ALERO PRIVACY POLICY

This Privacy Policy explains how AleroCore Technologies collects, uses, stores, discloses, and protects personal information when individuals interact with Alero, Alero Core, Alero AI, aleroai.ai, and related websites, applications, portals, APIs, embedded tools, Reasoning Bars, artificial intelligence features, voice features, customer installations, connected services, and other products or services provided by Alero.

In this Privacy Policy, "Alero," "we," "us," and "our" refer to AleroCore Technologies. "Services" refers collectively to the websites, applications, APIs, Reasoning Bars, artificial intelligence features, customer portals, voice features, integrations, and related technology provided by Alero.

By accessing or using the Services, you acknowledge the data practices described in this Privacy Policy.

1. Scope of This Privacy Policy

This Privacy Policy applies to information collected through:

• Alero-owned websites, including aleroai.ai;
• The Alero Reasoning Bar;
• Customer websites that embed or use Alero;
• Alero registration, onboarding, and checkout pages;
• Customer accounts and administrative portals;
• Artificial intelligence interactions;
• Lead forms and contact forms;
• Voice, telephone, audio, transcription, and recording features;
• Alero APIs;
• Connected accounts, applications, and third-party integrations;
• Support, billing, and customer communications; and
• Other Alero products, services, and technology.

This Privacy Policy does not govern the independent privacy practices of businesses or organizations that use Alero on their own websites or systems.

When Alero is installed on a customer’s website, the customer may separately determine why and how personal information is collected. That customer is responsible for providing its own legally required privacy notices and obtaining any required consent.

2. Alero’s Privacy Roles

Depending on the circumstances, Alero may act as:

• A business or data controller when Alero determines the purposes and means of processing personal information;
• A service provider or data processor when Alero processes personal information on behalf of a customer; or
• An independent business or controller for certain purposes such as account administration, billing, fraud prevention,

security, legal compliance, and operation of Alero’s systems.

When Alero acts as a service provider or processor, the applicable customer generally determines the purpose of the processing and is responsible for its relationship with the individual whose information is processed.

3. Categories of Information We Collect

Alero may collect the following categories of personal information.

3.1 Account and Registration Information

When you register for or use an Alero account, we may collect:

• Name;
• Email address;
• Telephone number;
• Username;
• Authentication credentials;
• Account identifiers;
• Business or organization name;
• Job title or business role;
• Website address;
• Registered domain;
• Company information;
• Workspace or account settings;
• Referral information;
• Selected plan;
• Assigned widget or Reasoning Bar;
• Subscription status; and
• Other information submitted during registration or onboarding.

3.2 Business and Customer Information

We may collect information concerning a customer’s business, including:

• Business name;
• Industry;
• Products and services;
• Website content;
• Business hours;
• Prices;
• Policies;
• Offers;
• Customer service information;
• Contact details;
• Locations;
• Branding information;
• Frequently asked questions;
• Internal instructions;
• Lead-routing preferences;
• Workflow settings; and
• Other information used to configure an Alero installation.

3.3 Reasoning Bar and AI Interaction Information

When you interact with an Alero Reasoning Bar or another AI feature, we may collect and process:

• Questions;
• Prompts;
• Instructions;
• Search terms;
• Uploaded information;
• Documents or files;
• Feedback;
• Conversation history;
• Generated responses;
• Ratings;
• Interaction signals;
• Original questions submitted before registration;
• Limited webpage context;
• Page title;
• Referring URL;
• Website location where the interaction occurred; and
• Other content provided during the interaction.

3.4 Lead and Contact Information

When you submit an inquiry, request information, complete a lead form, request an appointment, or ask to be contacted, we may collect:

• Name;
• Email address;
• Telephone number;
• Company name;
• Website;
• Location;
• Service interests;
• Appointment preferences;
• Questions;
• Message content;
• Referral source;
• Communication preferences;
• Qualification information; and
• Other information included in the request.

3.5 Payment and Subscription Information

When you purchase an Alero product or service, we may collect or receive:

• Billing name;
• Billing address;
• Subscription plan;
• Setup fee;
• Renewal date;
• Payment status;
• Transaction identifier;
• Invoice information;
• Payment method type;
• Last four digits of the payment method, where provided;
• Refund information;
• Cancellation status;
• Chargeback information;
• Tax information; and
• Related billing records.

3.6 Technical and Device Information

We may automatically collect:

• IP address;
• Browser type;
• Browser version;
• Device type;
• Operating system;
• Device identifiers;
• Language settings;
• Time zone;
• Session identifier;
• Cookie identifiers;
• Referring URL;
• Pages viewed;
• Dates and times of access;
• Interaction events;
• Approximate location derived from IP address;
• Error information;
• Performance information;
• Network information; and
• Other technical data.

3.7 API and Developer Information

When customers or developers use Alero APIs, we may collect:

• API key identifiers;
• Organization or account identifiers;
• Request timestamps;
• API endpoints;
• Request and response status;
• Usage volume;
• Rate-limit information;
• Error logs;
• Security logs;
• Diagnostic information;
• Billing-related usage data; and
• Other operational information.

3.8 Voice, Audio, and Telephone Information

Where voice features are enabled, Alero may collect or process:

• Voice recordings;
• Telephone recordings;
• Audio messages;
• Caller telephone number;
• Called telephone number;
• Call date and time;
• Call duration;
• Transcripts;
• AI-generated summaries;
• Voice commands;
• Call outcomes;
• Consent or recording-notice records;
• Interaction analytics; and
• Other information provided during the call or voice interaction.

3.9 Connected Account and Integration Information

When a customer connects Alero to another service, we may collect or process:

• Connected account identifiers;
• Authorization tokens;
• Permission settings;
• Contact records;
• Leads;
• Messages;
• Emails;
• Calendar events;
• Appointment information;
• Tasks;
• Notes;
• Workflow data;
• Customer records;
• Website data;
• Account metadata;
• Information retrieved from the connected service; and
• Information written back to the connected service.

3.10 Support and Communications Information

When you contact Alero, we may collect:

• Name;
• Email address;
• Telephone number;
• Account information;
• Support requests;
• Billing inquiries;
• Cancellation requests;
• Refund requests;
• Complaint information;
• Attachments;
• Communications; and
• Information needed to investigate and respond.

3.11 Security and Fraud-Prevention Information

We may collect information used to detect or prevent fraud, abuse, misuse, unauthorized access, or security threats, including:

• Login history;
• Failed login attempts;
• IP address;
• Device information;
• Access logs;
• Risk signals;
• Usage patterns;
• Rate-limit events;
• Security alerts;
• Audit records;
• Payment-risk information; and
• Other information necessary to protect Alero and its users.

3.12 Sensitive Personal Information

Depending on how a customer configures Alero and what a user submits, Alero may process information that qualifies as sensitive personal information under applicable law.

Users should not submit the following information unless an authorized and appropriately secured Alero feature specifically requests it:

• Social Security numbers;
• Government identification numbers;
• Complete financial account credentials;
• Passwords;
• Authentication codes;
• Private encryption keys;
• Detailed medical records;
• Protected health information;
• Biometric information;
• Genetic information;
• Precise geolocation;
• Confidential legal communications;
• Trade secrets;
• Information about children; or
• Other highly sensitive information.

Passwords and similar credentials may be stored in encrypted or hashed form where technically appropriate.

Do not submit information that you are not authorized to disclose.

Information submitted through an Alero-powered lead form may be delivered to the business operating the applicable website and processed through authorized customer relationship management, communications, scheduling, and support systems.

Payment-card and bank-account information may be processed directly by an authorized payment processor. Alero does not ordinarily store complete payment-card numbers.

API keys and credentials should be kept confidential and should never be submitted through unsecured channels.

Recording and consent requirements vary by jurisdiction. Required notices or consent should be provided before or at the beginning of a recorded interaction.

Alero processes connected-account information according to the permissions granted and the functionality requested.

4. Sources of Information

Alero may collect personal information from:

• Individuals who interact with Alero;
• Customers and account administrators;
• Users of customer websites;
• Lead forms;
• Registration and checkout pages;
• Connected accounts and applications;
• Customer-provided content;
• Service providers;
• Payment processors;
• Communications providers;
• Analytics providers;
• Security providers;
• Publicly available sources;
• Referral partners;
• Other users authorized to provide information; and
• Automatically through cookies, logs, and similar technology.

5. How We Use Information

Alero may use personal information to:

• Provide, operate, maintain, and improve the Services;
• Generate artificial intelligence responses;
• Maintain conversation continuity;
• Register and manage accounts;
• Authenticate users;
• Assign and configure Reasoning Bars;
• Validate domains;
• Process subscriptions and payments;
• Deliver requested information;
• Route leads;
• Schedule appointments;
• Support customer communications;
• Operate connected services;
• Create or update records;
• Provide customer support;
• Respond to requests;
• Process cancellations and refunds;
• Detect and prevent fraud;
• Protect system security;
• Enforce usage limits;
• Monitor performance;
• Diagnose errors;
• Develop new features;
• Improve reliability and safety;
• Conduct analytics;
• Maintain audit records;
• Comply with legal obligations;
• Enforce agreements;
• Establish or defend legal claims;
• Protect users and third parties; and
• Complete a merger, financing, acquisition, reorganization, or sale of assets.

6. Reasoning Bar and Artificial Intelligence Processing

Alero uses artificial intelligence systems to generate responses based on information submitted by users and information made available through the applicable customer configuration.

AI systems generate outputs probabilistically. Responses may be inaccurate, incomplete, outdated, misleading, or inappropriate.

Alero may process prompts, responses, conversation history, limited page context, technical information, and interaction signals to provide the requested service.

Where Alero appears on a customer’s website, the customer may receive or access information related to interactions with its Alero installation.

Users should independently verify important information before relying on an AI-generated response.

7. Lead Capture and Customer Websites

When an individual uses an Alero-powered feature on a customer website, information may be processed by:

• Alero;
• The customer operating the website;
• Authorized customer relationship management platforms;
• Communications providers;
• Scheduling providers;
• Hosting providers;
• Analytics providers;
• Support providers; and
• Other authorized service providers.

The applicable customer may use lead information to:

• Respond to an inquiry;
• Contact the individual;
• Provide requested services;
• Schedule an appointment;
• Evaluate eligibility;
• Manage customer relationships;
• Conduct follow-up communications;
• Maintain records; or
• Perform other purposes disclosed by the customer.

Alero does not control how an independent customer uses personal information after it is delivered to that customer.

Individuals should review the privacy policy of the website or business with which they are interacting.

8. Registration, Subscriptions, and Payments

Alero may use registration and billing information to:

• Create and administer accounts;
• Confirm subscription selections;
• Assign features;
• Process setup and implementation;
• Verify payment status;
• Process renewals;
• Manage upgrades and downgrades;
• Process cancellations;
• Review refund requests;
• Address billing disputes;
• Prevent fraud;
• Maintain tax and financial records; and
• Enforce applicable agreements.

Complete payment-card information is generally processed by an authorized third-party payment processor.

The payment processor’s privacy policy and terms may also apply.

9. Voice, Audio, Recording, and Transcription

Where voice features are enabled, interactions may involve an artificial or computer-generated voice rather than a human representative.

Where permitted by law and after any required notice or consent, voice interactions may be:

• Recorded;
• Transcribed;
• Analyzed;
• Summarized;
• Retained;
• Reviewed; or
• Used to perform requested actions.

Alero may use voice and call information to:

• Provide the service;
• Respond to requests;
• Maintain records;
• Improve quality;
• Evaluate performance;
• Detect fraud;
• Maintain security;
• Support customers; and
• Comply with legal obligations.

AI-generated transcripts and summaries may contain errors. Important names, numbers, dates, commitments, prices, and transaction details should be independently confirmed.

10. Connected Services and Automated Actions

Alero may connect to customer relationship management systems, communications platforms, calendars, scheduling systems, payment services, websites, databases, and other external services.

Depending on the permissions granted, Alero may:

• Retrieve information;
• Create records;
• Route leads;
• Draft communications;
• Send communications;
• Schedule appointments;
• Create tasks;
• Update records;
• Trigger workflows;
• Transfer information; or
• Perform other authorized actions.

Customers are responsible for reviewing permissions, limiting access appropriately, monitoring connected systems, and revoking access when it is no longer needed.

The connected service’s privacy policy and terms also apply.

11. AI Model Training and Service Improvement

Alero may use prompts, inputs, responses, feedback, technical information, interaction signals, and limited contextual information to evaluate and improve the quality, reliability, relevance, security, and safety of Alero’s systems.

Improvement activities may include:

• Evaluating model performance;
• Measuring error patterns;
• Developing evaluation datasets;
• Improving instruction-following;
• Improving relevance;
• Strengthening safety controls;
• Detecting abuse;
• Preventing fraud;
• Improving system performance; and
• Developing new functionality.

Alero may use automated methods and authorized human review for these purposes.

Alero uses measures intended to reduce unnecessary personal information in improvement workflows, which may include filtering, redaction, access controls, de-identification, and suppression rules.

Where available, customers or users may request that eligible future content not be used for model-training or improvement activities beyond what is necessary to provide, secure, and operate the Services.

Requests may be submitted to info@alerocore.com.

An approved limitation generally applies prospectively. It may not remove information from models, derived datasets, or artifacts already created where removal is not technically feasible or would be disproportionate.

Alero may continue processing information where necessary for:

• Service delivery;
• Security;
• Fraud prevention;
• Abuse prevention;
• Legal compliance;
• Recordkeeping; or
• Core system functionality.

Third-party AI providers may process information to generate requested outputs and support service reliability and safety.

Alero’s intent is that authorized providers do not use Alero data to train their independent models unless such use is expressly authorized and documented.

12. Cookies and Similar Technologies

Alero may use cookies, local storage, pixels, software development kits, server logs, and similar technologies to:

• Maintain sessions;
• Authenticate users;
• Remember preferences;
• Protect security;
• Prevent fraud;
• Measure usage;
• Diagnose errors;
• Analyze performance;
• Improve functionality; and
• Support communications and marketing where permitted.

Some cookies are necessary for operation of the Services. Others may be used for analytics, preferences, or other purposes.

Third-party services may also place or access cookies in accordance with their own policies.

Where required, Alero will provide an appropriate cookie notice or consent mechanism.

13. Do Not Track and Privacy Preference Signals

Some browsers offer a “Do Not Track” setting. Because there is not a uniform industry standard for responding to traditional Do Not Track signals, Alero may not respond to those signals unless required by law.

Where required by applicable law and supported by Alero’s systems, Alero will process recognized opt-out preference signals, including Global Privacy Control.

Alero does not sell personal information or share personal information for cross-context behavioral advertising as those terms are defined under applicable California law.

14. How We Disclose Information

Alero may disclose personal information to the following categories of recipients.

14.1 Customers

When Alero is installed on a customer’s website, Alero may disclose relevant interaction, lead, account, or performance information to that customer.

14.2 Service Providers and Contractors

Alero may disclose information to providers that support:

• Artificial intelligence processing;
• Hosting;
• Cloud infrastructure;
• Customer relationship management;
• Communications;
• Scheduling;
• Payment processing;
• Analytics;
• Logging;
• Security;
• Monitoring;
• Customer support;
• Data storage;
• Development;
• Auditing; and
• Professional services.

14.3 Connected Services

Information may be disclosed to connected applications and external systems according to the permissions authorized by the customer or user.

14.4 Legal and Safety Disclosures

Alero may disclose information when reasonably necessary to:

• Comply with law;
• Respond to lawful requests;
• Enforce agreements;
• Protect legal rights;
• Prevent fraud;
• Investigate security incidents;
• Protect users;
• Protect the public;
• Respond to emergencies; or
• Defend legal claims.

14.5 Business Transactions

Information may be transferred in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction.

14.6 With Consent or Direction

Alero may disclose information when the individual directs or authorizes the disclosure.

These providers are expected to process information only for authorized purposes and subject to appropriate contractual or legal restrictions.

15. No Sale or Cross-Context Behavioral Advertising

Alero does not sell personal information.

Alero does not share personal information for cross-context behavioral advertising as those terms are defined under applicable California privacy law.

If Alero’s practices materially change, this Privacy Policy and any required point-of-collection disclosures will be updated before the new practice is implemented where required by law.

16. De-Identified and Aggregated Information

Alero may aggregate or de-identify information so that it cannot reasonably be associated with an individual.

Alero may use de-identified or aggregated information for:

• Analytics;
• Research;
• Performance measurement;
• Service improvement;
• Security;
• Business planning; and
• Other lawful purposes.

Where required, Alero will take reasonable measures to prevent de-identified information from being reidentified.

17. Automated Processing and Significant Decisions

Alero uses automated systems to generate responses, route leads, organize information, trigger workflows, detect fraud, support communications, and perform other operational functions.

Alero does not intend to use automated systems as the sole basis for decisions that produce legal or similarly significant effects concerning an individual without appropriate safeguards.

Customers should not use Alero as the sole basis for significant decisions involving:

• Employment;
• Housing;
• Credit;
• Lending;
• Insurance;
• Education;
• Healthcare;
• Legal rights;
• Public benefits;
• Professional licensing;
• Safety; or
• Access to essential services.

Where required by applicable law, individuals may have rights relating to certain automated decision-making activities, including rights to receive information, opt out, request human review, or appeal a decision.

18. Data Minimization and Purpose Limitation

Alero seeks to collect and process personal information that is reasonably necessary and proportionate to the purposes described in this Privacy Policy.

Alero does not intend to use personal information for materially incompatible purposes without providing additional notice or obtaining consent where required.

19. Data Retention

Alero retains personal information for as long as reasonably necessary to:

• Provide the Services;
• Maintain accounts;
• Complete transactions;
• Support customers;
• Fulfill customer instructions;
• Improve system performance;
• Protect security;
• Prevent fraud;
• Resolve disputes;
• Enforce agreements;
• Maintain business records; and
• Comply with legal obligations.

Retention periods may vary based on:

• The category of information;
• The purpose of collection;
• Account status;
• Customer instructions;
• Contractual requirements;
• Security needs;
• Legal obligations;
• Dispute history;
• Backup cycles;
• Technical feasibility; and
• Whether the information has been aggregated or de-identified.

Different retention periods may apply to:

• Account records;
• Billing records;
• Prompts and responses;
• Lead information;
• API logs;
• Security logs;
• Voice recordings;
• Transcripts;
• Connected-service records;
• Customer configuration data;
• Support communications;
• Backups; and
• Model-improvement artifacts.

Alero may retain information longer when required by law, necessary to prevent fraud, needed to preserve evidence, or reasonably required to establish or defend legal claims.

20. Security

Alero uses administrative, technical, and organizational safeguards designed to protect personal information.

These safeguards may include:

• Encryption in transit;
• Access controls;
• Authentication systems;
• Role-based permissions;
• Audit logging;
• Monitoring;
• Rate limiting;
• Security testing;
• Incident response procedures;
• Vendor controls; and
• Employee or contractor access restrictions.

No electronic system, transmission method, or storage environment can be guaranteed to be completely secure.

Users and customers are responsible for protecting their passwords, API keys, devices, accounts, and access credentials.

21. Security Incidents

If Alero becomes aware of a security incident involving personal information, Alero may:

• Investigate the incident;
• Contain the issue;
• Mitigate harm;
• Restore systems;
• Notify affected customers;
• Notify affected individuals;
• Notify regulators; and
• Take other actions required by applicable law.

The nature and timing of any notification will depend on the circumstances and applicable legal requirements.

22. International Data Transfers

Alero and its service providers may process or store information in the United States and other jurisdictions.

Privacy laws in those locations may differ from the laws where an individual resides.

Where required, Alero may use contractual, organizational, or technical safeguards designed to protect personal information transferred across borders.

23. California Privacy Rights

Depending on applicable law and Alero’s legal status, California residents may have the right to:

• Know the categories of personal information collected;
• Know the categories of sources;
• Know the purposes for collection and use;
• Know the categories of recipients;
• Access specific pieces of personal information;
• Request deletion;
• Request correction;
• Obtain a portable copy of certain information;
• Opt out of the sale of personal information;
• Opt out of sharing for cross-context behavioral advertising;
• Limit certain uses of sensitive personal information;
• Receive information about certain automated decision-making activities;
• Use an authorized agent;
• Appeal certain request decisions where required; and
• Receive equal service without unlawful discrimination for exercising privacy rights.

Alero does not sell personal information or share it for cross-context behavioral advertising.

Requests may be submitted to info@alerocore.com.

A request should include enough information to identify the requester and describe the requested action. Alero may verify identity or authority before processing a request.

Alero may deny or limit a request where permitted by law, including when information must be retained for security, fraud prevention, legal compliance, contractual obligations, or the rights of another person.

24. Other U.S. Privacy Rights

Residents of other U.S. states may have privacy rights depending on applicable law, including rights to:

• Access;
• Correct;
• Delete;
• Obtain a copy;
• Opt out of certain targeted advertising;
• Opt out of certain sales;
• Opt out of certain profiling;
• Appeal a denied request; and
• Use an authorized agent.

Alero will evaluate requests according to the law applicable to the requester and Alero.

25. European and International Privacy Rights

Depending on location and applicable law, individuals may have rights to:

• Access personal data;
• Correct inaccurate data;
• Request deletion;
• Restrict processing;
• Object to processing;
• Obtain data portability;
• Withdraw consent;
• Lodge a complaint with a supervisory authority; and
• Receive information about certain automated decisions.

Where required, Alero relies on legal bases such as:

• Performance of a contract;
• Legitimate interests;
• Consent;
• Compliance with legal obligations; and
• Protection of legal rights.

Withdrawal of consent does not affect processing lawfully completed before withdrawal.

26. Privacy Requests and Verification

Privacy requests may be submitted to info@alerocore.com.

The request should include:

• Name;
• Email address;
• Account or business information, if applicable;
• State or country of residence;
• Type of request; and
• Information reasonably needed to locate relevant records.

Alero may require verification to protect personal information from unauthorized access or deletion.

Authorized agents may submit requests where permitted by law. Alero may request proof that the agent is authorized to act for the individual.

Alero will respond within the period required by applicable law.

27. Appeals

Where applicable law provides an appeal right, an individual may appeal a denied privacy request by replying to the decision or contacting info@alerocore.com.

The appeal should explain why the individual believes the decision should be reconsidered.

28. Children and Age Requirements

Alero’s general website and business services are not directed to children under 13.

Alero does not knowingly collect personal information directly from children under 13 without legally required parental authorization.

Individuals under 18 should use Alero only with the permission and appropriate supervision of a parent, legal guardian, school, organization, or other responsible adult where permitted by law.

A person must be at least 18 years old and legally capable of entering into a binding agreement to purchase an Alero subscription, create a business account, or accept contractual terms on behalf of an organization.

If Alero learns that personal information was collected from a child in violation of applicable law, Alero may take reasonable steps to delete or restrict the information.

29. Third-Party Websites and Services

The Services may contain links to or integrate with third-party websites, applications, platforms, or services.

Alero does not control the privacy, security, or data practices of independent third parties.

Users should review the privacy policies and terms of any third-party service they use.

30. Customer Responsibilities

Customers using Alero are responsible for:

• Providing required privacy notices;
• Obtaining required consent;
• Configuring the Services lawfully;
• Limiting data collection;
• Maintaining accurate customer information;
• Managing user permissions;
• Protecting credentials;
• Responding to privacy requests where applicable;
• Complying with recording laws;
• Complying with communications laws;
• Complying with children’s privacy laws;
• Complying with professional obligations; and
• Using appropriate human review for significant decisions.

A customer’s failure to meet its privacy obligations does not transfer those obligations to Alero except where required by law or expressly agreed in writing.

31. Changes to This Privacy Policy

Alero may update this Privacy Policy from time to time.

The “Last Updated” date identifies the most recent published version.

Material changes will apply prospectively unless applicable law permits or requires otherwise.

Where required, Alero may provide additional notice before a material change becomes effective.

Continued use of the Services after an updated Privacy Policy becomes effective constitutes acknowledgment of the revised Policy to the extent permitted by law.

32. Contact Information

Questions, complaints, privacy requests, and concerns regarding this Privacy Policy may be directed to:

AleroCore Technologies Email: info@alerocore.com Mailing Address: 5757 West Century Blvd, Suite 120 Los Angeles, California 90045 Website: aleroai.ai