This Privacy Policy explains how Quantum Era Solutions [Limited] (Altairian, we, us) handles personal data when you visit altairian.io, book a demo, create or use an account at altairian.app, or are contacted through the Service by a business that uses Altairian.
Short version: we use personal data to run the Service and to talk to you about it. We do not sell it, we do not use it to train general AI models, and we do not use advertising trackers.
1. Who is responsible for your data
In short: For your account and our website, we decide how data is used. For the invoices and contacts our customers bring, our customer decides and we act on their instructions.
We are the controller of personal data about our website visitors, people who request demos, account holders and their team members, and billing contacts. Our contact details are in section 13.
We are a processor (service provider) for personal data contained in Customer Data: the invoices, payments, contact details and messages our customers import into Altairian or send through it, including data about people who work at our customers' own clients. Each customer is the controller of that data and decides why and how it is processed. Our Data Processing Addendum governs that processing.
If you were contacted about an invoice through Altairian, the business that sent the message is responsible for it, and you should direct requests about that data to them. If you contact us, we will pass your request to them and help them answer it.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account and profile | Name, work email, company, role, password (stored as a hash by our authentication provider), industry, accounting system | You, at sign-up or invitation |
| Agreement records | Which version of our Terms and Privacy Policy you accepted, and when | You, at sign-up |
| Demo requests | Name, work email, company, phone (optional), number of workers, accounting system, the page you came from | You, via our demo form |
| Billing | Billing contact, plan, subscription status, invoices. Card details are handled by Dodo Payments; we never see full card numbers | You and Dodo Payments |
| Usage and device | Pages and features used, actions taken, IP address, browser, time stamps, error reports | Automatically, when you use the Service |
| Communications | Support emails and messages you send us | You |
| Customer Data (as processor) | Invoices and payments; names, emails and phone numbers of contacts at our customers' clients; message history, replies, notes, consent and opt-out records | Our customers and their connected accounting systems (Xero, QuickBooks) |
We do not intend to collect sensitive categories of data (such as health, biometric or government ID data). Customers must not upload such data to the Service.
3. How we use it, and our legal bases
In short: To provide the Service, keep it secure, bill for it, support you, and improve it.
Where the EU or UK GDPR (or a similar law) applies, we rely on the legal bases shown below.
| Purpose | Legal basis |
|---|---|
| Create and run your account; provide the Service and its integrations | Performance of our contract with you |
| Process Customer Data on our customers' instructions | Our customer's instructions under the DPA (the customer determines its own legal basis) |
| Billing, tax and accounting records | Contract; legal obligation |
| Security, fraud and abuse prevention, rate limiting, error monitoring | Legitimate interests in protecting the Service and its users |
| Respond to demo requests and support messages | Steps at your request before a contract; legitimate interests |
| Service emails (trial reminders, billing notices, security alerts, changes to terms) | Contract; legitimate interests |
| Product announcements and marketing emails to business contacts | Legitimate interests, or consent where required (e.g. under CASL or PECR). You can opt out at any time |
| Improve the Service using aggregated, de-identified statistics | Legitimate interests |
| Comply with law and enforce our terms | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights; you can ask us about that assessment and object (section 9).
4. AI processing
In short: AI helps draft and sort messages. Data goes to our AI provider only to get a result back, and is not used to train models.
Altairian uses large language models, currently provided by Anthropic, to draft collection messages, classify replies, summarise accounts and answer questions in the Service. To do that, relevant parts of Customer Data (for example an invoice, its history and the text of a reply) are sent to the model provider over an encrypted connection.
Under our agreement, the provider processes that data only to return results to us and does not use it to train its models. We do not use Customer Data to train our own general-purpose models either. Customers control whether AI drafts are reviewed by a person before sending.
The Service does not make decisions that produce legal effects about individuals solely by automated means. Messages are sent on behalf of a business, under rules it sets, about an amount owed between businesses.
6. International transfers
Quantum Era Solutions [Limited] is based in Jamaica, and our infrastructure is primarily in the United States. Your data may therefore be processed outside the country where you are.
When we transfer personal data from the EEA, UK or Switzerland to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism, together with supplementary measures such as encryption. Where our providers are certified under the EU-US Data Privacy Framework, we may rely on that. Transfers from Canada, Australia and Jamaica are made with contractual protections that give comparable protection. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
- Account data: for as long as the account is open, then deleted or anonymised within 90 days of closure, except as below.
- Customer Data: for the life of the account; exportable for 30 days after it ends, then deleted within a further 60 days (see our Terms). A paused trial may be deleted 90 days after the trial ends, after notice.
- Billing and tax records: as long as tax and accounting laws require (usually 6–7 years).
- Agreement records, audit and consent logs: for the life of the account and up to 6 years after, to show what was agreed and to defend legal claims.
- Demo requests: up to 24 months after our last contact, unless you become a customer.
- Security logs and error reports: up to 12 months.
- Backups: kept only for recovery and overwritten on our providers' normal backup cycle.
8. Security
We use encryption in transit (TLS) and at rest, encryption of stored accounting-integration tokens, organisation-level data isolation enforced by database row-level security, role-based access with least privilege, audit logging, monitoring and regular backups. No method of transmission or storage is perfectly secure; if a breach affects your personal data we will notify you and regulators as the law requires.
9. Your rights
In short: Depending on where you are, you can access, correct, delete, export or object to use of your data. Ask us and we will respond within the legal time limit.
Subject to conditions in the law that applies to you, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- delete your data;
- restrict or object to processing, including objecting at any time to direct marketing;
- data portability: receive data you gave us in a machine-readable format;
- withdraw consent where we rely on it, without affecting earlier processing;
- not be discriminated against for exercising your rights (California and other US states);
- appeal a decision we make about your request (where US state law provides it);
- complain to a regulator (see below).
To exercise a right, email privacy@altairian.io or use the settings in your account. We will verify your identity proportionately and respond within one month (EU/UK), 45 days (California and other US states) or 30 days (Canada), extending where the law allows. You may use an authorised agent where the law permits; we may ask for proof of their authority.
If your data is Customer Data (for example, you were contacted about an invoice), please contact the business that contacted you; we will forward requests we receive and help them respond. Replying STOP to a text message, or using the opt-out link in an email, stops further messages of that kind from that business through Altairian.
Regulators. You can complain to your local data-protection authority, including: in the EEA, your national supervisory authority; in the UK, the Information Commissioner's Office; in Canada, the Office of the Privacy Commissioner; in Australia, the Office of the Australian Information Commissioner; in Jamaica, the Office of the Information Commissioner; in California, the California Privacy Protection Agency. We would appreciate the chance to address your concern first.
10. Notice for California and other US states
In the last 12 months we collected the categories in section 2: identifiers (name, email, phone, IP address), commercial information (plan and billing history), internet activity (usage data), professional information (company and role), and inferences used only to operate the Service. We collected them from the sources and for the purposes in sections 2 and 3, and disclosed them for business purposes to the categories of providers in section 5. We do not sell or share personal information, do not use or disclose sensitive personal information for purposes that require a right to limit, and have no actual knowledge of collecting data from anyone under 16.
Residents of other states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas and others) have similar rights, which we honour as described in section 9.
12. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
13. Contact and changes
Controller: Quantum Era Solutions [Limited], [registered office address], Jamaica. Privacy questions and requests: privacy@altairian.io. Where the law requires us to appoint a representative in the EU or UK, or a data protection officer, we will list their details here.
We will update this Policy as our practices and the law change. We will post the new version here with a new date, and for material changes we will notify account owners by email or in the Service before they take effect.