Privacy Policy

This Policy applies to personal information processed in connection with our website, marketing communications, demos and working-session inquiries, customer accounts, and the AltheaOS product. It is designed for U.S. users and reflects requirements under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”) and other applicable U.S. privacy laws.

Controller / business: WylderWomen Inc
1464 E Valley Rd · Santa Barbara, CA 93108 · United States
Privacy contact: privacy@altheaos.org

If you are a customer’s authorized user of AltheaOS, we typically process personal information in that customer’s account as a service provider / processor on the customer’s instructions. In those cases, the customer’s privacy notice and our agreement with that customer also apply. Please contact your organization for questions about account data they control.

Depending on how you interact with us, we may collect:

• Identifiers — name, work email, phone number, organization name, role/title, account credentials, IP address, and similar online identifiers.
• Commercial and customer-relationship information — inquiry and demo requests, subscription or billing-related details we receive to administer an account, support tickets, and communication preferences.
• Internet / network activity — pages viewed, referring/exit pages, device and browser type, approximate location derived from IP, timestamps, and diagnostic or security logs.
• Professional information — nonprofit or employer affiliation and role, to the extent you provide it.
• Content you submit — messages in forms, emails, or product features (for example questions, documents, or notes you upload or enter into the Service).
• Customer content processed in the Service — financial, operational, and related records that a customer connects or uploads (which may include personal information about that organization’s staff, donors, vendors, or other individuals). We process this at the customer’s direction.
• Inferences — limited inferences used for product improvement, security, or support (for example that a visitor is evaluating Althea for a finance-team use case), not for advertising profiling where we do not engage in that practice.

We do not intentionally collect government ID numbers, precise geolocation, biometric identifiers for identification, or consumer health data through our public website. If sensitive personal information appears in customer content, we process it only as needed to provide the Service under our customer agreements and applicable law.

• Directly from you (forms, email, meetings, account setup).
• Automatically from your browser or device when you use our website or Service.
• From the organization that provides you access to AltheaOS (administrators, SSO providers).
• From systems a customer connects to AltheaOS (for example accounting or banking systems), as configured by the customer.
• From service providers who support hosting, analytics, communications, or security, when they provide us information on our behalf.

We use personal information to:

• Provide, operate, secure, and improve the website and Service.
• Respond to inquiries, schedule working sessions, and provide customer support.
• Create and administer accounts, authenticate users, and enforce access controls.
• Process customer content as instructed by the customer to deliver AltheaOS features (including calculations, explanations, and AI-assisted suggestions subject to our product design and agreements).
• Send service, security, and administrative messages.
• Send product or marketing communications where permitted (you may opt out of marketing emails).
• Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our terms.
• Comply with law, respond to lawful requests, and protect rights, safety, and property.
• Create de-identified or aggregated data that does not reasonably identify you, for analytics and product improvement.

AltheaOS may use AI systems to extract, classify, summarize, or draft suggestions from customer content. AI outputs are assistive and are not intended to be the sole basis for legal, accounting, or financial advice. Authoritative financial decisions in the product are designed to require human confirmation where our product model so requires.

We do not sell personal information to train third-party foundation models. Where we use subprocessors for AI functionality, we require contractual protections appropriate to the Service and instruct them not to use customer content to train their general models except as disclosed in our customer agreements or subprocessors list.

We may disclose personal information to:

• Service providers / contractors — hosting, infrastructure, email and communications, analytics, customer support tooling, security monitoring, and similar vendors who process information on our instructions.
• The customer organization — if you are a user of a customer account, administrators and other authorized users of that account may access information associated with the account.
• Professional advisors — lawyers, auditors, and insurers as needed.
• Authorities and counterparties — when required by law, legal process, or to protect rights and safety; and in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality.
• With your direction — for example when you ask us to share information with a partner or integration.

Sale and sharing. We do not sell personal information as “sell” is commonly understood (exchanging it for money). We also do not “sell” or “share” personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. If that practice changes, we will update this Policy and provide required opt-out mechanisms.

We and our service providers may use cookies, local storage, pixels, and similar technologies for essential site operation, security, remembering preferences, analytics, and understanding how our website is used. You can control cookies through your browser settings. Blocking some cookies may affect site functionality.

Where we use analytics tools, they may collect device and usage information. We configure these tools for our legitimate operational purposes and not to sell your personal information.

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, and maintain security backups. Retention periods vary by category (for example inquiry emails may be kept shorter than account audit logs). When no longer needed, we delete or de-identify information, subject to technical limitations of backup systems.

We implement administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, and alteration. No method of transmission or storage is completely secure; we cannot guarantee absolute security. Please use strong credentials and notify us promptly of any suspected unauthorized access to your account.

If you are a California resident, you may have the right to:

• Know / access the categories and specific pieces of personal information we collected about you.
• Know the categories of sources, business or commercial purposes for collection, and categories of third parties to whom we disclose personal information.
• Delete personal information we collected from you, subject to legal exceptions.
• Correct inaccurate personal information we maintain about you.
• Opt out of the sale or sharing of personal information (we do not currently sell or share as defined above).
• Limit the use and disclosure of sensitive personal information, where applicable and where we use sensitive personal information for purposes that trigger this right.
• Not be discriminated against for exercising your CCPA/CPRA rights.

How to exercise rights. Email privacy@altheaos.org with the subject line “California Privacy Request,” or write to us at 1464 E Valley Rd, Santa Barbara, CA 93108, United States. We will verify your request using information reasonably necessary to confirm your identity. You may use an authorized agent; we may require proof of authorization and identity verification. We will respond within the timeframes required by law.

Notice at collection. We collect the categories listed in Section 2 for the purposes in Section 4. We do not use or disclose sensitive personal information for purposes other than those permitted under CPRA regulations for providing services you request, security, short-term transient use, and similar limited purposes, except as otherwise disclosed to a customer under a service agreement for customer content.

Shine the Light. California Civil Code §1798.83 requests may be sent to the same privacy contact. We do not disclose personal information to third parties for their own direct marketing in the manner covered by that statute.

Residents of certain other U.S. states (including, where applicable, Virginia, Colorado, Connecticut, Utah, and others that enact similar laws) may have rights to access, delete, correct, or obtain a portable copy of personal information, and to opt out of targeted advertising, sale of personal information, or certain profiling. We do not sell personal information or engage in targeted advertising as those terms are typically defined in those laws. To exercise available rights, contact privacy@altheaos.org. We will not discriminate against you for exercising privacy rights afforded by law.

The Service and website are directed to businesses and organizations, not to children under 16 (and not to children under 13). We do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us and we will take appropriate steps to delete it.

We are based in the United States. If you access our website or Service from outside the U.S., you understand that your information may be processed in the United States and other countries that may have different data-protection rules. Where required for customer relationships outside the U.S., we will enter into appropriate transfer mechanisms and data processing terms.

We may update this Privacy Policy from time to time. The “Effective date” at the top will change when we post updates. Material changes will be highlighted on this page or communicated by other reasonable means. Continued use of the website or Service after the effective date of an update constitutes acceptance of the revised Policy to the extent permitted by law.

Current effective date: September 30, 2026.

Privacy questions and requests:
WylderWomen Inc
1464 E Valley Rd
Santa Barbara, CA 93108
United States
Email: privacy@altheaos.org

Related terms: our End-User License Agreement.