Privacy & Terms
Privacy Policy and Terms of Use.
What is processed when you use Alletho, where it goes, how long it stays, and the terms that govern using the site.
Governed by German law, with disputes before the courts of Bremen. Last revised August 2026.
Your privacy choices. Reopen the consent panel to turn optional usage analytics on or off. Turning it off removes the analytics cookie, its browser-storage entry, and the identifier immediately.
Privacy
What is processed, and where it lives.
- Your searches. The company name you enter is sent to the research services that build the review (see the processor list below) and appears in our server logs and error diagnostics. Do not enter personal data about yourself or private individuals into a query; the site is built for companies, and later for persons of public life.
- Finished company reviews. The review a search produces (scores, cited incidents, and the technical audit trail of how it was built) is stored in our database. This is the published record: it lets repeat searches load instantly instead of re-running, and it is versioned so past assessments stay accountable.
- Person searches. Reviews of public figures are not yet available. When they launch after the beta, they will be produced on request and not stored in our database; the result will live only in your own browser session.
- Technical logs. Server errors (including the entity a failed review concerned) are logged so we can fix what breaks. Your IP address is held briefly in memory for abuse-rate limiting and is not written to our database.
- Optional sign-in. If you sign in with Google, you are redirected to Google's own sign-in page; we then store your name, email address, and profile picture in an account record, plus a strictly necessary session cookie in your browser. Nothing from Google loads on ordinary page views. Most of the site works without signing in. To delete your account and everything tied to it, email us (address below) and we act within one month, usually much faster.
- On your device only. Bookmarks, your values-quiz answers, lifestyle scorecards, recently-viewed reviews, and your consent choices are stored in your browser's local storage and are never sent to our servers, with two exceptions: the community actions and the optional values sync described next. There are no advertising or third-party tracking cookies.
- Community features. If you cast a boycott vote or submit a source, your choice is stored on our servers together with a random device identifier (a UUID your browser generates locally) so each device counts once; public ratings are additionally tied to your signed-in account so each person counts once. None of it is linked to your IP address. Retracting a vote deletes it; clearing your browser resets the device identifier.
- Values sync, only if you turn it on. Signed-in users can optionally save their values-quiz answers and scorecard picks to their account so they follow you across devices. Because your answers can reveal political or philosophical convictions, this runs only on your explicit consent (Art. 9(2)(a) GDPR), is off by default, and is stored encrypted at rest on our servers, used for nothing except syncing your own devices. Turning the toggle off in your account deletes the server copy immediately; the copy on your device stays yours.
- Usage analytics, only if you opt in. If you enable the optional analytics category in the consent banner, we use PostHog (hosted in the EU, Frankfurt) to see how the site is used: page views and product events such as "a search was run" or "the quiz was completed". It sets one first-party cookie and a matching browser-storage entry holding a random identifier. It never records what you searched for or how you answered the quiz. It stays off unless you switch it on, and you can withdraw at any time using the "Manage your privacy choices" button at the top of this page. Withdrawal removes the cookie, the storage entry, and the identifier.
Privacy
Who processes it for us.
Building a review requires sending the searched name to external research services. These act as our processors or as independent data sources; transfers outside the EEA rely on the EU Standard Contractual Clauses or an adequacy decision.
- OpenAI (USA): language processing and web research for the review text and scores.
- Perigon (USA): news-archive retrieval for the evidence base.
- Free Law Project / CourtListener (USA): court-record retrieval.
- Official European court-record services (queried through our self-hosted eu-court-docs tool, which sends only the searched company name): NeuRIS / Rechtsinformationen des Bundes (Germany, BMJ), RIS (Austria), SAOS (Poland), The National Archives' Find Case Law (UK), Judilibre / Cour de cassation (France), Corte di Cassazione SentenzeWeb (Italy), and Open Legal Data (Germany), depending on jurisdiction coverage at the time of the search. Regulator datasets surfaced by the same tool (e.g. BaFin, Garante, CNIL via Légifrance) are ingested in bulk on a schedule and receive no search terms.
- Google (USA): sign-in when you use it; fact-check retrieval once public-figure reviews launch.
- Supabase (database hosting, AWS Frankfurt region): where finished reviews, accounts, and logs are stored.
- PostHog (EU Cloud, hosted in Frankfurt): opt-in usage analytics; receives page views and product events only if you enable analytics in the consent banner, under a signed data-processing agreement. Event data is stored in Frankfurt; any residual access from outside the EU is covered by the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
- Public registries and datasets consulted without receiving anything beyond the searched name, for example GLEIF, SEC EDGAR, the US Senate lobbying and FEC databases, the World Bank debarment list, Wikirate, B Corp and animal-welfare registries (PETA, ChickenWatch), and published NGO and UN lists.
Privacy
Legal bases, and why the balance holds.
Companies are not natural persons; the GDPR does not apply to data about them. Names of individuals that appear inside company evidence (an executive named in a cited article, a party to a lawsuit) are processed under the journalistic framework below.
Persons of public lifeare covered by Art. 6(1)(f) GDPR (legitimate interest) together with the media privilege of Art. 85 GDPR as implemented in German state press and media law, because Alletho's reviews are editorial-journalistic in character: they gather published reporting from identified outlets and institutions, apply a publicly declared methodology, and present the result with full citations for public scrutiny.
Our legitimate-interest assessment, in brief. Interest: enabling consumers and citizens to see the documented public record of powerful actors, a recognized public-information interest. Necessity: that record cannot be presented without processing data about the actors it concerns; no less intrusive means exists. Balancing:Alletho processes only what identified public sources have already published about public-sphere conduct; it does not report on private life, does not profile private individuals, weighs evidence by source reliability, says so when evidence is thin, and offers correction, reply, and erasure routes (below). On that basis the public-information interest is not overridden by the data subjects' interests. Where you actively use the site (running a search, signing in) Art. 6(1)(b) (performance of the service you requested) applies alongside.
Privacy
Retention.
- Published company reviews are retained as the site's versioned public record for as long as they remain published, subject to the correction and erasure routes below.
- Technical audit data behind a review (raw source payloads, call diagnostics) is kept up to 12 months for quality control and reproducibility, then deleted or anonymized.
- Error logs are kept up to 90 days.
- Account data (name, email, profile picture, sessions) is kept until you ask us to delete your account; email the address below and we remove it within one month.
- Synced values (the optional cross-device sync) are kept until you turn the sync toggle off in your account, which deletes the server copy immediately, or until your account is deleted.
- Browser-stored data is yours: it clears when you clear your browser.
Privacy
Your rights.
Under Articles 15–21 GDPR you may request access to the personal data we hold about you (Art. 15), correction of inaccurate data (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), a portable copy (Art. 20), and you may object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you may withdraw it at any time with future effect. You may also complain to a supervisory authority; for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen.
All requests go through the contact page. We confirm receipt within 72 hours and answer substantively within one month, as the GDPR requires. For erasure requests concerning editorial content, we weigh the request against the journalistic public interest case by case, as Art. 17(3)(a) and the media privilege require, and explain the outcome either way.
Corrections
Corrections, right of reply, and takedown.
The record is only worth something if it can be corrected. If a review about you or your organization contains an error (a misattributed incident, an outdated status, a mischaracterized source), tell us through the correction form. We acknowledge within 72 hours, check the challenged item against its cited sources, and correct, annotate, or remove it. Where a claim of serious inaccuracy concerns personality rights and cannot be verified quickly, we temporarily unpublish the contested item while we review.
Representatives of a reviewed entity also have a right of reply: a substantive response to a review is read, and where it adds documented facts, reflected in the record. The full-report page of every review links to this route, and the contact form reaches it directly.
Terms of use
What Alletho is.
Alletho gathers publicly available information about companies (with public-figure reviews to follow after the beta) and presents it in one place, together with an assessment of how the record stands. It is a research and transparency tool. It displays evidence and a sourced view of it, and you decide what to do with it.
The nature of what you read
Every assessment on Alletho is measured against a declared, external methodology published in advance. A score reflects how an entity stands relative to that standard, drawn from cited sources. It is an evidence-based assessment against a stated framework, not an independent accusation by Alletho. Where a source is quoted or a finding reported, the judgment belongs to the source or the institution that made it; Alletho reports it and applies its published rule. Reviews are generated with the assistance of automated language models working from those sources, and are marked as such. If you believe a record is inaccurate or out of date, tell us. Corrections are how the record improves.
Terms of use
Accuracy, and the limits of it.
Everything here is informational. It is not legal, financial, investment, medical, or professional advice, and it is no substitute for your own judgment or for consulting a qualified professional.
Alletho draws on automated retrieval and language models, and despite real care it can miss sources, misclassify an item, or summarize imperfectly. We do not guarantee completeness, and we correct errors when they are shown to us. That commitment, not a disclaimer, is the accuracy promise. Liability for intent and gross negligence, for injury to life, body or health, and under mandatory law remains unlimited; in other cases liability is limited to foreseeable damage typical for a free research service. Paid data licences are governed by their own written agreements.
Terms of use
Acceptable use, ownership, and law.
Alletho is for personal, non-commercial use, unless a separate written data or API licence agreement with us provides otherwise; commercial access to the underlying data runs through our data and API program, on its own terms. Outside such an agreement, please do not scrape the site, bulk-download it, resell it, or overload it with automated requests, and do not use it to harass anyone or to break the law. We may restrict access that threatens the service or others' use of it. The design, code, and original text of Alletho belong to Alletho; underlying facts and linked source material belong to their respective owners and are shown for reference and commentary. Third-party data displayed under open licenses is attributed where it appears.
For authorities and users alike, the contact page and main@alletho.com are our single point of contact (Art. 11–12 DSA). User-submitted sources are reviewed before any use; content you believe unlawful can be reported the same way and will be examined promptly, with removal where warranted and a reasoned reply (Art. 16–17 DSA).
This policy and these terms may be updated; the current version always lives here, and continued use after an update means you accept it. German law applies, and any disputes fall to the courts of Bremen, Germany. Provider identification is in the Impressum. Questions about any of it belong on the contact page.
