed by Meta Platforms, Inc. Data transfers are governed by Standard Contractual Clauses under GDPR. We do not sell or share your WhatsApp number with third-party advertisers. Compliance framework: GDPR (EU and UK), CCPA (California), TCPA (United States), CASL (Canada).

19. Use of AI and Automated Processing

We use Artificial Intelligence and automated technologies to provide and enhance our services, including:

• The Altea AI assistant, which answers your questions and, where you choose to connect or upload business data, grounds its answers in your own business data, as described in section 2A. Your individual data is isolated to your account and is not shared with or used to answer other members.
• AI-powered tools for customer support, enquiry handling, and service recommendations
• Automated SMS, email, and WhatsApp responses based on user queries
• Internal quality and safety monitoring of assistant interactions, as described in section 12A
• Personalisation and automated content recommendations based on platform activity

We do not use your conversations or your connected or uploaded business data to train AI models. AI does not make decisions with significant legal or financial consequences without human involvement. AI output may contain errors and does not constitute professional, financial, legal, medical, tax, or investment advice. Under GDPR Article 22 and CCPA/CPRA, you have the right to be informed about AI-driven processing, to request human intervention, and to object to AI-based profiling. To exercise these rights, contact legal@elative.solutions.

20. Children's Privacy

The Altitude Club service is intended for business owners aged 18 and over and is not directed at children. The Altitude Pulse mobile app is not directed at children under 13 (or under 16 in jurisdictions where the higher age applies under GDPR). We do not knowingly collect personal data from children under these ages.

If you are a parent or guardian and you believe a child has provided us with personal data, please contact legal@elative.solutions and we will delete the relevant account and associated data without undue delay.

21. Your Legal Rights

Under global data protection laws, you have the right to:

• Access your personal data
• Correct or update inaccurate data
• Request deletion of personal data
• Restrict or object to certain types of data processing, including processing based on legitimate interests (section 12A) and AI-based processing (section 19)
• Request data portability
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at legal@elative.solutions. We will respond to all legitimate requests within one month. There is no fee to exercise your rights unless a request is clearly unfounded, repetitive, or excessive. We may need to verify your identity before processing certain requests.

Right to lodge a complaint. Under GDPR Article 77, you have the right to lodge a complaint with your local data protection authority. In Estonia, the supervisory authority is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), https://www.aki.ee/en. EU residents can also use the European Data Protection Board portal at https://edpb.europa.eu.

22. Third-Party Links

Our Sites and Apps may contain links to third-party websites, plug-ins, or applications. These third parties may collect personal data independently. We are not responsible for their data handling practices and encourage you to read their respective privacy policies.

23. Third-Party Data Sharing

We share personal data with trusted third-party service providers for payment processing, analytics, push notifications, AI generation, and marketing. The full subprocessor list is in section 12. We have Data Processing Agreements with these providers to ensure compliance with GDPR, CCPA, and PIPEDA. We do not sell personal data to third parties for advertising purposes.

24. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Updates will be reflected in the Effective Date at the top of this document. Continued use of our Sites or Apps after such modifications constitutes acceptance of the revised terms. We will make reasonable efforts to notify users of material changes via email or a notice on the relevant Site or App.