Alto Guard
Privacy Policy
Last updated: September 14, 2026 · Operated by Alto Smart Solutions F.Z.C
This policy explains exactly what data Alto Guard (the web dashboard at guard.altosmartsolutions.com and its Telegram moderation bot, @AltoSmartbot) collects, why, how long we keep it, and what your rights are. We collect the minimum needed to run a chat-moderation service and never sell personal data.
1. Data we collect
a) When you sign in with Google
- Your Google email address — creates and identifies your Alto Guard account (used for login, security notices and billing receipts).
- Your display name and profile photo — shown in your dashboard to label the account owner and team members.
- A persistent Google identifier (sub). We do NOT receive or store your Google password, and we do not request Google Drive, contacts or calendar data.
b) When you connect a Telegram channel
- Group identifiers: chat ID, group title, and the public @username of the group you register.
- Chat messages flowing through groups where @AltoSmartbot is an admin — processed in real time to apply your moderation rules (spam, ads, scams, forbidden words). Message text is stored only as needed to power the review queue, search, appeals evidence and moderation audit logs.
- Telegram user identifiers (user ID, @username, first name) of members who send messages, so moderation actions and appeals can be attributed.
- Moderation outcomes: warnings, mutes, removals and bans applied by the bot, with timestamps and rule references.
c) When you pay for a subscription
- Plan, billing cycle and order records. Payments are processed by NOWPayments in cryptocurrency; we store the order ID, amount, currency and payment status — card/wallet details never touch our servers.
d) Technical data
- Session cookies (authentication only), IP address and request metadata in server security logs, used to prevent abuse and rate-limit.
- We do not use advertising, tracking or analytics cookies.
2. Why we use it (legal basis)
- Provide the service you signed up for: authentication, moderation, dashboards, alerts (performance of contract).
- Legal compliance: keeping audit evidence for appeals and lawful requests (legal obligation).
3. Who we share data with
| Processor | Purpose | Location |
|---|---|---|
| Google Cloud (us-central1) | Hosting, database storage (Cloud SQL), all service data at rest, encrypted | United States (EU data handled under SCCs) |
| Google Identity Services | Sign-in only; sends us an ID token we verify | Google LLC |
| Telegram (Bot API) | Relaying messages between groups and our bot | Telegram FZ-LLC |
| NOWPayments | Cryptocurrency payment processing | NOWPayments Ltd |
We never sell personal data and do not share it with advertisers. Data is disclosed to law enforcement only when required by a valid legal order.
4. Retention
- Account and billing records: kept while your account exists and up to 5 years after closure for tax/legal obligations.
- Telegram message content: retained for 90 days by default (needed for review, search and appeals). Moderation action logs (who was warned/muted and why) are kept longer for audit integrity; message bodies referenced in an appeal are kept until the appeal closes.
- Security logs: up to 30 days.
- When a tenant disconnects a group, message content for that group is purged within 30 days except action logs needed for abuse prevention.
5. Your rights
- Access, correct, export or delete your personal data — from the dashboard (Settings) or by emailing the address below.
- Object to processing, restrict processing, or withdraw consent (e.g. remove the bot from a group at any time).
- Delete your account from Settings → Danger zone, or request deletion by email; we complete deletion within 30 days.
- If you believe we process data unlawfully, you may complain to a data protection authority (e.g. the DPA of your EU/EEA member state, or SDAIA in Saudi Arabia).
6. Security
All traffic is HTTPS (TLS 1.2+, HSTS). Data is encrypted at rest on Cloud SQL with automated point-in-time backups. Access is role-based, tenant-isolated (row-level security) and audited. Sessions use HttpOnly, SameSite=Lax cookies and expire.
7. Children
Alto Guard is a business tool for group owners and admins. It is not directed to children under 16, and we do not knowingly collect data from them.
8. Changes & contact
Material changes will be announced in the dashboard and on this page at least 14 days before taking effect. For privacy questions or requests: support@altosmartsolutions.com — Alto Smart Solutions F.Z.C, Dubai, UAE.