Last updated: April 25, 2026 · Effective date: April 25, 2026
This Privacy Policy explains how Alterion Labs, Inc. ("Alterion Labs", "we", "us", "our") collects, uses, discloses, and protects personal data when you use the website at alterionlabs.com, our AI agents, our APIs, our MCP servers, and any related products (together, the "Services").
We are headquartered at 615 Hillcrest Dr, Waunakee, WI 53597, United States. For privacy questions, contact privacy@alterionlabs.com.
Our role under data-protection law depends on whose personal data is being processed and why.
This Policy covers our own controller activities. Section 11 explains the affiliate-program processing in more detail. For data we process on a Customer's behalf, the Customer's privacy notice governs the relationship with the data subject, not this one.
We collect the following categories of personal data:
We do not intentionally collect special categories of personal data (race, religion, health, biometric, sexual orientation, etc.). Do not submit such data to the Services.
We use personal data to: (a) provide, secure, support, and improve the Services; (b) authenticate you and prevent fraud; (c) process payments and manage subscriptions; (d) personalize the experience and surface relevant features; (e) communicate with you about the Services, including service notices, security alerts, and product updates; (f) send marketing where lawful and where you have not opted out; (g) measure and improve performance, reliability, and quality; (h) train, evaluate, and improve our models — only on aggregated, de-identified, or properly authorized data; (i) comply with legal obligations and enforce our Terms of Service; and (j) protect the rights, safety, and property of Alterion Labs, our Customers, and the public.
Data we process on a Customer's behalf is used only for the Customer's documented purposes and as permitted by the DPA. We do not sell it, do not use it for cross-Customer marketing, and do not use it to train general-purpose models that could re-identify individuals.
We rely on the following lawful bases under Article 6 GDPR for our controller processing:
For processor activities (Section 11), the Customer is responsible for selecting the lawful basis and obtaining any required consent from data subjects.
We share personal data only as described below. We do not sell personal data.
A current list of sub-processors is available on request from privacy@alterionlabs.com. Customers receive at least thirty (30) days' notice of new sub-processors that handle Customer Data and may object as set out in the DPA.
We process personal data in the United States and in other jurisdictions where our service providers operate. When personal data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been deemed adequate, we rely on appropriate safeguards — primarily the European Commission's Standard Contractual Clauses (2021/914) and, where applicable, the UK International Data Transfer Addendum — together with supplementary technical and organizational measures. Transfers related to affiliate programs (e.g. paying out a commission to an affiliate located in another country) rely on the same safeguards.
We retain personal data for as long as needed to provide the Services, to comply with our legal, tax, and accounting obligations, to resolve disputes, and to enforce our agreements. When personal data is no longer needed, we delete or anonymize it.
For affiliate-program data processed on a Customer's behalf, retention follows the Customer's documented instructions and the DPA. Default retention windows include: click and view events for the configured cookie duration plus a reasonable audit window; conversion and commission records for the period required for chargeback, refund, and tax reporting (typically up to seven years); and affiliate account records for as long as the affiliate's relationship with the Customer is active and for the period required by tax law thereafter.
We implement reasonable technical and organizational measures to protect personal data — including encryption in transit, encryption at rest for sensitive fields (including affiliate banking and tax data), access controls, audit logging, network segmentation, secret rotation, webhook signing, and routine security reviews. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for promptly notifying us of any suspected unauthorized access at security@alterionlabs.com.
If you are in the EEA, the UK, or Switzerland, you have the right to: access the personal data we hold about you; request rectification or erasure; restrict or object to processing; receive your data in a portable format; withdraw consent at any time without affecting the lawfulness of prior processing; and lodge a complaint with your local supervisory authority. To exercise these rights, contact privacy@alterionlabs.com. We will respond within the time required by law (generally one month).
If your data was collected by us on behalf of a Customer (for example, you clicked an affiliate link to a Customer's site or signed up as an affiliate in a Customer's program), the Customer is the controller. We will forward your request to the Customer and assist them in responding, but the Customer is the party legally required to act on it.
If you are a California resident, you have the right to:
To exercise your rights, contact privacy@alterionlabs.com or use the form at alterionlabs.com/contact. We will verify your identity before responding. You may designate an authorized agent in writing.
For requests that concern data we process as a service provider for one of our Customers (including end-user data captured through a Customer's affiliate program), we will route the request to the Customer and support them in fulfilling it.
For the categories of personal information we have collected and disclosed in the prior twelve months, the sources, the business or commercial purposes, and the categories of recipients, see Sections 2, 3, and 5 of this Policy.
When a Customer uses Alterion Labs to run an affiliate program — or any other product where we capture data from the Customer's end users, prospective customers, or partners — we act as a processor (and a service provider under the CCPA/CPRA). This section explains what that processing looks like in practice.
client_reference_id, and store the result.For all processing described in this Section 11, the Customer is the controller (and a business under the CCPA/CPRA). The Customer is solely responsible for:
We will assist the Customer to a reasonable extent under the DPA — including by honouring deletion requests, executing SCCs, providing security documentation, and notifying the Customer of any data incident affecting Customer Data without undue delay — but the underlying compliance obligations sit with the Customer.
The Services are not directed to children under sixteen (16). We do not knowingly collect personal data from children. If you believe a child has provided us — or a Customer using our Services — with personal data, contact privacy@alterionlabs.com and we will take appropriate steps.
The Services use AI to generate recommendations, content, and automated actions. A meaningful human in the loop — you, or the Customer — is required. Affiliate fraud detection, attribution decisions, and payout calculations are deterministic rules configured by the Customer; the Customer reviews and approves them. We do not subject you to decisions based solely on automated processing that produce legal or similarly significant effects on you.
Most browsers send a "Do Not Track" signal that has no agreed standard. We do not respond to DNT signals. We do honour the Global Privacy Control signal as an opt-out of sale/share under the CPRA.
We may update this Policy from time to time. Material changes will be communicated by email or through the Services at least thirty (30) days before they take effect, except where a shorter period is required by law. The "last updated" date at the top of this page will always reflect the latest revision. Prior versions are available on request.
California Civil Code §1798.83 ("Shine the Light") permits California residents who have an established business relationship with us to request, once per calendar year, certain information regarding our disclosure of personal information to third parties for those third parties' direct-marketing purposes. We do not disclose personal information to third parties for their own direct-marketing purposes. To make a Shine-the-Light request, see the dedicated notice at alterionlabs.com/legal/california-shine-the-light.
For all privacy-related requests, contact privacy@alterionlabs.com or write to: Alterion Labs, Inc., Attn: Privacy, 615 Hillcrest Dr, Waunakee, WI 53597, United States.
If we are required to designate an EU/UK representative under Article 27 GDPR, the current representative will be listed at alterionlabs.com/legal/privacy-policy.
Disclaimer. Despite our compliance posture, you remain responsible for your own privacy practices on the Services and for the lawfulness of the data you submit. Customers running affiliate programs or any other end-user-facing product through Alterion Labs are solely responsible for: (i) the legal basis for the processing, (ii) the privacy notice on their own site, (iii) consent capture for tracking cookies, identifiers, and fingerprinting, (iv) responses to data-subject requests, and (v) any communication with end users, affiliates, or supervisory authorities. Alterion Labs assumes no liability for personal data submitted in violation of these terms or applicable law, or for a Customer's failure to obtain the consents and provide the notices required of a controller. See the Terms of Service for the full liability framework.