This privacy policy ("Privacy Policy") applies to all visitors and customers of the altmo.app hosted services, websites, and mobile applications (collectively, the "Website" or "Websites" or "App") and self-managed installations, which are offered by Urbanmorph Consultants Pvt Ltd and/or any of its affiliates ("Altmo" or "we" or "us") and describes how we process your personal information in connection with those Websites, mobile applications, or self managed installations, customer events and demos, and how we collect information through the use of cookies and related technologies. Please read this Privacy Policy carefully. By accessing or using any part of the Websites, mobile applications, or self-managed installations, you acknowledge you have been informed of and consent to our practices with regard to your personal information and data.

Altmo is a collaborative community, as well as a company. This means that many portions of our Websites and mobile app, including information you voluntarily provide, will be public-facing for the open sharing of innovative developments, ideas, and information that makes our collaborative community so great. While we are committed to open sharing, we strive to respect the privacy of individual community members and will minimize the information we collect and share. If you do not want to share your information, including personally identifiable information, with other community members and the public, please be thoughtful as to how you interact with our Websites and mobile app and what information you provide through the Websites and mobile app (for example, through creating a public profile, project contributions, comments, and blog posts).

Unless otherwise stated, we act as the data controller for the data processing operations described in this Privacy Policy.

We may provide additional information about our privacy practices in other places - for example, when we ask you to provide personal information in connection with a particular service or when you apply for a job with us.

Information from website visitors

Like most website operators, Altmo automatically collects (i) technical information about your device including your device's internet protocol (IP) address; and (ii) information about your visit to our Websites (the referral URL, the content viewed and the content interacted with).

Some of this information is collected using cookies and related technologies. See below for further information on these technologies. We collect this information to better understand how visitors use our Websites, to improve our Websites and experience for visitors, and to monitor the security of the Websites.

For logged-in customers to Altmo deployments, Altmo also collects this information on our application using our own software, to help us understand how to make the deployments more useful for different categories of customer.

In addition to the usage information we collect the following information about your activities that are critical to providing services to you

Account information

Altmo collects information about you, including information that directly or indirectly identifies you, if you choose to share it with Altmo. We receive information in two ways:

• When you sign up to Altmo on our web or mobile app and fill out the registration form.
• When you use our mobile app to track, complete or upload activities.
• When you optionally connect your account to third-party platforms such as Strava to import activities from those platforms. This is a one-way import—no tracking data is sent back to Strava.

We collect basic account information such as your name, email address, age (optional), gender (optional), and password that helps secure and provide you with access to our service. Passwords are stored using bcrypt hashing and are never stored in plain text. We use your contact information so we can respond to your support requests and comments.

Location information

We collect and process location information when you use our mobile app to track your activities. With your permission, our mobile app accesses your device location to record your trip information and provide our core services. You can control location permissions through your device settings at any time.

Our mobile app tracks activities entirely on-device using your phone's GPS. Location data is stored locally on your device during tracking and uploaded to our servers only when you save an activity. The mobile app contains no third-party analytics SDKs or advertising trackers, providing enhanced protection for your tracking data compared to platforms that route data through third-party services.

On mobile, background location is collected only during active tracking sessions. The app requests foreground location permission first; background location permission is requested separately, with a clear explanation of why it is needed.

If you choose to connect your account to third-party platforms such as Strava, we will import activity data from those platforms with your permission. You may revoke third-party platform authentication at any time through your account settings. When collecting data from Strava, we do so under the agreement available at https://www.strava.com/legal/api

Rental marketplace data

Bicycle owners provide listing details and location for the rental marketplace. Payment details (such as UPI ID and QR code) are optional and can be enabled or disabled by the owner at any time. We do not store credit card numbers, CVVs, or full bank account details.

Map Visibility and Activity Display

Altmo uses the information we collect and receive solely to display your commute activities and analyze your ride metrics. Altmo may aggregate the information you and others make available and use this aggregate anonymised information to display interactive maps for commute and leisure activities.

Data Sharing and Protection

We do not sell your personal or location information. Only your organisation name and your activities will be shared on Altmo so that you may be able to participate in our service. Only anonymised and/or aggregate data is shared with planning bodies to provision infrastructure that benefits cycling to work, and with corporates for their Environment, Social and Governance goals.

For users enrolled via an organisation, we share only aggregated team metrics (total distance, rides, CO₂ saved) and challenge participation status. Individual GPS routes, precise locations, and personal profile details are never shared with employers.

What information Altmo does not collect

Altmo does not intentionally collect sensitive or special category personal information, such as genetic data, biometric data for the purposes of uniquely identifying a natural person, or religious information.

Altmo is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal data, please contact contact@altmo.app.

To fulfill a contract or take steps linked to a contract with you, we use your personal information to:

• administer access to your accounts;
• manage our customer relationships;
• process orders, provide our products and services and send you service-related communications;
• provide you with customer support.

Legitimate interests

We use your personal information:

• to improve and personalize your experience with us and our Websites and mobile app and to tailor communications to you;
• to monitor and improve the performance of our products and services for administrative, security and fraud prevention purposes;
• for our own internal functions, management and corporate reporting, and internal research and analytics;
• to enforce compliance with our terms of use and other policies or otherwise in connection with legal claims, compliance, regulatory and investigatory purposes as necessary (including disclosure of such information in connection with legal process or litigation).

Consent

We may rely on your consent:

• Where you ask us to send marketing information (e.g. newsletter updates) via a medium where we need your consent under applicable law (for example email marketing in some countries);
• Where you give us consent to use cookies or similar technologies;
• On other occasions where we ask for your consent, for the purpose we explain at the time.
• You may withdraw your consent at any time through the unsubscribe feature provided with the relevant marketing email or by contacting us at contact@altmo.app.

You have the following rights regarding your personal data. To exercise any right, contact contact@altmo.app or use the in-app settings where available.

• Access—request a copy of all personal data we hold about you.
• Correction—correct inaccurate or incomplete data via Account Settings or by contacting us.
• Deletion—request deletion of your account and data via Account Settings or by contacting us.
• Portability—receive your data in a structured, machine-readable format (JSON/CSV).
• Restrict or object—limit how we process your data or object to processing based on legitimate interest.
• Withdraw consent—opt out of any consent-based processing at any time.
• Disconnect third-party services—revoke Strava, Google, GitHub, Microsoft, or Apple access in Account Settings.

We will acknowledge your request within 3 business days and fulfil it within 30 days.

Altmo takes measures reasonably necessary to protect your personal information against any unauthorized access, use, alteration, or destruction. These include:

• TLS 1.2+ encryption on all connections; platform-level encryption at rest for databases and storage.
• bcrypt password hashing; JWT authentication with refresh token rotation.
• Role-based access control with admin multi-factor authentication.
• Server-side input validation and parameterised queries to prevent injection attacks.
• Credentials and secrets filtered from application logs.
• iOS Keychain / Android Keystore for secure mobile token storage.
• No third-party analytics SDKs or advertising trackers on the mobile app.

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay. Enterprise customers will be notified within 48 hours via their designated security contact.

Altmo is a global business, headquartered in Bengaluru, India. Your personal information collected by us in accordance with this Privacy Policy is used and shared by Altmo to our company Urbanmorph Consultants Pvt. Ltd. based in Bengaluru, India for the purposes of providing the Websites and mobile app, delivering our Products and services, managing your accounts, hosting, IT, security, support, billing, marketing, and communications.

Legal Requirements. We may disclose personal information to government authorities or other third-parties if required to do so by law or in the good faith belief that such action is necessary to: (a) comply with a subpoena, court order or similar legal obligation, (b) protect and defend our rights or property, (c) act in urgent circumstances to protect the personal safety of users of any Website or mobile app or the public, (d) protect against legal liability, (e) to investigate fraud or other unlawful activity, or (f) or as otherwise required or permitted by law.

Altmo at its sole discretion may make use of company logos where those companies are using the software that we provide. If you have concerns over the use of your logo, please email contact@altmo.app.

The Websites and mobile app services are hosted in Bengaluru, India and the personal information we collect about our customers' users will be stored and processed on our servers in India. Information about our customers is processed in India by us, and may also be by the service providers and partners listed above. Our employees, contractors and affiliated organizations that process information for us as described above may be located in India or in other countries outside of your home country which may have different data protection standards to those which apply in your home country. In this case you can email us at contact@altmo.app to know more about the contract we are entering into with our partners.

Where data is transferred outside India or the European Economic Area, we ensure adequate protection through Standard Contractual Clauses and binding provisions in our agreements with sub-processors.

This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act 2023. All disputes shall be subject to the exclusive jurisdiction of the High Court of Karnataka, Bengaluru, India. For EU/EEA users, the General Data Protection Regulation (GDPR) applies in addition to Indian law.

Enterprise customers may request a Data Processing Agreement (DPA) covering processing scope, sub-processor controls, audit rights, international transfer safeguards, and data return or deletion on termination. Contact contact@altmo.app for details.

If you are a registered user of the Websites or mobile app and have supplied your email address, Altmo may occasionally send you an email to tell you about your activities, security, system information, new features, solicit your feedback, or just keep you up to date with what's going on with Altmo and our products. We primarily use our social media to communicate public information, so we expect to keep this type of email to a minimum where it involves your personal activities. There's an unsubscribe link located at the bottom of each of the marketing emails we send you so you can stop receiving such emails at any time.

If you send us a request (for example via a support email or via one of our feedback mechanisms), we reserve the right to publish your request in order to help us clarify or respond to your request or to help us support other customers. We will not publish your personal information in connection with your request.

Cookies

A cookie is a string of information that a website stores on a visitor's computer, and that the visitor's browser provides to the website each time the visitor returns. Altmo uses cookies to help Altmo identify and track visitors, their usage of the Websites, and their Website access preferences. Altmo visitors who do not wish to have cookies placed on their computers may set their browsers to refuse cookies before using the Websites. Disabling browser cookies may cause certain features of Altmo's websites to not function properly.

To remember you, our system will give you a cookie. It's safe. We're very careful to only have first-party cookies on our site, including when we embed content from other websites, such as YouTube. We do not use third-party advertising cookies or cross-site tracking.

Analytics

We may use third-party analytics services such as Google Analytics and PostHog to collect information about how you use our app and/or websites. This is so that we can iteratively make your experience better and build on your pain points. Analytics on the web require your consent—when declined, tracking is fully suppressed. Our mobile app contains no third-party analytics SDKs.

Data retention and deletion

If you already have an account on the Websites or mobile app, you may access, update, alter, or delete your basic customer profile information by logging into your account and updating profile settings.

Altmo will retain your information for as long as your account is active or as needed to perform our contractual obligations, provide you services through the Website or mobile app, to comply with legal obligations, resolve disputes, preserve legal rights, or enforce our agreements. Retention periods will be determined taking into account the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable opportunity. For instance, in respect of data held for the management of customers and potential customers, we consider the lead time necessary to develop and maintain our commercial relationships and how recent our interactions are with you. We may rectify, update or remove incomplete or inaccurate information, at any time and at our own discretion. For more information on our retention periods you can contact us by sending an email to contact@altmo.app.

Although most changes are likely to be minor, Altmo may change its privacy policy from time to time, and in Altmo's sole discretion. For material changes, we will email all registered users and provide 30 days' notice before the new terms take effect.

We may also provide notification to customers who have provided us email addresses of material changes to this Privacy Policy through our Website or mobile app. Altmo encourages visitors to frequently check this page for any minor changes to its Privacy Policy. Your continued use of this site or mobile app after any change in this Privacy Policy will constitute your acceptance of such change.