Privacy Policy
Last updated September 29, 2026
This policy explains how alstro handles personal information when you visit alstro.co, get in touch with us, work with us, or hear from us about our services.
- Our website doesn’t use cookies, analytics or advertising trackers.
- When you send the project form, we receive what you typed and keep it only to reply to you.
- We use what you send us to reply, and to work with you if you become a client.
- We sometimes contact businesses using publicly listed business details. You can opt out at any time.
- We never sell personal information.
Who we are
alstro (“alstro”, “we”, “us”) is a studio for custom software, design and marketing. The alstro website and business are operated by alstro, which is responsible for the personal information described in this policy. Under data protection laws such as the EU and UK General Data Protection Regulation, that makes us the “controller” of this information.
You can reach us about anything in this policy at info@alstro.co.
What this policy covers
This policy covers personal information we handle when you:
- visit our website,
- contact us, send us an inquiry or an idea, or meet with us,
- receive business outreach from us, and
- work with us as a client, or as someone at a client’s business.
It doesn’t cover information we handle on behalf of our clients when we build or run software, websites or campaigns for them. In that work we act as a service provider (a “processor”) under our agreement with the client, and the client’s own privacy policy explains how that information is used. It also doesn’t cover other websites we link to.
Information we collect
Information you give us
When you send our project form, email us, call us, or meet with us, we receive what you choose to share. That usually includes your name, email address, company, the services you’re interested in and a description of your project, along with anything else you include in your message. If you schedule a call with us, we receive the details needed to arrange it. If you become a client, we also keep billing contact details, contracts, invoices and project communications.
You don’t have to give us any information, but we can’t reply to you without a way to reach you. Please don’t send us sensitive information, such as health information, financial account numbers or government identification numbers, unless we’ve asked for it and agreed how it will be handled.
Information from public sources
To find businesses our services could help, we review publicly available business information, such as business websites, public directories and review sites, and government license and registration records. From these we may note a business’s name and address, the names and roles of owners or contacts listed publicly, business email addresses and phone numbers, website details, license or registration status, and public reviews and ratings. We use this only to judge whether our services could help and to contact the business. We don’t buy or rent contact lists.
Information collected automatically
Our website doesn’t use cookies, analytics, advertising pixels or any other tracking technology, and it doesn’t build a profile of you. Its fonts and files are served from the website itself rather than from third-party services.
Like any website, ours is delivered by a hosting provider that automatically receives the technical information needed to send you each page and keep the service secure: your IP address, browser type, the page you asked for, the page that referred you, and the date and time. This is recorded in server logs. The provider that hosts our database, which stores what you send with the project form, keeps similar logs.
What you type into the idea box stays in your browser until you move it into the project form. When you send the form, your name, email address, company if you give it, the services you picked and your message are sent to us and stored in our database, along with the part of the website you sent it from. If sending fails, the form prepares an email in your own email app instead, and nothing reaches us unless you send that email.
Because our website doesn’t track you over time or across other websites, and doesn’t let third parties do so, it doesn’t respond differently to “Do Not Track” browser signals. For the same reason, and because we don’t sell or share personal information, there’s nothing for a Global Privacy Control signal to opt you out of.
How we use information
We use personal information only for the purposes below. Where the EU or UK General Data Protection Regulation applies, the table also shows the legal basis we rely on.
| Purpose | Information | Legal basis |
|---|---|---|
| Replying to your inquiry and discussing a possible project | Information you give us | Taking steps at your request before a contract, and our legitimate interest in answering people who contact us |
| Providing our services, managing the client relationship and invoicing | Client information | Performing our contract, and meeting our tax and accounting obligations |
| Contacting businesses about our services | Information from public sources | Our legitimate interest in offering our services to businesses. You can object at any time. |
| Running, securing and fixing the website | Technical information in server logs | Our legitimate interest in running a secure website |
| Meeting legal requirements, enforcing our terms and protecting our rights | Any of the above, as needed | Legal obligation, and our legitimate interests |
We don’t use personal information for targeted advertising, and we don’t make decisions about anyone by automated means that have legal or similarly significant effects.
Business outreach
When we contact a business about our services, our message says who we are, gives our contact details and explains how to opt out. To stop hearing from us, reply “unsubscribe” or email info@alstro.co. We’ll honor your request promptly, and in any case within 10 business days. We keep a minimal record of the opt-out, such as the email address and the date, so we don’t contact you again.
How we share information
We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We share it only as follows:
- Service providers that help us run our business, such as email and productivity tools, website hosting, secure internal tools and databases, calendar and video meeting tools, and accounting and payment providers. They may use it only to provide their services to us.
- Professional advisers, such as lawyers and accountants, who are bound by confidentiality.
- Authorities and others when the law requires it, or when it’s needed to protect the rights, property or safety of alstro, our clients or others.
- A buyer or successor if our business is involved in a merger, acquisition or sale of assets, subject to the commitments in this policy.
- Anyone else with your permission.
We don’t share personal information with third parties for their own direct marketing.
International transfers
We and our service providers may store and process information in the United States and other countries. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country that isn’t recognized as providing adequate protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK Addendum to them, or a provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for more detail about these safeguards.
How long we keep information
We keep personal information only as long as we need it for the purposes in this policy:
- Inquiries that don’t lead to a project: up to 24 months after our last contact, then deleted.
- Client records: for the length of our relationship, then as long as tax, accounting and legal requirements call for, usually up to seven years.
- Outreach research: up to 24 months after we last reviewed or contacted the business, unless it becomes an inquiry or a client relationship.
- Opt-out records: for as long as we need them to respect your choice.
- Server logs: for a short period, as needed for security and troubleshooting, then deleted by our hosting provider.
Your rights and choices
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy of it,
- correct information that’s inaccurate,
- have your information deleted,
- receive your information in a portable format,
- object to or restrict how we use it, including objecting to business outreach at any time, and
- withdraw your consent where we rely on it.
If you’re in the European Economic Area, the United Kingdom or Switzerland
You have the rights above under the General Data Protection Regulation, the UK GDPR and Swiss law. You also have the right to complain to your local data protection authority. In the United Kingdom, that’s the Information Commissioner’s Office.
If you’re in the United States
If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, New Jersey, Texas or Virginia, you may have the right to know about, access, correct, delete and get a copy of your personal information, and to opt out of its sale, its use for targeted advertising, and profiling. We don’t sell personal information, use it for targeted advertising, or use it for profiling, so there’s nothing to opt out of, but you can still use your other rights. We won’t discriminate against you for using any of them.
In the past 12 months we’ve collected these categories of personal information, as California law defines them: identifiers, such as name, email address, phone number and IP address; professional information, such as company and role; commercial information, such as records of services we’ve provided; and internet activity, such as server log data. We collect them from you, from public sources and automatically, for the purposes in section 4, and we disclose them only to the recipients in section 6. We don’t collect sensitive personal information.
How to make a request
Email info@alstro.co with the subject “Privacy request”. We may need to confirm your identity first, for example by asking you to reply from the email address in our records. We’ll respond within one month where the GDPR applies, and within 45 days where a US state law applies, and we’ll tell you if we need more time where the law allows it. Where the law allows, you can use an authorized agent to make a request for you, and we may ask for proof of their authority.
If we decline your request, you can appeal by replying to our decision. We’ll answer your appeal within the time your state’s law requires. If we deny it, you can contact your state attorney general.
Security
We protect personal information with reasonable technical and organizational safeguards, including encrypted connections, access limited to the people who need it, and reputable service providers. No method of transmission or storage is completely secure, so we can’t guarantee absolute security. If a breach affects your personal information, we’ll notify you and the relevant authorities as the law requires.
Children
Our website and services are meant for businesses and aren’t directed to children. We don’t knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, contact us at info@alstro.co and we’ll delete it.
Other websites
Our website may link to websites and services run by others. Their privacy practices are their own, so please read their policies before sharing information with them.
Changes to this policy
We may update this policy from time to time. When we do, we’ll change the date at the top of this page. If a change is significant, we’ll give notice on our website or, where appropriate, by email.
Contact us
For questions about this policy or your personal information, email info@alstro.co.