Privacy Policy

Scope and who is responsible

This Privacy Policy describes ALCO USA Inc.’s (“ALCO,” “we,” “us” or “our”) processing through alcohq.com, access.alcohq.com, tools.alcohq.com, status.alcohq.com, ALCO-provided hosting control panels including cPanel, WHM and Webmail, and ALCO billing flows using Stripe. It also covers ALCO-operated legacy or compatibility pages on alcousa.org that link here (together, the “Sites and Systems”; “Site” below includes the applicable system).

You can reach us at info@alcohq.com, at +1 (208) 391-7176, or through our contact form. Privacy requests are reviewed by ALCO and routed to the appropriate person.

Which system are you using?

ALCO’s role and your organization’s role

ALCO determines how it uses its own enquiry, account-administration, billing and security records. When we host or support personal information on a client’s behalf, the client normally decides why that information is processed and ALCO acts under the applicable service agreement and instructions. Your employer or organization may administer your access and view service information within its authorized permissions. This Policy does not replace that organization’s privacy notice.

Customer-owned websites are not ALCO websites merely because ALCO hosts them. Direct requests concerning their content or users to the relevant organization; ALCO can help route a request when we process the information on its behalf.

Information we collect

We do not ask for passwords, private keys, payment-card data, protected health information or similarly sensitive material through public forms. Please do not place that information in a general website form. Ask us for an approved secure delivery method if it is genuinely needed.

ALCO Access and support records

Access is ALCO’s account and service workspace. Depending on your organization and permissions, it handles contact and organization details, support requests and email replies, ticket history, attachments, notes, assets, service documentation, agreements and invoice or payment references. Sign-in and account recovery also use authentication, session and audit records to verify users and prevent unauthorized access. Where Google or Microsoft sign-in is offered, the identity provider exchanges an account identifier, email and basic profile information with ALCO to authenticate and match the account. Email or any enabled text-message verification also uses the relevant delivery provider; the sign-in choice does not grant access to unrelated ALCO client records.

Information you submit in a ticket can be available to ALCO staff and authorized people in your organization according to their access rights. Configured support emails can include your ticket subject, details, organization and a ticket reference or link, and are handled by the relevant mail-delivery services and authorized recipients. Submit only material you are entitled to share. Avoid putting passwords, access tokens, private keys or full payment details in ticket text or ordinary attachments; ask ALCO for the approved secure method.

Where incident escalation is configured, Mission Critical tickets and related updates can send selected ticket subject/details, organization name or reference, ticket link, status and timing to Better Stack for incident handling. These operational notifications are separate from public status publication; not every ticket is sent or published.

Links from Access may open hosting, scheduling, status or Stripe systems. An authorized single-sign-on or billing handoff can use your account and service identifiers to establish the requested destination session. The destination has its own session, security and privacy controls. Signing out or changing analytics choices on one system does not necessarily sign you out or change settings on another.

AI assistance, chat and learning content

Ask ALCO chat. The public website assistant, also embedded on Access and Tools, asks for your name, email and an optional phone number. The HQ server generates chat replies from ALCO’s prepared response library. When you submit your details to start chat, ALCO records them in an Access ticket. Accepted messages and assistant replies are added to that ticket. Contact forms and pricing enquiries submitted during the same website visit are recorded on the same ticket. Recorded tickets may also be processed by the support AI-summary feature described below.

The assistant keeps admission and security state in a server session. A separate secure, host-only session cookie connects these deliberate submissions across HQ and the shared chat on Access and Tools. A visit ends after 30 minutes without a saved submission or after four hours. Chat admission lasts 30 minutes. Ending chat resets its admission state but does not delete the Access ticket or saved conversation; those follow the support-record retention below. The displayed conversation and interface preferences also use browser memory or session storage. Technical rate-limit records help prevent abuse.

AI summaries. ALCO uses Google Gemini to summarize published pages and relevant service records. Public summaries use public source content. Training summaries use the published page text; they do not analyze the video or a transcript. Ticket summaries use selected ticket details and replies; a staff summary can include internal notes, while a client-facing summary excludes them. Ticket attachments are not part of the current summary input. ALCO limits and filters the selected text, but this is not a guarantee of anonymization: personal or confidential information in the source can remain.

Relevant source text is sent to Google for summary generation, and ALCO stores the generated result and associated source/version metadata. Google’s processing is subject to the applicable Gemini API terms and data-processing terms. Provider retention is separate from ALCO’s cached summary; this notice does not promise zero provider retention or a particular processing country.

AI results can be incomplete or wrong. Ask ALCO for human review or correction before relying on a consequential result. A summary does not approve work, change an agreement or make a final decision about your rights. Chat, authentication, support recordkeeping and AI-summary processing are separate from optional website analytics; declining analytics does not delete service records or disable these requested service functions.

Training videos. Published training pages can load YouTube thumbnails and a YouTube privacy-enhanced player. Requests for those assets disclose technical information such as IP address and browser details to Google/YouTube; playback can involve additional identifiers and storage under Google’s policies. Privacy-enhanced mode does not make playback anonymous or eliminate every request. The current video-coming-soon example does not load a YouTube player. See Google’s Privacy Policy.

ALCO Tools: processing on your device

ALCO Tools provides utilities designed to process the text, numbers and files you select in your browser. Published browser-based tools do not upload those inputs to an ALCO processing server and do not automatically fall back to server processing. Results are created locally; copying or downloading a result is an action you choose. We do not create a server-side library of your tool inputs or outputs.

This describes the tool operation, not every network request made by the page. Your browser still downloads the website and its assets, and normal hosting, Cloudflare security and status-indicator requests can process technical visit data. Browser extensions, device backups, downloads and clipboard history are controlled by your device and their providers.

Inputs and results normally remain in the active page’s memory until the page is cleared or closed; your browser may restore page state, and files you download or copy remain under your control. Tools remembers its analytics preference locally. On the home page, category directories and sitemap, Google Analytics and Microsoft Clarity load only after you accept on Tools. They do not load on individual tool pages, pages with a tool workspace, or URLs containing a query string or fragment. Directory measurement uses a generic page title and no referrer; Clarity is instructed to mask page text. Accepting analytics is not permission to upload tool content. Unavailable tools and unsupported or oversized jobs may show a limitation instead of processing.

ALCO Status and service notifications

ALCO Status is operated by ALCO on its existing hosting. It publishes automated service checks and recorded interruptions. Normal hosting and Cloudflare security requests process technical visit data. The page uses the same privacy choices as ALCO HQ; the status indicator refreshes from ALCO’s own service-status endpoint.

The current status page does not offer notification subscriptions. For an account-specific issue, contact ALCO through your agreed support channel.

Status information is operational information, not a guarantee that every individual service or account is unaffected. For an account-specific issue, use your agreed support channel.

cPanel, WHM, Webmail and hosted systems

ALCO uses hosting control panels to provide authorized website, domain, DNS, mail, database, certificate, backup and server administration. Relevant information can include account names and contacts, domains, configuration, website files, database contents, mailboxes, access and mail logs, resource usage, and administrative or security events. ALCO accesses this information as needed for the authorized service, troubleshooting, maintenance, security and applicable obligations.

cPanel, WHM and Webmail use their own sign-in sessions and security controls. WebPros/cPanel licensing, updates, support and enabled extensions may process system, license, diagnostic or support information. Optional product or interface analytics have their own controls where offered; the ALCO website cookie popup does not manage them. See the WebPros/cPanel Privacy Policy and cPanel analytics information.

Hosted content can contain information about your users or customers. The applicable client agreement and instructions govern ALCO’s role for that content. Using a control panel does not mean a particular backup, retention period, data location or regulated-data arrangement is included; those requirements must be established in the service agreement.

Stripe payments, invoices and subscriptions

ALCO uses Stripe for payment and billing functions such as hosted payment pages, invoices, subscriptions and the customer billing portal. ALCO and Stripe exchange information needed for the transaction, including customer and billing details, service or invoice descriptions, amounts, currency, tax information, transaction identifiers and payment or subscription status. ALCO can receive limited payment-method details, such as a brand and last digits, and refund or dispute information.

Payment details entered into a Stripe-hosted form are submitted to Stripe. Do not send full card numbers, security codes or bank-login credentials to ALCO through chat, email or a support ticket. Stripe processes payment credentials and technical or fraud-prevention data under its own Privacy Policy; ALCO’s hosted billing integration uses Stripe references rather than asking you to enter raw payment credentials into Access.

Stripe can act on ALCO’s behalf for payment processing and for its own purposes, including fraud prevention and legal compliance. Optional Stripe services such as Link have separate choices and terms when offered. Stripe’s Cookie Policy describes its browser technologies. An ALCO analytics choice does not disable payment-security checks or change Stripe’s settings.

Where the information comes from

• Directly from you, when you submit a form, call us or otherwise communicate with ALCO.
• Automatically from your browser or network, through normal web requests, security logs, form-protection controls and—only with consent—analytics technology.
• From your organization or an authorized colleague, when they introduce you, include you in a request or identify you as a business contact.
• From public professional sources, such as an organization website or professional profile, when reasonably relevant to an enquiry or business relationship.

If you provide personal information about another person, you should have authority to do so and should direct them to this Policy when appropriate.

How and why we use information

Where EEA or UK data-protection law applies to ALCO’s processing as a controller, the legal bases we rely on are: your consent for optional analytics; steps at your request before entering a contract and performance of a contract; our legitimate interests in operating and securing our websites and services, responding to support requests, preventing fraud and managing business relationships; and compliance with legal obligations. Where we rely on legitimate interests, we consider the effect on your rights and do not use that basis when your interests override ours.

Cookies, analytics and form protection

HQ uses Google Analytics 4 and Microsoft Clarity to understand traffic and user experience. Access has its own consent-gated Google Analytics on a small set of sign-in and dashboard entry routes, with sanitized page information and analytics storage signaled as denied. Access also offers optional Microsoft Clarity on its public sitemap page only, after Access analytics consent and with page-text masking requested. Clarity does not load on sign-in forms, client or staff account pages, or URLs containing a query string or fragment. Tools uses separate consent-gated Google Analytics and Clarity on its public directory pages, excluding tool workspaces as described above. These ALCO-installed analytics scripts stay off unless you choose Accept analytics on the applicable site. We instruct the tools that advertising storage is denied and do not use the Site to serve targeted ads.

Clarity can capture page interactions and generate session replay and heatmap information. Microsoft operates Clarity under its own terms and may process Clarity data for the purposes described in its privacy materials. This is one reason it remains optional and blocked until consent.

Cloudflare Turnstile protects public forms from automated abuse. It processes technical signals such as IP address, browser information and site origin. ALCO validates a short-lived token before accepting a protected request. This security check operates separately from optional analytics. Cloudflare explains its processing in the Turnstile Privacy Addendum.

Our Cookie Policy lists the technologies, explains their purpose and gives you controls to accept, decline or later change optional analytics. HQ, Access and Tools also treat an enabled Global Privacy Control signal as a request to decline their optional analytics. See the separate status, payment and hosting notices for provider-controlled systems.

When we disclose information

We disclose personal information only as reasonably necessary for the purposes described above:

• Within ALCO, to personnel and authorized contractors who need it for their work and are subject to confidentiality obligations.
• To infrastructure and security providers, including website hosting, content delivery, anti-abuse, backup and network-security providers that process request and security data.
• To communications and business-system providers, which help route inquiries, maintain correspondence and schedule meetings.
• To analytics providers, Google Analytics and Microsoft Clarity, after the applicable ALCO-site consent, and to independently operated hosts as described in the system notices.
• To service providers for the feature used, including Stripe for billing, Better Stack for any retained configured incident routing, WebPros/cPanel for hosting software and related services, and Google Gemini for summary processing.
• To Cloudflare Turnstile, when a protected form is displayed or submitted, for automated-abuse prevention.
• For legal and safety reasons, if reasonably necessary to comply with law or lawful process; protect rights, safety or systems; investigate fraud or abuse; or establish, exercise or defend legal claims.
• In a corporate transaction, such as a financing, reorganization, merger, acquisition or sale of assets, subject to appropriate confidentiality and use restrictions.
• At your direction or with your consent.

Service providers may use information only to provide contracted services to ALCO or as otherwise permitted by their governing terms and applicable law. We do not publish client names, internal system names or private service information through this Policy.

No sale or targeted advertising

ALCO does not sell personal information for money. We do not use the Site to serve targeted advertising or profile visitors in furtherance of decisions that produce legal or similarly significant effects.

We instruct our analytics tools that advertising storage is denied, keep them off until consent and honor supported Global Privacy Control signals by keeping them off. Some privacy laws use broad definitions of “sale” or “sharing”; you may use the privacy-request process below if you have a question about how a law applies to your information.

How long we keep information

Browser-storage lifetimes are not promises about deletion of server records. Ask ALCO about the record and system involved if you need a specific retention or deletion determination.

We may retain information longer when reasonably necessary for litigation holds, security investigations, contractual requirements or legal obligations. We may retain aggregated or de-identified information that can no longer reasonably identify you.

How we protect information

We use administrative, technical and physical safeguards appropriate to the nature of the information and the risks involved. These include encrypted transport, access controls, least-privilege practices, logging, rate limiting, anti-abuse controls, maintenance and protected backups where appropriate.

No website, network or storage method can be guaranteed completely secure. If a security incident affects personal information, we will investigate, contain and provide notices as required by applicable law.

Your privacy rights and choices

Depending on where you live and the law that applies, you may have a right to:

• know whether we process your personal information and obtain access to it;
• receive information about categories, sources, purposes and recipients;
• correct inaccurate personal information;
• request deletion, subject to lawful exceptions;
• receive certain information in a portable format;
• withdraw consent, including consent to optional analytics;
• object to or request restriction of certain processing;
• opt out of sale, targeted advertising or certain profiling;
• appeal a decision on a privacy request where applicable; and
• not be discriminated against for exercising a privacy right.

ALCO offers access, correction and deletion requests to individuals even when a particular comprehensive state privacy law does not apply, subject to identity verification and legitimate retention needs.

Changing cookie preferences is separate from requesting account or record deletion. For client-controlled hosted data, contact the client organization; we will assist it as required by our agreement and applicable law. For provider-controlled records, you can also use the provider contact linked in the relevant notice.

How to submit a request

Use our contact form or email info@alcohq.com and write “Privacy request” in the subject or message, call +1 (208) 391-7176, or send mail to the address in Scope and who is responsible. Describe the right you want to exercise and the information or interaction involved.

We may request information reasonably necessary to verify your identity and protect the person whose data is involved. An authorized agent may submit a request when permitted by law; we may verify the agent’s authority and, where allowed, confirm the request directly with you. We respond within the period required by applicable law and normally do not charge a fee. If we deny a request, we will explain why and provide appeal instructions when required.

International visitors and transfers

ALCO is based in the United States. If you visit from another country or submit information through the Site, your information may be processed in the United States and in other countries where our service providers operate. Privacy laws in those locations may differ from the laws where you live.

Where applicable law requires a transfer mechanism or additional safeguard, we use appropriate contractual or other lawful measures. EEA and UK visitors may also complain to their local data-protection authority, although we encourage you to contact us first so we can address the issue directly.

Children’s privacy

The ALCO websites and systems are intended for adult business users and are not directed to children under 13. This does not describe the audience of a separate customer-owned website merely hosted by ALCO. We do not knowingly collect personal information online from a child under 13. If you believe a child has submitted personal information to the Site, contact us and we will investigate and delete it where required.

Third-party sites

The Site links to external websites and services. Their operators decide how they collect and use information, and their privacy notices—not this Policy—govern their practices. A link does not mean ALCO controls or endorses every practice of the destination.

Changes to this Policy and how to contact us

We may update this Policy to reflect changes in the Site, our practices or applicable law. The effective and last-updated dates at the top identify the current version. We will provide a more prominent notice before a material change takes effect when required or appropriate.