Privacy Policy

Atlas IntelliTek, Inc. ("Atlas IntelliTek," "Company," "we," "us," or "our") operates the Alma platform (the "Platform"), accessible at joinalma.ai and through our mobile applications. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Platform.

We are committed to protecting your privacy and handling your data with transparency and care. Please read this Privacy Policy carefully. By using the Platform, you consent to the data practices described in this policy. If you do not agree with this Privacy Policy, please do not use the Platform.

We collect information in several ways, depending on how you interact with the Platform.

2.1 Personal Information You Provide

When you create an account and use the Platform, you may provide us with the following types of personal information:

• Identity Information: Your name, email address, and password.
• Education Information: Your educational institution, graduation year, degree level, major or field of study, and academic interests.
• Employment Information: Your employer, job title, industry, and professional experience (primarily for mentor profiles).
• Payment Information: Credit card or payment method details, processed and stored by our payment processor (Stripe). We do not store your full payment card information on our servers.
• Referral Information: If you participate in our referral program, we store your unique referral code and track which users signed up using your referral link. If you signed up via a referral link, we record the referral relationship to award bonus credits to both parties.

2.2 Profile Data

To enhance your experience and improve matching, you may provide additional profile information including:

• Personal interests, hobbies, and extracurricular activities.
• Career goals and aspirations.
• A biographical description or "about me" section.
• Profile photographs.
• Mentorship preferences and availability.

2.3 Usage Data

We automatically collect information about how you interact with the Platform, including:

• Features you use and pages you visit.
• Search queries and discovery interactions.
• Interaction patterns, such as how frequently you use the Platform and which features you engage with most.
• Timestamps and duration of your sessions.
• Referral sources (how you found the Platform).

2.4 Device and Technical Data

When you access the Platform, we may collect technical information from your device, including:

• IP address and approximate geolocation.
• Browser type and version.
• Operating system and version.
• Device type, model, and unique device identifiers.
• Screen resolution and language preferences.
• Push notification tokens (for mobile app users who opt in).

2.5 Communication Data

We collect information related to your communications on the Platform, including:

• Messages exchanged between you and other users through the Platform's messaging system.
• Introduction requests and their content.
• Conversations with the AI chat assistant.
• Communications you send to our support team.

Messages between users may be encrypted in transit and at rest. AI-generated content (such as introduction drafts) is processed to provide the service and is not retained longer than necessary to deliver the feature.

We use the information we collect for the following purposes:

• Provide and Operate the Platform: To create and manage your account, facilitate connections between students and mentors, process transactions, and deliver the core services of the Platform.
• AI Matching and Recommendations: To power our AI-driven mentor matching algorithms, generate relevant mentor suggestions, and create personalized introduction drafts.
• Improve the Platform: To analyze usage patterns, diagnose technical issues, conduct research, develop new features, and enhance the overall user experience.
• Communicate with You: To send you service-related notifications, updates, security alerts, and administrative messages. With your consent, we may also send promotional communications.
• Ensure Safety and Security: To detect, investigate, and prevent fraudulent, unauthorized, or illegal activity; to enforce our Terms of Service and policies; and to protect the rights, property, and safety of our users and the public.
• Comply with Legal Obligations: To comply with applicable laws, regulations, legal processes, and governmental requests.
• Process Payments: To facilitate and process payments for subscriptions and credit purchases.

Alma uses artificial intelligence and machine learning in several aspects of the Platform. We believe in being transparent about how AI interacts with your data:

• Matching Algorithms: Our AI analyzes your profile information, goals, interests, and educational background to identify and recommend the most relevant mentor matches. This processing is essential to the core functionality of the Platform.
• Draft Generation: When you request an introduction, our AI generates a personalized draft message based on your profile and the mentor's profile. You always have the opportunity to review, edit, or rewrite the draft before sending.
• Conversation Analysis for Matching: We may analyze the topics and themes of your conversations with the AI assistant (not private messages between users) to improve the relevance of mentor recommendations.
• No Third-Party AI Training: We do not sell your personal data to third parties, and we do not provide your personal data to third-party AI companies for the purpose of training their models. When we use third-party AI services (such as OpenAI) to power certain features, your data is processed under strict data processing agreements that prohibit the use of your data for model training.

We use the following third-party services to operate the Platform. Each service provider has its own privacy policy governing how it handles your data:

• Supabase: Provides authentication, database hosting, and real-time data synchronization. Your account credentials and profile data are stored in Supabase's infrastructure with encryption at rest.
• Stripe: Handles all payment processing. When you make a purchase, your payment information is transmitted directly to Stripe and is subject to Stripe's privacy policy. We do not store your full credit card number on our servers.
• SendGrid: Used for transactional email delivery, including account verification, password resets, and service notifications. SendGrid processes your email address and message content for delivery purposes only.
• OpenAI: Powers certain AI features of the Platform, including the AI chat assistant and introduction draft generation. Data sent to OpenAI is governed by our data processing agreement with them, which prohibits the use of your data for training OpenAI's models.
• Expo: Provides push notification delivery for our mobile application. If you opt in to push notifications, Expo processes your device push token to deliver notifications. No personal data beyond the push token and notification content is shared with Expo.

We carefully vet our service providers and require them to maintain appropriate data protection standards. However, we are not responsible for the privacy practices of third-party services, and we encourage you to review their respective privacy policies.

We do not sell your personal information. We share your data only in the following circumstances:

• Service Providers: With the third-party service providers described in Section 5, solely for the purpose of operating and improving the Platform.
• Other Users: Your profile information (name, educational background, interests, bio) is visible to other verified users on the Platform as part of the mentorship matching and discovery features.
• Legal Requirements: When required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect the rights, property, or safety of Atlas IntelliTek, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, in which case your personal information may be transferred as part of the transaction. We will notify you of any such change in ownership or control.
• With Your Consent: We may share your information with third parties when you have given us explicit consent to do so.
• Aggregated or De-Identified Data: We may share aggregated or de-identified data that cannot reasonably be used to identify you, for research, analytics, or other business purposes.

We use cookies and similar tracking technologies to operate the Platform and improve your experience. For detailed information about the types of cookies we use and how to manage them, please review our Cookie Policy.

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Active Accounts: Your data is retained for as long as your account remains active and you continue to use the Platform. You may request deletion of your account and data at any time.
• Deleted Accounts: When you delete your account, we will remove your personal information from our active systems within 30 days. Some data may be retained for up to 90 days in encrypted backups, after which it is permanently deleted.
• Legal Obligations: We may retain certain data for longer periods where required by law, such as transaction records for tax and accounting purposes, or data necessary for legal claims or compliance.
• Anonymized Data: Aggregated or anonymized data that cannot be used to identify you may be retained indefinitely for analytical and research purposes.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and applicable local data protection laws:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request that we correct any personal data that is inaccurate or incomplete.
• Right to Erasure: You have the right to request deletion of your personal data, subject to certain legal exceptions (such as data we are required to retain for legal compliance).
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to Object: You have the right to object to our processing of your personal data, including for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at privacy@joinalma.ai. We will respond to your request within 30 days. You also have the right to lodge a complaint with your local data protection authority.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purposes for collection, and the categories of third parties with whom it was shared.
• Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out: You have the right to opt out of the "sale" or "sharing" of your personal information. We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive different pricing, quality of service, or access to the Platform based on exercising your rights.
• Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you.

To submit a CCPA/CPRA request, please email us at privacy@joinalma.ai or use the account settings in the Platform. We will verify your identity before processing your request and respond within 45 days.

The Platform is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and you believe your child under 13 has provided us with personal information, please contact us at privacy@joinalma.ai so that we can take appropriate action.

We take the security of your personal information seriously and implement a variety of technical and organizational measures to protect it, including:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at Rest: Personal data stored in our databases is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: We implement role-based access controls and the principle of least privilege to ensure that only authorized personnel have access to personal data.
• Regular Audits: We conduct regular security assessments and vulnerability testing to identify and address potential security weaknesses.
• Secure Authentication: We support secure authentication methods, including OAuth-based social login and JWT-based session management.

While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to maintaining industry-standard protections and promptly addressing any security incidents.

Atlas IntelliTek is based in the United States. If you access the Platform from outside the United States, please be aware that your data may be transferred to, stored, and processed in the United States or other countries where our service providers maintain facilities.

If you are located in the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission, or other legally recognized transfer mechanisms, to lawfully transfer your personal data to countries outside the EEA that do not have an adequacy decision from the European Commission.

By using the Platform, you consent to the transfer of your information to the United States and other jurisdictions as described in this Privacy Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated Privacy Policy on the Platform with a new "Last updated" date.
• Notify you by email or through an in-app notification if the changes are significant.

Your continued use of the Platform after the effective date of the revised Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this Privacy Policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For GDPR-related inquiries or to exercise your data protection rights, please direct your correspondence to our Data Protection Officer at privacy@joinalma.ai.