Privacy Policy

Last updated: March 31, 2026

Alto ("we", "us", "our") is a voice dictation service for Linux. This policy explains what data we collect, why, and your rights under the General Data Protection Regulation (GDPR).

1. Data controller

Alto
Contact: privacy@alto-dictation.com

2. Data we collect

Data	Purpose	Retention
Email address	Account identification, login	Until account deletion
Password (hashed)	Authentication	Until account deletion
Subscription tier & status	Service access, billing	Until account deletion
Monthly usage (request count, audio duration)	Usage metering, quota enforcement	12 months rolling
Creem customer & subscription IDs	Payment processing	Until account deletion

3. Data we do NOT collect

• Audio recordings — your voice is sent directly to Mistral AI for transcription and is never stored on our servers.
• Transcribed text — the text result is returned to your device and never logged or stored.
• IP addresses — we do not store request IP addresses in our database.
• Device information — we do not collect browser fingerprints, hardware identifiers, or geolocation data.

4. Legal basis

We process your data under Article 6(1)(b) GDPR — performance of a contract. The data is necessary to provide the Alto service, enforce usage quotas, and manage your subscription.

5. Sub-processors

Provider	Purpose	Location
Mistral AI	Speech-to-text transcription	France (EU)
Creem	Payment processing (Merchant of Record)	Estonia (EU)
OVH	Server hosting	France (EU)

All sub-processors are located within the European Union. No data is transferred outside the EU.

6. Your rights

Under the GDPR, you have the right to:

• Access your data — available via your account settings or the API endpoint GET /v1/auth/me and GET /v1/usage.
• Rectify inaccurate data — contact us at privacy@alto-dictation.com.
• Delete your account and all associated data — available from the app or via the API endpoint DELETE /v1/auth/me. Deletion is immediate and irreversible.
• Export your data in a portable format — the API endpoints above return JSON.
• Lodge a complaint with a supervisory authority (in France: CNIL).

7. Data security

• Passwords are hashed before storage and never stored in plaintext.
• All connections use TLS (HTTPS).
• Refresh tokens are hashed and rotated on each use.
• The database is hosted on a private VPS with restricted access.

8. Cookies

The Alto website and application do not use cookies or tracking technologies.

9. Children

Alto is not intended for use by children under 16. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. For significant changes, we will notify users by email.

11. Contact

For any questions about this privacy policy or to exercise your rights, contact us at:
privacy@alto-dictation.com