Privacy Policy

Last updated: 7 September 2026

1. Who we are and the scope of this policy

This Privacy Policy explains how Alture, LLC ("Alture", "we", "us" or "our") collects, uses, shares and protects personal data. Alture, LLC is a limited liability company organized under the laws of the State of Wyoming, United States, Filing ID 2025-001724105, with its principal office at 30 N Gould St Ste R, Sheridan, WY 82801.

Alture is a business-to-business marketing and management agency for content creators. We provide services to creators and their businesses, including account and platform management, marketing and social strategy, content production and photoshoots, collaborations and partnerships, brand deals and sponsorships, and content protection and takedowns.

Alture, LLC is the controller of the personal data described in this policy. We are based in the United States, and this policy is written primarily around United States federal and state privacy law. Where the European Union General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") applies to our processing of your personal data — which it may, under Article 3(2), where we offer services to people in the European Union — the additional rights and obligations described in sections 4, 6, 9 and 11 apply to you as well.

This policy applies to personal data we process through our website at www.alturellc.com and in the course of providing our services. Where we act as a processor on behalf of a client (for example, when managing a creator's third-party platform accounts on their instructions), the relevant data processing is governed by our written engagement agreement with that client rather than by this policy.

2. The personal data we collect

We collect and process the following categories of personal data.

• Website form data. All three of our website forms are Netlify Forms. When you submit our contact form, we collect the name, email address and message content you provide. When you submit our roster request form, we collect the name, company, email address and description of what you are planning that you provide. When you submit our order form, we collect the name, email address, company, billing address and chosen service that you provide. In each case we also collect anything else you choose to include.
• Order and billing data. When you order a fixed-price service through the Website, we collect your name, email address, company name where you give one, and the billing address we need in order to invoice you, together with the product ordered and the amount invoiced. We do not take card payments on this Website and we never receive or store card numbers.
• Client and business-contact data. In the course of discussing, agreeing and delivering our services, we process the personal data of clients and their representatives, such as names, business and personal email addresses, telephone numbers, job titles, billing and invoicing details, and the contents of our correspondence and meetings with you.
• Service-delivery data. Where relevant to an engagement, we process information needed to deliver our services, such as social-media account details and credentials provided to us by the client, campaign and performance information, content and creative materials, and details of brand partners and collaborators.
• Technical and essential-storage data. Our website uses only essential first-party storage. Specifically, we store a cookie-consent preference key in your browser to remember your cookie choice. We do not currently operate analytics or advertising cookies. Parts of the Website are served by our hosting, delivery, font and script providers — named in section 5 — and your browser requests those parts from them directly, so each of those providers receives your IP address, your browser details and the address of the page you asked for as part of serving it. See our Cookie Policy for details.

We do not intentionally collect special categories of personal data (such as data revealing health, religious beliefs or political opinions) through our website. Please do not include such information in anything you send us through our website forms.

3. How we collect personal data

We collect personal data directly from you when you contact us, enquire about our services, enter into an engagement with us, or correspond with us. We also receive personal data from clients in connection with the services we deliver on their behalf, and we may receive limited information from third parties such as brand partners, platforms and invoicing providers in the ordinary course of business.

4. How we use personal data and our lawful bases

United States privacy law does not generally require a "lawful basis" of the kind the GDPR does; it regulates disclosure, choice and the handling of requests instead. We set out the GDPR bases below because they apply where the GDPR reaches our processing, and because they describe accurately why we process personal data in every case.

• Performance of a contract (Article 6(1)(b)). To respond to enquiries that are a step towards entering an engagement, to negotiate and conclude engagement agreements, to deliver our services, to manage our client relationship and to administer billing and invoicing.
• Legitimate interests (Article 6(1)(f)). To operate, secure and improve our website and business; to respond to general enquiries; to manage and develop relationships with clients, brand partners and collaborators; to keep records of our dealings; and to establish, exercise or defend legal claims. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to this processing as described in section 9.
• Compliance with a legal obligation (Article 6(1)(c)). To comply with our legal and regulatory obligations, including accounting, tax and record-keeping requirements under United States federal and state law, and to respond to lawful requests from competent authorities.
• Consent (Article 6(1)(a)). Where we ask for your consent for a specific purpose (for example, optional communications). You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Because we operate on a business-to-business basis, much of the personal data we process relates to individuals in their professional or business capacity, including sole traders and individual creators.

5. Sharing your personal data and third-party processors

We do not sell your personal data. We share personal data only where necessary for the purposes set out above, with the following categories of recipients.

• Service providers and processors who process personal data on our behalf and under our instructions, such as our website host and form provider, our content-delivery, font and script providers, the content-protection tools we use on client instructions, email and productivity providers, and accounting, invoicing and professional advisers. The providers who host this Website or deliver its files are named below.
• Brand partners, platforms and collaborators, where sharing is necessary to deliver an engagement and is consistent with our instructions from the relevant client.
• Competent authorities, regulators and advisers, where we are required to share data to comply with the law, enforce our agreements, or protect our rights, property or safety.

The providers we use, and what each of them receives, are as follows.

• Netlify. Our website host and form provider. Netlify serves the pages of the Website and receives the technical data described in section 2 in order to do so. All three of our forms — the contact form, the roster request form and the order form — are Netlify Forms, so whatever you type into any of them is stored by Netlify on our behalf.
• Cloudflare. Our DNS and content-delivery provider. Requests for the Website are delivered through Cloudflare's network before they reach our host, so Cloudflare receives your IP address and request details in order to serve the page and to protect the Website against abuse.
• Google Fonts. The typefaces on the Website are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser requests them from Google directly, so Google receives your IP address and browser details each time a page loads.
• unpkg. The one front-end library we use, for smooth scrolling, was originally taken from the public open-source code CDN unpkg.com. It is now served from this Website itself, so your browser does not request anything from unpkg and unpkg receives no data about you. Our content-security policy still permits unpkg.com, which is why it is still listed here.
• Content-protection tools. Where you instruct us to act on unauthorised copies of your content, we use third-party monitoring services to search for copies and to submit takedown notices. Those services act as our subprocessors and process the content, URLs and rights information you give us for that purpose only.

We do not use any of these providers for analytics, advertising or cross-site tracking, and we do not operate an analytics or advertising service of our own.

We put in place written agreements with our processors that require them to protect personal data and to process it only on our instructions, as required by Article 28 of the GDPR.

6. International transfers

We are established in the United States, and the providers named in section 5 — our website and form host (Netlify), our content-delivery provider (Cloudflare), the font provider whose files your browser loads (Google Fonts) and the content-protection tools we use on client instructions — process personal data in the United States and, in some cases, elsewhere. Our content-security policy also permits unpkg.com, the public code CDN our one front-end library was originally taken from; as section 5 explains, that library is now served from this Website itself, so unpkg does not receive anything about you or process personal data on our behalf. If you are in the European Economic Area or the United Kingdom, this means your personal data is transferred outside that area. Where the GDPR applies to such a transfer, we ensure an appropriate safeguard is in place, such as the European Commission's Standard Contractual Clauses, together with any supplementary measures required following the Court of Justice of the European Union's judgment in Case C-311/18 ("Schrems II"), or reliance on a European Commission adequacy decision covering the recipient. You may request further information about these safeguards using the contact details in section 15.

7. Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, and to meet our legal, accounting and regulatory obligations.

• Website form submissions — from the contact form, the roster request form and the order form alike — are retained for as long as needed to deal with your enquiry or order and for a reasonable period afterwards, after which they are deleted or anonymised unless they have become part of a client relationship.
• Client, purchase and engagement records are retained for the duration of the engagement and for a period afterwards consistent with applicable limitation periods and our record-keeping obligations. Business books and records supporting our tax filings are generally retained for at least seven years, consistent with Internal Revenue Service guidance and applicable state limitation periods.

When personal data is no longer required, we securely delete or anonymise it.

8. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include access controls, use of reputable service providers, and limiting access to personal data to those who need it. No method of transmission or storage is completely secure, but we work to protect your information and to maintain its confidentiality.

9. Your rights

We grant the rights below to everyone who contacts us, regardless of where you live and regardless of whether a particular privacy law happens to apply to us in your state. We have taken that decision deliberately: the thresholds in United States state privacy laws turn on our size, and we would rather offer one consistent set of rights than a different set in each state.

You may ask us to:

• Know and access — confirm whether we process personal data about you, what categories we collect, where we got it, why we process it and who we share it with, and obtain a copy.
• Correct — have inaccurate or incomplete personal data about you corrected.
• Delete — have personal data about you deleted, subject to the records we are required to keep.
• Obtain a portable copy — receive personal data you gave us in a structured, commonly used and machine-readable format.
• Opt out — of any sale of personal data, any sharing for cross-context behavioural advertising, and any profiling with legal or similarly significant effects. We do none of these things, so there is nothing to opt out of; the right is stated because you should not have to take our word for it.
• Not be discriminated against — we will not deny you services, charge a different price or provide a lower quality of service because you exercised any of these rights.

Additional rights where the GDPR applies. If your personal data is processed subject to the GDPR, you also have the right to restrict processing in certain circumstances, the right to object to processing carried out on the basis of our legitimate interests on grounds relating to your particular situation, and the right to withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing carried out before withdrawal.

10. How to exercise your rights

To exercise any of your rights, please contact us at hello@alturellc.com. We may need to verify your identity before responding. We will respond without undue delay and in any event within 45 days of receiving your request, which we may extend once by a further 45 days where reasonably necessary, having regard to the complexity and number of requests; we will tell you within the first 45 days if an extension applies. Where the GDPR applies to your request, we will respond within one month, extendable by two further months on the same basis. Exercising these rights is normally free of charge, but we may charge a reasonable fee or decline to act where a request is manifestly unfounded, excessive or repetitive, to the extent the applicable law permits.

11. Right to lodge a complaint

If you have concerns about how we handle your personal data, we encourage you to contact us first so that we can try to resolve them.

United States. If you are a California resident, you may complain to the California Privacy Protection Agency (cppa.ca.gov) or to the California Attorney General (oag.ca.gov). If you live in another state with a comprehensive privacy law, that state's Attorney General is the enforcing authority, and you may complain to their office.

European Economic Area and United Kingdom. Where the GDPR applies to our processing of your personal data, you have the right to lodge a complaint with the supervisory authority in the country where you live or work, or where you believe an infringement occurred.

12. United States privacy notice

This section applies to residents of United States states that have enacted comprehensive consumer privacy laws, including California under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CPRA").

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising, as those terms are defined under the CPRA and its equivalents in other states. We do not process personal information for profiling that produces legal or similarly significant effects. We have never done any of these things.

Whether these laws currently apply to us. Most state privacy laws apply only above a threshold — commonly a revenue figure or a count of residents whose data is processed — and we are below those thresholds today. Rather than change what we offer as our size changes, we extend the rights in section 9 to everyone who asks, and we handle every request the same way. If a threshold begins to apply to us, nothing about your rights under this policy will change.

Categories of personal information. The categories we collect are set out in section 2, the sources in section 3, the purposes in section 4, and the categories of recipient in section 5. We do not collect personal information from anyone we know to be under 16.

California residents may contact us at hello@alturellc.com with any privacy request, and we will not discriminate against you for exercising your rights. An authorised agent may submit a request on your behalf; we will ask for proof of their authority and may ask you to confirm it directly.

13. Do Not Track and cross-site tracking

Some browsers can send a "Do Not Track" ("DNT") signal, and some send a Global Privacy Control ("GPC") signal. California law requires us to tell you how we respond to them.

We do not track you across websites at all, so there is nothing for these signals to switch off. We operate no analytics, advertising or cross-site tracking of any kind, we set no cookie for those purposes, and we do not allow any third party to collect personal information about your online activities over time and across different websites through our Website. Because our behaviour is already what a DNT or GPC signal asks for, we do not change it in response to one.

The providers named in section 5 receive your IP address and browser details when your browser requests files from them, which is an unavoidable part of serving a page. None of them is used by us for analytics, advertising or tracking. Our Cookie Policy describes the single item of storage the Website sets, which records your cookie choice and nothing else.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational or regulatory reasons. The "Last updated" date at the top of this policy indicates when it was last revised. We encourage you to review it periodically.

15. Contact us

If you have any questions about this Privacy Policy or our handling of your personal data, please contact us:

Alture, LLC
30 N Gould St Ste R, Sheridan, WY 82801
Email: hello@alturellc.com