Privacy Policy

2.1 Personal Information

We collect personal information that you voluntarily provide to us when you register for an account, subscribe to our services, or contact us. This information may include:

• Full name
• Email address
• Company name and business information
• Billing address and payment information (processed securely through Stripe)
• Phone number (optional)
• Profile information and preferences

2.2 Usage Data and API Logs

When you use our API service, we automatically collect certain information about your usage:

• API requests, including URLs scraped, request parameters, and response data
• API key usage and authentication attempts
• Request timestamps, duration, and success/failure rates
• IP addresses and geographic location data
• User agent strings and device information
• Balance and billing metrics
• Error logs and debugging information

2.3 Technical and Device Information

We collect technical information about how you access our Service:

• Browser type, version, and language preferences
• Operating system and device type
• Screen resolution and display settings
• Referring website addresses
• Pages visited and time spent on each page
• Click patterns and navigation paths

2.4 Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to enhance your experience and collect usage data. For detailed information about our use of cookies, please review our Cookie Policy.

2.5 Communication Data

We collect information from your communications with us, including support tickets, email correspondence, feedback forms, and any other information you choose to provide.

2.6 User-Provided Session Data (BYOS)

When you use our Bring Your Own Session (BYOS) authenticated scraping feature, you may provide us with third-party session data to enable scraping of authenticated content. This data may include:

• Session cookies from third-party websites (e.g., authentication tokens, login session identifiers)
• Authentication headers or bearer tokens you provide via the API
• Cookies captured through the AlterLab Chrome Extension cookie capture feature
• Domain associations for stored session data (which websites the cookies belong to)

Important: We treat all user-provided session data as highly sensitive authentication material. You are responsible for ensuring you have the right to use and share the session data you provide. We do not access, read, or use your session cookies for any purpose other than injecting them into your authorized scraping requests.

5.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf:

• Stripe: Payment processing and subscription management
• Cloud Infrastructure Providers: Hosting and data storage services
• Analytics Services: Microsoft Clarity for behavioral analytics, heatmaps, and session recordings
• Email Service Providers: Transactional and marketing email delivery
• Customer Support Tools: Help desk and ticketing systems

These service providers have access to your personal information only to perform specific tasks on our behalf and are obligated not to disclose or use it for any other purpose.

5.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, or government agencies).

5.3 Business Transfers

If we are involved in a merger, acquisition, asset sale, or bankruptcy, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

5.4 Protection of Rights

We may disclose information when we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, violations of our Terms of Service, or to protect our rights, property, or safety, or that of others.

6.1 Right to Access

You have the right to request access to the personal information we hold about you. We will provide you with a copy of your data in a structured, commonly used, and machine-readable format.

6.2 Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal information we hold about you. You can update most information directly through your account settings.

6.3 Right to Deletion

You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, fraud prevention, or legitimate business purposes). You can delete your account at any time through your account settings.

6.4 Right to Data Portability

You have the right to request a copy of your personal information in a portable format that can be transferred to another service provider.

6.5 Right to Opt-Out

You can opt-out of receiving marketing communications from us at any time by clicking the "unsubscribe" link in our emails or by contacting us. You may also opt-out of certain data collection practices, such as analytics cookies, through your browser settings.

6.6 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal information under certain circumstances, such as when you contest the accuracy of the data or object to our processing.

6.7 Right to Object

You have the right to object to our processing of your personal information for direct marketing purposes or when processing is based on legitimate interests.

6.8 Right to Lodge a Complaint

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the right to lodge a complaint with your local data protection supervisory authority if you believe that our processing of your personal data violates applicable data protection laws. You can find a list of EEA supervisory authorities at the European Data Protection Board website. While we encourage you to contact us first to resolve any concerns, this right can be exercised at any time.

8.1 What We Collect and Store

• Stored sessions: When you create a named session via the API or Chrome Extension, we store the encrypted cookie data, the associated domain, a user-defined session name, and metadata (creation date, last used date)
• Inline sessions: When you pass cookies directly in an API request, we process them in memory only — no cookie data is written to disk or persisted after the request completes
• Chrome Extension capture: The AlterLab Chrome Extension reads cookies from your browser for domains you explicitly select and transmits them to our API over an encrypted connection. The extension does not capture cookies without your explicit action

8.2 How We Use BYOS Data

We use your session data solely to inject it into scraping requests you initiate. We do not analyze, profile, or extract information from your session cookies. We do not use your session data to access third-party accounts except as directed by your API requests.

8.3 Retention and Deletion

• Stored sessions: Retained until you explicitly delete them through the API or dashboard, or until your account is deleted. There is no automatic expiration — you maintain full control over the lifecycle of your stored sessions
• Inline sessions: Discarded immediately after the API request completes. No data is retained
• Account deletion: When you delete your account, all stored session data is permanently and irreversibly deleted within 30 days

8.4 Your Rights Over BYOS Data

In addition to the general rights described in Section 6, you have the following specific rights over your BYOS session data:

• View: You can list all stored sessions and their metadata (domain, name, creation date) via the API or dashboard at any time
• Delete: You can delete any individual session or all sessions at any time through the API or dashboard. Deletion is immediate and irreversible
• Export: You may request an export of your stored session metadata (excluding the encrypted cookie values) as part of a data portability request

8.5 Third-Party Responsibility

AlterLab acts as a data processor for BYOS session data that you provide. You are the data controller and are responsible for ensuring that your use of third-party session cookies complies with the terms of service of those third-party websites and all applicable laws. We do not verify the validity, ownership, or authorization of session data you provide.

9.1 What We Collect and Store

• Connector credentials: OAuth tokens, API key references, and account identifiers for third-party services you connect to Workflow Studio. These are stored encrypted and used solely to authenticate on your behalf when a workflow runs.
• Workflow execution outputs: Data extracted, transformed, or relayed during a workflow run, to the extent you configure the workflow to store results. Outputs are stored under your account and accessible only to you.
• Workflow execution logs: Metadata about workflow runs (start time, duration, step status, error messages). Logs do not include the full content of processed data unless a step explicitly outputs it.
• Email tracking data: Where a workflow sends emails on your behalf, open and click events may be recorded. See our Data Processing Agreement, Section 7.2 for the full email tracking disclosure.

9.2 How We Use Workflow Data

We use your workflow data solely to execute the automations you configure and to provide you with run history and debugging information. We do not analyze, profile, or use your workflow execution outputs for any purpose other than delivering the Service.

9.3 Retention and Deletion

• Connector credentials: Retained until you disconnect the integration or delete your account. You can revoke any connector at any time from the Workflow Studio settings.
• Workflow execution outputs: Retained until you delete the workflow, purge its run history, or delete your account. You maintain full control over the lifecycle of stored outputs.
• Execution logs: Retained for 30 days for debugging purposes and automatically purged thereafter.
• Account deletion: When you delete your account, all workflow data — credentials, outputs, and logs — is permanently and irreversibly deleted within 30 days.

9.4 Your Rights Over Workflow Data

In addition to the general rights described in Section 6, you have the following specific rights over your Workflow Studio data:

• View: You can inspect all stored connector connections, workflow outputs, and execution logs from the Workflow Studio dashboard at any time.
• Delete: You can delete any workflow, purge its run history, or disconnect any integration at any time. Deletion is immediate and irreversible.
• Export: You may request an export of your workflow execution outputs as part of a data portability request.

9.5 Data Controller Responsibility

AlterLab acts as a data processor for data flowing through your Workflow Studio automations. You are the data controller and are responsible for ensuring that your use of Workflow Studio — including any Personal Data you process through connected third-party services — complies with applicable data protection laws. You are also responsible for ensuring that recipients of automated emails sent via Workflow Studio have provided the appropriate consents.

10.1 Creator Data

When you register as a creator and publish workflows on the marketplace, we collect and process:

• Payout information: Bank account details, tax identification numbers, and billing address required for revenue disbursement. This information is collected and processed by Stripe Connect on our behalf. AlterLab does not store full bank account numbers.
• Workflow performance metrics: Aggregate data about how your published workflows are used, including execution counts, success rates, error rates, and average run duration. These metrics are used to power your creator dashboard.
• Revenue analytics: Purchase history, revenue totals, payout records, and refund history associated with your creator account.
• Workflow logic and configurations: The workflow definitions you publish are stored encrypted at rest. They are used solely to execute purchases made by buyers and to display your listings in the marketplace. We do not use your workflow configurations for any other purpose.

We may aggregate anonymised workflow performance data across all creators for marketplace ranking, discovery, and quality signals. This aggregated data cannot be used to identify individual creators or buyers.

10.2 Buyer Data

When you purchase and run a workflow from the marketplace, we process:

• Payment information: Payments are processed by Stripe. AlterLab does not store full card numbers or sensitive payment credentials.
• Purchase history: Records of which workflows you have purchased, when, and at what price. This data is retained for accounting and support purposes.
• Workflow run logs: Execution logs generated when you run a purchased workflow, including step status, error messages, and timing metadata. Run logs are retained for 30 days for debugging and support purposes, and are automatically purged thereafter.

Creator access to buyer run logs: Creators cannot access your individual run logs. Creators have access only to aggregated, anonymised performance metrics for their published workflows (e.g., total execution count and aggregate success rate). Your specific inputs, outputs, and run details are never disclosed to the creator.

10.3 Contact Lists (Multi-Party Data)

Some marketplace workflows allow buyers to upload contact lists (for example, to run email sequences or enrichment workflows). The following data handling rules apply:

• Data controller: When you upload a contact list, you (the buyer) are the data controller for the personal data contained in that list. AlterLab processes contact list data solely as a data processor, acting on your instructions to execute the workflow.
• Isolation from creators: Contact list data is not shared with creators. Creators access only aggregated completion metrics (e.g., number of contacts processed). Individual contact records are never exposed to creators.
• Your legal basis obligation: You must have a valid legal basis under applicable data protection law (including GDPR Article 6) for any personal data contained in contact lists you upload. AlterLab does not verify the legal basis for the personal data in your contact lists and relies on you to ensure compliance.
• Retention and deletion: Contact list data is deleted when you delete the list from your account or when you terminate your account. Deletion is permanent and irreversible.

10.4 Creator-to-Buyer Relationships

AlterLab maintains strict data separation between creators and buyers on the platform:

• AlterLab does not share buyer identities with creators. Creators see only aggregate purchase counts, ratings, and anonymised performance metrics — not who purchased their workflows.
• Buyers may optionally choose to share their contact information with a specific creator for support or customisation purposes. This sharing is opt-in and initiated solely by the buyer.
• AlterLab is not a party to any direct data sharing arrangements between creators and buyers that occur outside the platform (for example, via direct email or third-party tools). We cannot be held responsible for data handling by either party outside the AlterLab platform.

10.5 White-Label Storefronts

Creators may deploy white-label storefronts that present purchased workflows under the creator's own branding (see also Section 11 for the full storefront data handling framework). The following data controller distinctions apply:

• AlterLab remains the data processor for the technical infrastructure underpinning the white-label storefront, including workflow execution, payment processing via Stripe, and platform-level logs.
• The creator operating the white-label storefront becomes an additional data controller for their customers' personal data collected through that storefront (name, email, purchase history). The creator is responsible for providing their customers with appropriate privacy notices covering this processing.
• Buyers on white-label storefronts should review the creator's privacy policy in addition to AlterLab's Privacy Policy.

11.1 Data AlterLab Collects on Storefronts

When you interact with a creator's Storefront (including signing up, browsing, or making a purchase), AlterLab may collect the following data on behalf of the creator:

• Account registration data: Name, email address, and any other details you provide when creating a buyer account on a Storefront
• Purchase and transaction data: Payment method details (processed by Stripe — AlterLab does not store full card numbers), purchased products, and transaction history
• Usage data: How you interact with products accessed through the Storefront, including workflow execution history associated with your buyer account
• Technical identifiers: IP address, browser type, and referrer information collected automatically when you access a Storefront

11.2 Data Controller and Processor Roles

For data collected on a creator's Storefront, the creator is the data controller and AlterLab is the data processor, acting solely on the creator's behalf. The creator determines the purposes and means of processing. AlterLab processes Storefront buyer data only to provide the Storefront functionality and does not use that data for its own marketing, profiling, or analytics purposes beyond aggregate, anonymised platform metrics.

11.3 Whose Privacy Policy Governs

Creators are required to make their own privacy policy available to buyers on their Storefronts. If you are a buyer and have questions about how your data is used by a specific creator, you should consult that creator's privacy policy. Where a creator has not published a separate privacy policy, AlterLab's Privacy Policy applies as a fallback baseline for the processing we conduct as operator of the platform. However, AlterLab does not control the creator's independent data practices and cannot represent that the fallback baseline satisfies all applicable legal requirements for the creator's specific use case.

11.4 Cookie Consent on Custom Domains

AlterLab deploys its cookie consent management tooling on Storefronts hosted under alterlab.io subdomains and paths. Where a creator operates a Storefront on a custom domain they control via CNAME, the creator is responsible for deploying appropriate cookie consent mechanisms for that domain. Buyers accessing a custom-domain Storefront should refer to the cookie consent notice displayed on that Storefront.

11.5 Buyer Data Rights

As a buyer, your rights over personal data collected on a Storefront are subject to both AlterLab's processing capabilities and the creator's obligations as data controller. You may:

• Contact AlterLab at legal@alterlab.io to request deletion of your buyer account and associated data from our systems
• Request a copy of your transaction and usage data associated with your buyer account
• Direct substantive data subject rights requests (access, rectification, portability, objection) to the creator, who is the data controller for Storefront data