TermsPrivacyCookies

Privacy Policy

Last updated: 5 October 2026

This policy explains what personal information Aalto collects, how we use it, and the choices you have. It covers the Aalto website and app, our mobile apps, our browser extensions, and our backend services. Aalto is operated by Graye Pty Ltd (ABN 50 683 949 902), and we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are

Aalto is operated by Graye Pty Ltd, Suite 223, Level 2/111 Harrington St, The Rocks NSW 2000, Australia. For any privacy question or request, contact our Privacy Officer at [email protected].

2. What we collect

  • Account data: email, display name, avatar, and auth credentials handled by Supabase Auth. If you sign in with Google or Apple, we receive your email and basic profile from that provider.
  • Product saves: the URLs you choose to save and the metadata we extract from them (name, price, brand, images).
  • Collections & tags: the structure and labels you create to organise your saves.
  • Usage data: server logs (request paths, timestamps, error traces) used to operate and debug the Service, and error reports from your browser (with text and form inputs masked).
  • Analytics data:pages visited, features used, device and browser type, and approximate location (country). We collect this with Google Analytics and PostHog using cookies only if you allow them. If you accept, PostHog may also record your clicks, scrolling and page changes, with all text, form inputs, images and video hidden; these recordings are kept for 30 days. We don't send your IP address to PostHog, and we strip query strings from page addresses before they're sent. See our Cookie Policy.
  • Billing data: handled by Stripe. We store a customer ID and subscription status; we do not see or store card numbers.

3. What the extension collects

The Aalto browser extension reads the URL, title, OG tags, JSON-LD, and image URLs of a page onlywhen you click Save. It does not track your browsing history, scrape pages in the background, or send data to third parties. It reads Aalto's own auth cookies on the web app domain to resume your session. This access is limited to providing the save feature, consistent with the Chrome Web Store Limited Use requirements.

4. AI apps you connect

On paid plans, a workspace admin can let AI apps such as Claude and ChatGPT connect to Aalto. Nothing is shared with an AI app unless an admin turns this on and you sign in to Aalto from that app and approve it.

  • When you approve an app, it receives your name, email address and an account identifier so it can sign you in.
  • While connected, the app can read the products, collections, tags, custom fields and images of the workspace you are signed in to, and, if the admin allows it, add or change them. We send this content only when the app asks for it on your behalf.
  • Connected apps never receive your password, billing details, sharing settings or usage data, and they cannot delete products or collections.
  • We record each action a connected app takes (which app, who, when, the outcome and what changed) so you and your workspace admins can review it and undo it in Settings.

What an AI app does with the content it receives is governed by that app's own terms and privacy policy. You can limit or disconnect an app at any time in Settings, and an admin can turn AI access off for the whole workspace.

5. How we use it

  • Run and improve the Service.
  • Extract product metadata via our backend and AI providers.
  • Send transactional email (sign-up confirmation, billing receipts).
  • Enable sharing and collaboration you initiate.
  • Prevent abuse and enforce tier limits.
  • Understand how Aalto is used so we can improve it (analytics, with your consent where cookies are involved).

We do not sell your personal information and we do not use it for advertising.

6. Sub-processors

We share minimal, necessary data with the following:

  • Supabase (database, auth, file storage, edge functions).
  • OpenAI (text embeddings + image description; product metadata only).
  • ScrapingBee + Context.dev (page fetching for product extraction).
  • Stripe (billing).
  • remove.bg (optional background removal for product images).
  • Google Analytics (website analytics, with your consent).
  • PostHog (product analytics).
  • Sentry (error monitoring).
  • Vercel (web hosting and cookie-free page view counts).

7. Overseas disclosure

Some of our sub-processors store or process data outside Australia, including in the United States and other countries. In accordance with APP 8, we take reasonable steps to ensure overseas recipients handle your personal information consistently with the Australian Privacy Principles. By using Aalto, you acknowledge your information may be processed overseas.

8. Retention

We keep your data while your account is active. When you delete your account, we delete your products, collections, tags, and uploaded images. Billing records are retained as required by Australian tax law.

9. Your rights

Under the Australian Privacy Principles you may access the personal information we hold about you, ask us to correct it, and request its deletion. You can export all your data as CSV (and, on paid tiers, Excel and PDF) from the Settings page. To make a request, email [email protected]. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Security

Data is transmitted over TLS and stored encrypted at rest. Row Level Security policies ensure one user cannot read another user's data. We follow industry-standard practices and disclose material security incidents to affected users promptly.

11. Notifiable data breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

12. Children

Aalto is not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

13. Changes

We will notify you of material changes by email or in-app. The “Last updated” date at the top of this page always reflects the current version.

14. Contact

Questions or requests? Email [email protected], or write to Graye Pty Ltd, Suite 223, Level 2/111 Harrington St, The Rocks NSW 2000, Australia.