Privacy Policy

Effective Date: February 8, 2025

1. Introduction

Alethia Intelligence ("we", "our", "us") operates the Alethia GTM Audit Agent platform available at app.alethia-intelligence.ai. This Privacy Policy explains how we collect, use, and protect your information when you use our services.

2. Information We Collect

We collect information you provide directly when creating an account:

Account information: email address, name, and hashed password.
OAuth tokens: when you connect third-party platforms (Google, Meta, LinkedIn, TikTok), we store encrypted access and refresh tokens to perform audits and analytics on your behalf.
Audit data: website URLs, tag configurations, and audit results generated through the platform.

3. OAuth Scopes and Data Access

We request the minimum permissions necessary to provide our services:

Google Tag Manager: tagmanager.readonly (read container/tag data), tagmanager.edit.containers (apply approved remediations).
Google Ads: ads.readonly (read campaign metrics for cross-platform reporting).
Meta/Facebook: ads_read (read ad account data and insights), ads_management (manage ad configurations).
LinkedIn: r_ads, r_ads_reporting (read advertising data).
TikTok: Read-only advertising data access.

We only access data necessary to perform audits, generate reports, and execute approved remediations. We do not access personal messages, friend lists, or other unrelated data.

4. How We Use Your Information

Perform tag management audits and generate compliance reports.
Display cross-platform advertising metrics in the control plane dashboard.
Execute approved remediation actions on your tag configurations.
Send account-related communications (password resets, audit completion notifications).

5. Data Retention

Account data: retained while your account is active. Deleted within 30 days of account deletion request.
OAuth tokens: stored only while the platform connection is active. Immediately deleted when you disconnect a platform.
Audit reports: retained for 90 days after generation, then automatically purged.

6. Data Sharing

We do not sell, rent, or share your personal data with third parties. Data is only transmitted to:

The third-party platforms you connect (Google, Meta, etc.) via their official APIs using your authorized tokens.
Our infrastructure providers (hosting, database) under strict data processing agreements.

7. Data Deletion Rights

You have the right to request deletion of your data at any time:

Disconnect a platform: removes all stored tokens and cached data for that platform immediately.
Delete your account: contact [email protected] to request full account deletion.
Meta data deletion: Meta may send automated deletion requests on your behalf. We process these within 24 hours and provide a confirmation code.

8. Security

We employ industry-standard security measures including:

PBKDF2 password hashing with per-user salts.
JWT-based authentication with 24-hour token expiry.
HTTPS encryption for all data in transit.
Row-level security policies on our database.
HMAC verification on all incoming webhooks.

9. Cookies

We use a single authentication token stored in your browser's localStorage. We do not use tracking cookies or third-party analytics on this website.

10. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated via email to registered users. The effective date at the top of this page reflects the most recent revision.

11. Contact

For privacy-related questions or data deletion requests, contact us at [email protected].