Privacy Policy — Aletheia Tech

Last Updated: June 28, 2026

1. Introduction

Aletheia Tech Ltd ("Aletheia Tech", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains our practices regarding the collection, use, disclosure, and safeguarding of your personal data when you visit our website, engage our services, or use our products including Bifrost IoT Gateway ("Bifrost") and JanusAccess ("JanusAccess").

We comply with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable Maltese data protection laws.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide to us, including: name, email address, phone number, company name, job title, and any other information you submit through our contact forms, email communications, or during onboarding for services or product deployment.

2.2 Information Collected Automatically

When you visit our website, we automatically collect certain technical information including: IP address, browser type and version, operating system, referring URLs, pages visited, and time and date of访问. We use cookies and similar tracking technologies as described in Section 6.

2.3 Telemetry & Product Data

Bifrost IoT Gateway: Bifrost collects and transmits telemetry data necessary for operation, including device status, sensor readings, network metrics, connection logs, and operational diagnostics. This data is transmitted to our cloud infrastructure for processing, analysis, and storage.

JanusAccess: JanusAccess collects and transmits telemetry data including access events, credential usage patterns, audit trails, system health metrics, and configuration logs. This data is transmitted to our cloud infrastructure for processing, analysis, and storage.

We do not collect sensitive personal data (special categories of data under GDPR) through our products unless explicitly configured by the Client for a specific purpose with appropriate consent.

3. How We Use Your Information

We use your personal data for the following purposes:

To provide, operate, and maintain our Services and Products
To process and respond to your inquiries and requests
To manage client accounts and billing
To monitor and improve the performance, security, and reliability of our Services and Products
To develop new features, products, and services
To send service-related communications, including updates, security alerts, and technical notices
To send marketing communications (with your consent where required by law)
To comply with legal obligations and enforce our Terms & Conditions
To create aggregated, anonymized datasets for product improvement, research, and AI/ML model training as described in our Terms & Conditions

4. Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data on the following legal bases:

Contract Performance: Processing necessary to fulfill our obligations under a contract with you (e.g., providing Services or Product licenses).
Consent: Processing based on your explicit consent (e.g., marketing communications, cookie preferences).
Legitimate Interests: Processing for our legitimate business interests, including product improvement, network security, and customer support, provided such interests are not overridden by your data protection rights.
Legal Obligation: Processing necessary to comply with applicable laws and regulations.

5. Data Sharing & Disclosure

We do not sell your personal data. We may share your information in the following circumstances:

Service Providers: With trusted third-party vendors who assist us in operating our infrastructure, processing payments, providing analytics, and delivering customer support (e.g., cloud hosting providers, payment processors). These providers are contractually bound to protect your data.
Legal Requirements: When required by law, legal process, or governmental request, or to protect our rights, property, or safety.
Business Transfers: In connection with a merger, acquisition, or sale of all or part of our assets, with notice to you and continued protection of your data.
Aggregated Data: We may share Anonymized Data (as defined in our Terms & Conditions) with partners, researchers, or the public for benchmarking, research, and product improvement purposes. Such data cannot be used to identify you.

6. Cookies & Tracking Technologies

Our website uses cookies and similar technologies for functionality, analytics, and (with your consent) marketing. You can manage cookie preferences through your browser settings. Essential cookies cannot be disabled as they are necessary for the operation of the website.

We use Google Analytics and similar services to understand website traffic and usage patterns. These services may use cookies and similar technologies subject to their own privacy policies.

7. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this Privacy Policy, or as required by law. Telemetry data collected by Bifrost and JanusAccess is retained in accordance with our data retention schedule, typically not exceeding 24 months unless otherwise agreed with the Client. When data is no longer needed, it is securely deleted or anonymized.

8. Data Security

Aletheia Tech implements industry-standard technical and organizational security measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These include:

Encryption in transit using TLS 1.3
Encryption at rest using AES-256
Access controls and authentication mechanisms
Regular security audits and penetration testing
Staff training on data protection best practices

9. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or transfer to countries with an adequacy decision from the European Commission.

10. Your Rights (GDPR)

If you are located in the EEA or UK, you have the following rights under the GDPR:

Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to certain exceptions.
Right to Restrict Processing: Request restriction of processing of your personal data.
Right to Data Portability: Request transfer of your data to another controller in a structured, commonly used format.
Right to Object: Object to processing of your personal data for direct marketing or legitimate interests.
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at privacy@aletheiatech.net. We will respond to your request within thirty (30) days. You also have the right to lodge a complaint with the Information and Data Protection Commissioner of Malta.

11. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information. Aletheia Tech does not sell your personal information. You have the right to request disclosure of the categories and specific pieces of personal information we have collected, the right to request deletion, and the right to non-discrimination for exercising your CCPA rights.

12. Children's Privacy

Our Services and Products are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete such information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where appropriate, via email. The "Last Updated" date at the top of this policy reflects the most recent version.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: privacy@aletheiatech.net
General inquiries: contact@aletheiatech.net
Phone: +356-77697803
Location: Malta

Our Data Protection Officer can be reached at dpo@aletheiatech.net.