Introducing Altrio Pro, the CRE AI-Agent that captures, extracts and scores every deal in your inbox.
Join the WaitlistIntroducing the Altrio CRE AI-Agent that captures, extracts and scores every deal in your inbox.
Learn MoreLast updated July 17, 2026
This privacy notice for Altrio ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("services"), including when you:
Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our services. If you still have any questions or concerns, please contact us at brianna@altrio.com.
This summary provides key points from our privacy notice, but you can find out more details about any of these topics by using the table of contents below to find the section you're looking for.
What personal information do we process? When you visit, use, or navigate our services, we may process personal information depending on how you interact with us and the services, the choices you make, and the products and features you use.
Do we process any sensitive personal information? Some information may be considered "special" or "sensitive" in certain jurisdictions — for example, racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.
Do we collect any information from third parties? We may collect information from public databases, marketing partners, social media platforms, and other outside sources.
How do we process your information? We process your information to provide, improve, and administer our services, communicate with you, prevent fraud, and comply with law. We may also process your information for other purposes with your consent, and only when we have a valid legal reason to do so.
In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties.
How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission or storage technology can be guaranteed to be 100% secure, so we cannot promise that hackers, cybercriminals, or other unauthorized parties will never defeat our security.
What are your rights? Depending on where you're located, applicable privacy law may give you certain rights regarding your personal information.
How do you exercise your rights? The easiest way is by visiting altrio.com/contact-us, or by contacting us directly. We will consider and act on any request in accordance with applicable data protection laws.
In short: we collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and services, when you participate in activities on the services, or otherwise when you contact us.
Personal information provided by you. The personal information we collect depends on the context of your interactions with us and the services, the choices you make, and the products and features you use. It may include the following:
Sensitive information. We do not process sensitive information. All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such information.
In short: some information — such as your IP address and browser and device characteristics — is collected automatically when you visit our services.
We automatically collect certain information when you visit, use, or navigate the services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and other technical information. It's primarily needed to maintain the security and operation of our services, and for internal analytics and reporting.
Like many businesses, we also collect information through cookies and similar technologies. You can find out more in our cookie notice. The information we collect includes:
In short: we may collect limited data from public databases, marketing partners, and other outside sources.
In order to enhance our ability to provide relevant marketing, offers, and services to you and update our records, we may obtain information about you from other sources, such as public databases, joint marketing partners, affiliate programs, data providers, and other third parties. This information includes mailing addresses, job titles, email addresses, phone numbers, intent data, IP addresses, social media profiles and URLs, and custom profiles, for purposes of targeted advertising and event promotion.
In short: we process your information to provide, improve, and administer our services, communicate with you, prevent fraud, and comply with law — and for other purposes only with your prior explicit consent.
We process your personal information for a variety of reasons, depending on how you interact with our services, including:
In short: we only process your personal information when we have a valid legal reason to do so — such as your consent, compliance with laws, fulfilling contractual obligations, protecting your rights, or our legitimate business interests.
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on to process your personal information. We may rely on the following:
We may process your information if you've given us specific permission (express consent), or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.
In some exceptional cases, we may be legally permitted to process your information without consent, including:
In short: we may share information in specific situations described in this section and with the following third parties.
We may need to share your personal information in the following situations:
In short: we may use cookies and other tracking technologies to collect and store your information.
We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our services. Some online tracking technologies help us maintain security, prevent crashes, fix bugs, save your preferences, and support basic site functions.
We also permit third parties and service providers to use online tracking technologies on our services for analytics and advertising, including to help manage and display advertisements or tailor them to your interests. These third parties use their own technology to provide advertising tailored to your interests, which may appear on our services or elsewhere.
To the extent these technologies are deemed a "sale" or "sharing" under applicable US state laws, you can opt out as described in the section on US resident privacy rights. Specific information about how we use these technologies and how to refuse certain cookies is set out in our cookie notice.
We may share your information with Google Analytics to track and analyze use of the services. The Google Analytics advertising features we may use include remarketing, Google Display Network impressions reporting, and demographics and interests reporting. To opt out of Google Analytics tracking across the services, visit tools.google.com/dlpage/gaoptout.
In short: we keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice, unless otherwise required by law.
We will only keep your personal information for as long as necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).
When we have no ongoing legitimate business need to process your personal information, we will delete or anonymize it — or, if that isn't possible (for example, because it's stored in backup archives), we'll securely store it and isolate it from further processing until deletion is possible.
In short: we aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate technical and organizational security measures designed to protect the personal information we process. However, despite our safeguards, no electronic transmission or information storage technology can be guaranteed to be 100% secure, so we cannot promise that hackers, cybercriminals, or other unauthorized parties will never defeat our security. Transmission of personal information to and from our services is at your own risk — please only access the services within a secure environment.
In short: we do not knowingly collect data from or market to children under 18, or the equivalent minimum age in your jurisdiction.
We do not knowingly collect, solicit, or sell personal information from children under 18 (or the equivalent age specified by law in your jurisdiction). By using the services, you represent that you're at least 18, or that you're the parent or guardian of a minor and consent to their use of the services. If we learn that we've collected information from a child under the applicable age, we will deactivate the account and take reasonable measures to promptly delete the data. If you become aware of any such data, please contact us at brianna@altrio.com.
In short: depending on your state or region of residence — including the EEA, UK, Switzerland, and Canada — you have rights that give you greater access to and control over your personal information.
In some regions, you have certain rights under applicable data protection laws. These may include the right to request access to and a copy of your personal information; to request rectification or erasure; to restrict processing; where applicable, to data portability; and not to be subject to automated decision-making. If an automated decision produces legal or similarly significant effects, we will inform you, explain the main factors, and offer a way to request human review. You may also have the right to object to processing. You can make a request using the contact details in section 13.
We will consider and act on any request in accordance with applicable data protection laws. If you're in the EEA or UK and believe we're unlawfully processing your personal information, you have the right to complain to your Member State data protection authority or the UK data protection authority. If you're in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing your consent. Where we rely on your consent to process your personal information, you have the right to withdraw it at any time by contacting us using the details in section 13. This won't affect the lawfulness of processing carried out before your withdrawal.
Opting out of marketing. You can unsubscribe from marketing and promotional communications at any time via the unsubscribe link in our emails, or by contacting us. We may still send you service-related messages necessary for administering your account or responding to service requests.
Cookies. Most browsers accept cookies by default, but you can usually set your browser to remove or reject them. Doing so could affect certain features of the services. See our cookie notice for details.
Most web browsers and some mobile operating systems include a do-not-track ("DNT") feature you can activate to signal your preference not to have your online browsing activity monitored and collected. No uniform technology standard for recognizing DNT signals has been finalized, so we do not currently respond to them. If a standard is adopted that we must follow, we'll update this notice accordingly.
California law requires us to disclose how we respond to browser DNT signals. Because there's no industry or legal standard for honoring them, we do not respond to DNT signals at this time.
In short: if you're a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have rights to access, correct, obtain a copy of, or delete your personal information, and to withdraw consent to its processing. These rights may be limited by applicable law.
The table below shows categories of personal information we've collected in the past twelve months. It includes illustrative examples of each category and doesn't necessarily reflect the information we collect from you specifically — see section 1 for a full inventory.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Contact details such as name, alias, postal address, phone number, unique or online identifier, IP address, email address, and account name | Yes |
| B. Personal information (California Customer Records statute) | Name, contact information, education, employment, employment history, and financial information | Yes |
| C. Protected classification characteristics | Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data | No |
| D. Commercial information | Transaction information, purchase history, financial details, and payment information | No |
| E. Biometric information | Fingerprints and voiceprints | No |
| F. Internet or network activity | Browsing history, search history, online behavior, and interactions with our and other websites, applications, and advertisements | No |
| G. Geolocation data | Device location | Yes |
| H. Audio, electronic, or sensory information | Images, audio, video, or call recordings created in connection with our business activities | No |
| I. Professional or employment-related information | Business contact details, job title, work history, and professional qualifications (e.g. for job applicants) | Yes |
| J. Education information | Student records and directory information | No |
| K. Inferences | Inferences drawn from collected information to create a profile of preferences or characteristics | No |
| L. Sensitive personal information | — | No |
We may also collect other personal information outside these categories when you interact with us in person, online, by phone, or by mail — for example, through customer support, surveys or contests, and delivery of the services.
We use and retain collected personal information as needed to provide the services, specifically:
Learn more in section 2 and section 4. We may disclose your personal information to service providers under a written contract. We may also use your personal information for our own business purposes, such as internal research for technological development — this is not considered "selling" your information. We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve months, and we will not do so going forward.
You have rights under certain US state data protection laws, though these rights are not absolute and we may decline a request as permitted by law. These include the right to:
Depending on your state, you may also have the right to:
To exercise these rights, contact us by visiting altrio.com/contact-us, emailing brianna@altrio.com, or using the contact details at the bottom of this notice. Under certain state laws, you can designate an authorized agent to make a request on your behalf; we may deny a request from an agent who doesn't submit proof of valid authorization.
Upon receiving your request, we'll need to verify your identity to confirm you're the person about whom we hold information. We'll only use the information provided in your request for verification purposes. If we can't verify your identity from information we already maintain, we may request additional information for verification, security, or fraud-prevention purposes. If you submit a request through an authorized agent, we may require additional identity verification along with the agent's signed permission to act on your behalf.
Under certain state laws, if we decline to act on your request, you may appeal by emailing brianna@altrio.com. We'll inform you in writing of any action taken, including our reasoning. If your appeal is denied, you may submit a complaint to your state attorney general.
California Civil Code Section 1798.83 permits California resident users to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we've disclosed to third parties for direct marketing purposes, along with the names and addresses of those third parties. To make such a request, submit it in writing using the contact details in section 13.
In short: yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this privacy notice from time to time. The updated version will be indicated by a revised "last updated" date at the top of this notice. If we make material changes, we may notify you by prominently posting a notice within the services or by sending you a direct notification. We encourage you to review this notice periodically.
If you have questions or comments about this notice, email us at brianna@altrio.com or contact us by post at:
Altrio
65 Grenview Blvd N
Etobicoke, Ontario M8X 2K3
Canada
Based on the applicable laws of your country or US state of residence, you may have the right to request access to the personal information we collect from you, details about how we've processed it, correction of inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To make a request, please visit altrio.com/contact-us.
In short: Altrio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access Gmail data solely to provide and improve deal management features you've directly requested. We do not use this data for advertising, nor do we transfer or sell it to third parties.
When you connect your Google account to the service, we access Google user data through OAuth 2.0. The specific scopes we request, their Google classification, and their purpose are detailed below.
| OAuth scope | Classification | Purpose |
|---|---|---|
| gmail.modify | Sensitive (Tier 2) | Read emails, modify labels, move to trash, compose drafts. Does not permit permanent deletion. Used for inbox ingestion and deal tracking. |
| gmail.send | Sensitive (Tier 2) | Send emails on behalf of the user when initiating deal communications from within the platform. Only triggered by explicit user action. |
| openid | Basic (Tier 1) | Authenticate the user's Google identity during sign-in. |
| Basic (Tier 1) | Retrieve the user's email address for account creation and identification. | |
| profile | Basic (Tier 1) | Retrieve the user's display name and profile picture for in-app display. |
What we do not do with your Gmail data: we do not read, index, or store the full content of emails unrelated to your commercial real estate activity. We do not use Gmail data for advertising or to build advertising profiles. We do not transfer, sell, or share Gmail data with third parties except as described in section 4. We do not use Gmail data to train AI or machine learning models without your explicit, separate consent.
If you connect a Microsoft Outlook account, we access your inbox via the Microsoft Graph API under equivalent least-privilege permissions. The same access, use, storage, and sharing policies described in this notice apply equally to Outlook data.
In accordance with the Google API Services User Data Policy Limited Use requirements, we use data obtained through Google APIs only to:
We expressly do not use your Google user data to:
Your data, including any information obtained from Google APIs, is stored on secure servers located in Canada and Ireland and hosted by Amazon Web Services (AWS), depending on your location and where the data is collected.
We implement and maintain technical and organizational security measures appropriate to the sensitivity of the data, including:
| Data type | Retention period | Deletion trigger |
|---|---|---|
| Gmail / Outlook email metadata and content linked to deals | Duration of account + 30 days after account deletion | Account deletion or explicit data deletion request |
| Gmail / Outlook authentication tokens (OAuth) | Until you revoke access via your Google Account settings or our platform | Token revocation or account disconnection |
| Deal data entered by users | Duration of subscription + 90 days after termination | Subscription end + grace period |
| Account profile data | Duration of account + 30 days | Account deletion request |
| Server and audit logs | 12 months | Rolling deletion |
| Anonymized, aggregated analytics | Indefinitely (no personal identifiers) | N/A |
Upon account deletion or your request, we will delete or anonymize your personal data within 30 days, except where retention is required by law or legitimate business record-keeping obligations.
We do not sell your personal information. We share data only in the limited circumstances described below.
Service providers. We share data with trusted third-party service providers who assist in operating the service, subject to contractual obligations restricting their use of data to the services they provide to us. Categories of providers include:
Legal compliance and protection. We may disclose your data when we reasonably believe disclosure is required to comply with applicable law, regulation, or legal process; to enforce our terms of service or protect our rights; or to protect the safety of our users, the public, or third parties.
Business transfers. If we're involved in a merger, acquisition, financing, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice in the service before your data is transferred and becomes subject to a different privacy policy.
With your consent. We will share your data for any other purpose with your explicit prior consent.
Google Account permissions. You may review and revoke the service's access to your Google account at any time via your Google Account's security settings at myaccount.google.com/permissions. Revoking access will disconnect your Gmail inbox from the service, and we'll cease all new data collection from Google APIs. Existing data linked to your account will be handled per our retention policy above.
Platform data controls. Within the service, you may at any time:
.webp){kind=small}
.webp){kind=small}
.webp){kind=small}