AlatusaAlatusaLogin

Privacy Policy

Last updated: August 16, 2026

Alatusa is a product of Lein AI Systems (“we”, “us”). This Privacy Policy explains how we process personal data for visitors of alatusa.com, people who sign up for a workspace, and end customers whose conversations flow through Alatusa when a customer organization connects messaging channels.

We process personal data in line with the EU General Data Protection Regulation (GDPR / Dutch AVG) and other applicable privacy laws.

1. Who we are (roles)

  • Controller: for account, billing, marketing-site, and lead data about you as a business customer or visitor (for example email, company name, payment metadata via Stripe, IP and security logs, Google Sign-In profile fields).
  • Processor: for Customer Content in the inbox (end-customer names, phone numbers, message bodies and media) that your organization (the controller) submits or receives through connected Meta channels. Our Data Processing Agreement applies to that processing.

2. AI assistance (“wingman”)

Where AI features are enabled for a workspace (for example on trial or higher tiers), they act as a professional wingman: they may suggest or prepare content. They do not replace human judgment. Your team remains responsible for what is sent to customers. Autonomous outbound sending without a human in the loop is not how Alatusa is designed.

3. Categories of personal data

Depending on how you use Alatusa, we may process:

  • Account and workspace data: names, emails, roles, company profile, and settings for people who log into Alatusa.
  • Billing data: subscription status and Stripe customer/invoice identifiers. Card details are handled by Stripe; we do not store full card numbers.
  • Lead and signup data: information you submit on activate-account / lead forms (including country and requested channels).
  • Technical and security data: IP address, device/browser metadata, authentication events, and operational logs needed to secure and run the service.
  • Messaging metadata and Customer Content: channel identifiers, phone numbers, timestamps, delivery status, and message text/media when you connect WhatsApp, Instagram, or Messenger.
  • Product usage: events for reliability, security, and in-product analytics, as described in our Cookie Policy for non-essential technologies.

4. Google Sign-In

Team members can sign in with Google Sign-In. We receive the Google account name, email, and (if provided) a profile photo, solely to authenticate you and open the correct workspace. We do not use Google Sign-In to read Gmail, Drive, or other Google content, and it does not grant access to WhatsApp or other messaging content by itself.

5. Purposes and legal bases

  • Contract: provide the Alatusa service, authenticate users, route conversations, and bill subscriptions.
  • Legitimate interests: secure the platform, prevent abuse, measure reliability, and improve the product in a privacy-respecting way (balanced against your rights).
  • Legal obligation: tax, accounting, and binding requests from authorities where applicable.
  • Consent: where required for non-essential cookies or optional programs (see Cookie Policy). Optional email (setup reminders and, when we start sending them, product updates) can be stopped at alatusa.com/unsubscribe.

6. Email we send from Alatusa

We send email from info@alatusa.com. There are two kinds:

  • Optional: WhatsApp setup reminders while connection is incomplete, and product-update notes when we start sending them. You can stop all of these, or keep only the types you still want, at Email preferences. On that page, boxes start unchecked. Saving with nothing ticked stops all optional email. We do not add extra confirmation steps to keep you subscribed.
  • Required: account and security mail, workspace invites, support correspondence, account notices (for example Meta connection status), and Stripe billing receipts. These are part of operating the service or a contract/legal need. They are not a newsletter and are not listed as optional switches.

Product-update mail is not sent yet. The product-updates choice is stored so a later list will honor it from the first send.

7. Model training

Use of Customer Content to train generic third-party foundation models is not the default. Where features improve suggestions for your workspace (for example from answers your team marks as approved), that processing stays scoped to delivering your service unless we disclose otherwise and obtain any required consent or instructions.

8. Sharing and sub-processors

We use service providers under contract, including:

  • Supabase: application database, auth, and storage (primary region: AWS eu-west-2 (London, United Kingdom)).
  • Stripe: subscription payments and invoicing.
  • Meta: WhatsApp, Instagram, and Messenger when you connect those channels (Meta processes data under its terms and your Meta Business configuration).
  • Google: Sign-In; and generative AI APIs when AI features are enabled for a workspace.

A fuller sub-processor schedule is available on request or in your order / DPA annex.

We do not sell personal data. Operational health monitoring (database health snapshots, queue metrics, alerts) excludes message bodies, customer phone numbers, and authentication tokens.

9. Retention

We retain account and Customer Content while your workspace is active and as needed for backups, disputes, and legal holds, then delete or anonymize according to our retention schedule, your instructions (as processor), and applicable law. After termination, see the export window in our Terms.

10. Your rights

Under the GDPR you may have rights to access, rectify, erase, restrict, port, or object to certain processing, and to lodge a complaint with a supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens). Signed-in team members can download a portable JSON export from Export my data. For optional email, use Email preferences. For deletion and Meta disconnect steps, see Data deletion instructions. Customer organizations handle most end-customer requests as controller; we assist as required by law and the DPA.

11. International transfers

Primary application data is hosted in AWS eu-west-2 (London, United Kingdom). Where personal data is transferred internationally, we use appropriate safeguards (such as adequacy decisions and/or standard contractual clauses) where required by the GDPR.

12. Contact

Lein AI Systems
Paul Krugerstraat 356, 4381 WT Vlissingen, Netherlands
Email: info@alatusa.com
Phone: +31 6 82 19 76 31
VAT: NL005354633B13