altcrm is software for tailors and alteration shops: orders, customers, a price list and “ready for pickup” texts, on the web and on phones. This policy explains what information Rivo Agency (“altcrm”) handles, why, where it is kept and what you can do about it. Our postal address is 6929 Sunrise Blvd, Citrus Heights, CA 95610, USA. Questions and requests go to support@altcrm.io.
Two kinds of information, two roles
- Shop accounts. The details of the people who use altcrm at a shop (owners, admins, staff). For this information we decide how it is used; we are its controller.
- The shop’s customers. Shops enter details about their own customers: names, phone numbers, emails, addresses, birthdays, orders, garment photos, notes and payments. That information belongs to the shop. We store and process it only to run altcrm for that shop and on its instructions; we are the shop’s service provider (processor), and the shop is responsible for having the right to use it.
What we collect
- Account details: name, email address, optional phone number, and your password, stored only as a salted scrypt hash.
- Shop details: business name, address, phone, time zone, language, logo and settings.
- What shops enter: customers, orders, services and prices, notes, photos, and payment records (amount and method; never card numbers).
- Messages we send for the shop: the text of each message, who it went to and whether it was delivered.
- Technical data: sign-in sessions with the IP address and browser or device they came from, a log of important account actions, and server logs. We use them to keep accounts secure, stop abuse and fix problems.
- If paid plans are used: the billing details our payment processor (Stripe) shares with us, such as plan, status and the last digits of a card. Card numbers never reach us.
Cookies
altcrm sets only the cookies it needs to work: one that keeps you signed in on your shop’s address, and, during a support session, one that marks it and ends it on time. There are no advertising or analytics cookies and no ad trackers, and we don’t sell or “share” personal information for cross-context advertising.
Why we use it
- To provide altcrm: show your shop’s orders, send the texts and emails you ask for, and keep every shop’s data apart (the contract with your shop).
- To send account emails: address confirmation, team invites, password resets and notices about your plan (the contract, and our legitimate interest in a working, secure service).
- To keep the service secure: limit sign-in attempts, investigate misuse, and keep backups (our legitimate interest, and legal obligations).
- To improve altcrm from aggregated, non-identifying usage counts.
- To answer you when you write to us.
We don’t use the information shops enter about their customers for any purpose of our own, and we don’t sell any personal information.
Where it is kept and who helps us
altcrm runs on our own servers at Hetzner Online in Germany (European Union). Companies that run parts of the service for us, under contracts that limit them to that job:
- Hetzner Online (Germany): servers, database and file storage.
- Cloudflare: delivers the site and protects it from attacks; traffic passes through its network.
- Resend: delivers account emails.
- Our SMS provider: delivers the texts shops choose to send.
- Stripe: handles payments for paid plans.
Some of them process data in the United States. Where the law requires it, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses. We also disclose information when the law requires it, to protect people’s safety, or as part of a sale or merger of our business, in which case this policy keeps applying to it.
Texts to a shop’s customers
Shops decide whether to text their customers, for example when an order is ready. Shops must have their customers’ permission to text them. If you got a text from a shop that uses altcrm and don’t want more, reply STOP where offered, ask the shop, or write to us and we’ll pass it on.
How long we keep it
- Shop data: while the shop’s account exists. When a shop closes its account, we delete its data within 30 days.
- Backups: up to 14 days, after which deleted data is gone from them too.
- Sign-in sessions: until you sign out or they expire (30 days on the web, 90 days in the phone app).
- Records we must keep by law, such as billing records, for as long as the law requires.
Security
Data travels encrypted (HTTPS). Every shop’s data is kept apart inside the database itself, so one shop cannot read another’s, and team roles limit what each person in a shop can see and change. Passwords are stored only as hashes, garment photos only behind expiring links, and sign-in attempts are limited. No system is perfectly secure; if a breach affects your information, we will tell the affected shops without undue delay and as the law requires.
Your rights
You can update your account details in altcrm at any time. You may also ask us for a copy of your information, to correct it, to delete it, or to restrict or object to how we use it; write to support@altcrm.io. To delete your account or close your shop, see Delete your account. We answer within 30 days (45 days where California law allows) and may need to confirm who you are first. You may use an authorized agent, and we won’t treat you differently for using your rights.
If you are a shop’s customer, contact the shop first: it controls your information, and we will help it respond. If you are in the EU, UK or Switzerland, you can also complain to your data protection authority.
Children
altcrm is a tool for businesses and isn’t meant for children under 16. We don’t knowingly collect information from them.
Changes
If we change this policy in a way that matters, we’ll email shop owners before the change takes effect. The date at the top shows when it last changed.