Privacy notice

01Who we are

We Are Aldo Inc. (“aldo”, “we” or “us”) is a corporation incorporated in Delaware, United States. aldo is business software that helps companies define, track and align their strategy. This notice explains what personal data we process, why we use it, who we share it with and what rights people have. aldo’s address is available on request at compliance@wearealdo.com.

In this notice, “Customer” means the company or organization that contracts aldo. “User” means a person the Customer gives access to the app. “Service” means the website and the app together.

02Controller and processor

aldo processes personal data in two different roles.

• As a processor. This covers the data that the Customer and its Users upload to or connect with the app (“Customer Data”). The Customer decides what data to upload and for what purpose. aldo processes it on the Customer’s behalf and under its instructions.
• As a controller. This covers the account data we use to provide access, support and protect the Service. It also covers website browsing data and business contact data.

When aldo acts as a processor, the Customer must inform its Users and have a legal basis for the processing. Requests about Customer Data are handled together with the Customer, as described in section 13.

03Data we process

• Account and profile data. Name, work email, job title, department, and role and permissions in the app. Also a profile photo, when one is available. The Customer usually creates the account or sends the invitation.
• Sign-in data. If a person signs in with a Microsoft or Google account, we receive basic profile data from that account: name, email, an identifier and, when available, a profile photo.
• Customer Data. The strategy the Customer uploads: perspectives, objectives, indicators, targets and cause-and-effect links. Also the periodic follow-up: indicator values, comments and forecasts. It includes the assignment of owners to people, teams and departments. This data may contain personal data, such as the name of an indicator owner or the text of a comment.
• Integration data. The data the Customer chooses to bring in from other tools to calculate its indicators. Section 5 explains this.
• Technical and usage data. We record basic technical information about use of the Service, such as IP address, browser and device type, and date and time of access. We use it to operate the Service, keep it secure and improve it.
• Business contact data. When someone books a meeting or writes to aldo: name, email, company, job title and any information they choose to share.

aldo does not ask for sensitive personal data. We ask the Customer not to upload sensitive data to the app unless it is necessary and the Customer has a legal basis to do so.

04How we use data

We use data for these purposes:

• To provide the Service. Create and manage accounts, authenticate Users, display and calculate indicators, and send Service invitations and notifications.
• To provide support. Answer questions, requests and issues.
• To protect the Service. Prevent fraud, abuse and unauthorized access, and diagnose errors.
• To improve the Service. Understand, in aggregate, how the website and the app are used.
• To manage the business relationship. Respond to inquiries, schedule meetings, manage contracts and billing, and send communications about the Service.
• To comply with the law. Meet legal obligations and establish, exercise or defend legal claims.

Depending on the applicable law, each purpose relies on one or more of these bases:

• Performance of the contract with the Customer, or steps taken before entering into it.
• Our legitimate interest in operating, protecting and improving the Service.
• Compliance with legal obligations.
• Consent, where the law requires it.

We process Customer Data only to provide the Service to the Customer and under its instructions. We do not sell personal data or use it for third-party advertising.

05Tools the Customer connects

The Customer can connect aldo to third-party tools it already uses, for example its CRM, spreadsheets or ERP, to bring data into its indicators.

• The Customer, or a User allowed to do so, authorizes each connection.
• aldo uses the connection only to obtain the data needed by the indicators the Customer sets up.
• Each connected tool is also subject to its provider’s terms and privacy policy.

For Microsoft 365 and the other connected tools, aldo accesses only the data needed for the feature the Customer requests, and only at the Customer’s request. The Customer can revoke that access at any time.

How to disconnect. The Customer can disconnect a tool from within aldo. It can also remove the permission in its account settings for that tool, for example on the permissions page of its Google account. After a disconnection, aldo stops accessing that tool and the linked indicators stop updating. Values already obtained remain part of the Customer’s history. Those values are kept as described in section 11, unless the Customer asks us to delete them.

06Google user data

This section describes how aldo handles data it receives from Google.

What data we access.

• Sign in with Google. Name, email, account identifier and profile photo.
• Google Sheets. aldo only accesses the Google files the person explicitly chooses, and only the content of those files it needs to display their indicators. aldo does not access the person’s other files.

How we use it. We use sign-in data to identify the account and provide access. We use the content of the selected sheets to display and calculate indicators inside aldo, for the Customer. We do not use this data for advertising.

Where we store it. We store this data in the Service’s systems, hosted with our cloud service providers.

Who we share it with. Only with the providers needed to operate the Service, acting as subprocessors, or when the law requires it. We never share it with advertisers or data brokers, and we do not use it for advertising.

How to revoke access. The person can disconnect the tool from within aldo or remove the permission on the permissions page of their Google account. Section 5 describes what happens after a disconnection.

aldo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

07Features that use artificial intelligence

Some aldo features may use artificial intelligence providers to process Customer Data on the Customer’s behalf. Some of these features are offered as early access and may change. In those cases, the provider acts as aldo’s subprocessor and processes the data to deliver the feature the Customer uses.

08Cookies and similar technologies

We use cookies and similar technologies that are needed to keep the session active and remember the person’s preferences, such as language and visual theme. We also use analytics tools to measure website usage in aggregate. We do not use advertising cookies. A person can block or delete cookies in their browser. If they block the necessary cookies, they will not be able to sign in to the app.

09Who we share data with

We do not sell personal data. We share data with providers that help us deliver the Service, acting as processors or subprocessors. These are the main categories:

• Hosting and cloud service providers.
• Database and authentication providers.
• Email delivery providers, for invitations and notifications.
• Providers that enable connections with other tools.
• Artificial intelligence providers, for the features that use it.
• Analytics tools.
• Scheduling and video call tools, for business meetings.

These providers process data on aldo’s behalf, to deliver their services, under confidentiality and security commitments. The list of subprocessors is available on request at compliance@wearealdo.com.

We may also share data in these cases:

• Within the Customer’s organization. Users of the same Customer see information according to the roles and permissions the Customer defines.
• Professional advisers. Lawyers, auditors and accountants, under a duty of confidentiality.
• Authorities. When the law, a court order or legal process requires it.
• Corporate transactions. In a merger, acquisition or sale of assets, with the obligation to honor this notice.
• With instructions or consent. When the Customer or the person asks us to.

10International transfers

aldo and several of its providers operate in the United States and other countries. As a result, data may be processed outside the country where the person lives. Those countries may have different data protection laws. We apply reasonable safeguards to these transfers, such as contractual commitments with our providers. Where appropriate, we use the transfer mechanisms recognized by the applicable law.

11Retention

We keep data for as long as the relationship with the Customer lasts or the account is active. After that, we keep it as long as needed to meet legal obligations, resolve disputes and enforce agreements.

• Customer Data. When the relationship ends, the Customer can request an export of its data. aldo then deletes or anonymizes it within a reasonable period, under the contract with the Customer. Backup copies are deleted in their ordinary cycle.
• Business contact data. We keep it while it is useful for the business relationship or until the person asks us to delete it.
• Technical and usage data. We keep it as long as needed to operate and protect the Service.

12Security

We apply reasonable technical and organizational measures to protect data against loss, misuse and unauthorized access. Access to data inside the app is controlled by roles and permissions. No system is completely secure. If an incident affects personal data, we will notify those who need to be notified, as required by applicable law and the contract with the Customer. Each User is responsible for protecting their sign-in credentials.

13Your rights

Depending on the applicable law, people can exercise these rights over their personal data:

• Access their data.
• Correct inaccurate or incomplete data.
• Ask for their data to be deleted.
• Object to processing.
• Receive their data in a portable format.
• Withdraw consent, where processing is based on it.

To exercise them, write to compliance@wearealdo.com. We may ask for information to verify the identity of the person making the request. We respond within the time limits set by the applicable law.

If the request concerns Customer Data, aldo acts as a processor. In that case, it is best to contact the organization’s administrator first. If the request reaches aldo, we forward it to the Customer or handle it together with the Customer.

People can also file a complaint with the competent data protection authority. Exercising these rights will not lead to unfavorable treatment.

14Children

The Service is meant for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from minors. If we learn that we received data from a minor, we will delete it. Anyone with information about this can write to compliance@wearealdo.com.

15Changes to this notice

We may update this notice. Each version is published on this page with its last updated date. If a change is significant, we will give notice by reasonable means, such as a notice in the Service or an email.

16Contact

For privacy and data protection matters, including exercising rights, write to compliance@wearealdo.com. For general questions, write to contact@wearealdo.com. We Are Aldo Inc. is a corporation incorporated in Delaware, United States. Its address is available on request at compliance@wearealdo.com.