Privacy Policy.

1. Who We Are

Data Controller: Aletheias
Contact email: info@aletheias.live

As Aletheias is established in the European Union, the General Data Protection Regulation (GDPR) applies. Aletheias has not appointed a formal Data Protection Officer. For any privacy-related matters, you may contact us at the email address above.

2. What Personal Data We Collect

When you create an account or use the Platform, we may collect:

Account and Profile Data

• Account identifiers (email address, mobile phone, username, account status)
• Profile information (name, bio, profile photo, languages, areas of expertise)
• Ratings and reviews

Session and Communication Data

• Session metadata (date, time, duration, connection logs)
• Messages exchanged through the Platform (where applicable)
• Technical logs related to call or chat connectivity
• Aletheias does not routinely monitor or review the content of live sessions or private communications. Content is processed solely to enable the delivery of the Services and to ensure platform security and technical reliability.

Payment and Transaction Data

• Transaction records and payment status
• Payment information processed by third-party payment providers (Aletheias does not store full payment card details)

Usage and Technical Data

• IP address, including its use for approximate geographic information
• Anonymous browser, device or client identifiers stored through cookies or local storage
• Browser type, device type, operating system and general technical characteristics
• Page URLs or paths, referrer and campaign/attribution information
• Page views, clicks, scrolling, element and form interactions, successful or failed conversion events, dead clicks and rage clicks
• Consented Session Replay data showing how visitors interact with pages

Analytics events are not deliberately sent with names, email addresses, message contents, application answers or other submitted form-field values. Session Replay masks on-screen text and input fields by default, and the contact and advisor application forms are additionally blocked from replay capture.

3. How We Use Your Data

We process personal data for the following purposes and legal bases:

4. Cookies and Tracking Technologies

Aletheias uses cookies and similar technologies to operate the Platform and to understand how visitors use it. We rely on Iubenda to collect and manage cookie and measurement preferences.

Based on those preferences, we may use the following analytics tools:

• Mixpanel for product analytics, Autocapture and Session Replay. Mixpanel records how visitors interact with pages (for example, mouse movements, clicks, scrolling and page transitions) only when Measurement consent has been granted.
• Google Analytics 4 for audience, acquisition, page-view and successful-submission measurement. Google Analytics 4 is loaded only when Measurement consent has been granted and is restricted to production hostnames.

Neither Mixpanel nor Google Analytics 4 is loaded until the visitor grants the Iubenda Measurement purpose. For Google Analytics 4, advertising storage, advertising user data and advertising personalisation remain disabled; Aletheias does not use this implementation for targeted advertising.

Consent can be withdrawn or changed at any time through the cookie-preferences interface. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and refusing analytics consent does not prevent access to the public website.

For full details, see our Cookie Policy.

5. Data Storage and Retention

Personal data is stored on secure servers operated by its service providers. Server locations may be within or outside the European Union, depending on the infrastructure used at any given time.

We retain personal data only for as long as necessary for the purposes described in this Policy, including:

• Account and profile data: for the duration of your account and for a reasonable period thereafter for legal and compliance purposes
• Transaction and financial records: as required by applicable accounting and tax laws
• Session and communication metadata: retained for limited periods in accordance with operational and legal requirements
• Waitlist data: deleted within a reasonable period after launch if no ongoing consent exists
• Session-related communication metadata and chat logs are retained for up to thirty (30) days, unless a longer retention period is required by law or for the establishment, exercise, or defense of legal claims.
• Transaction and payment-related records are retained for the periods required by applicable accounting and tax laws. Refund-related data is processed in accordance with the Refund and Credit Policy, including applicable fourteen (14) day refund periods.
• Mixpanel Session Replays are retained for up to 30 days under the current standard retention.
• Analytics events and identifiers are kept only for the periods configured in the relevant provider account and as long as reasonably necessary for measurement, trend analysis, security, diagnostics and legal obligations.
• Cookie and browser-storage durations are detailed in the Cookie Policy.
• Data is deleted or anonymised when no longer needed, subject to technical backup cycles and legal obligations.

6. Data Sharing

We may share limited personal data with trusted third-party service providers, including:

• Payment processors (e.g., Stripe or equivalent)
• Communication and infrastructure providers (for voice, chat, and hosting)
• Mixpanel (product analytics, Autocapture and Session Replay) and Google (Google Analytics 4). These analytics service providers act on our behalf and do not receive deliberately submitted form contents through Aletheias’ manual analytics events.
• Analytics and monitoring providers (for platform performance and reliability)

All service providers are contractually required to process personal data in accordance with GDPR or equivalent data protection standards.

We do not share personal data with third parties for advertising or resale purposes.

7. International Data Transfers

Some of our service providers and subprocessors are located outside the European Economic Area (EEA). When personal data is transferred outside the EEA, such transfers are safeguarded by appropriate legal mechanisms, such as:

• Adequacy decisions, including the EU–US Data Privacy Framework where applicable
• Standard Contractual Clauses approved by the European Commission
• Other GDPR-compliant transfer mechanisms, where applicable

Mixpanel event ingestion is configured to use its EU endpoint; however, Mixpanel, Google or their subprocessors may still process or access limited data outside the EEA. Information about the safeguards used for a specific transfer can be requested at info@aletheias.live.

8. Automated Decision-Making and Profiling

Aletheias may use automated processes to support platform functionality (e.g., matching, ranking, or recommendations). These processes do not produce legal or similarly significant effects on Users. You may contact us if you wish to object to certain forms of automated processing, where applicable.

9. Your Rights under GDPR

You have the right to:

• Access your personal data
• Rectify inaccurate or incomplete data
• Request deletion (“right to be forgotten”)
• Request restriction of processing
• Object to certain processing activities
• Request data portability
• Withdraw consent at any time

You may exercise these rights by contacting us at any time. Analytics data is optional; refusing analytics consent does not prevent you from using the public website.

Where form or account information is required to respond to a request, process an application, provide requested services or enter into a contract, failure to provide that information may prevent us from taking the corresponding action.

To exercise these rights, contact info@aletheias.live. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) or your local supervisory authority.

10. Security

Aletheias implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure. Communications and transactions are protected using industry-standard encryption (e.g., TLS/SSL).

11. Marketing and Communications

Aletheias does not send marketing newsletters by default. You may receive service-related communications (e.g., account notifications, security alerts).

12. Children’s Privacy

The Platform is not intended for individuals under 18 years of age. Aletheias does not knowingly collect personal data from minors.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform or website, and the “Last updated” date will be revised accordingly.

14. Contact Us

For questions, requests, or concerns regarding this Privacy Policy or your personal data, contact:

info@aletheias.live