Privacy Policy: Pace

Version: 1.1.0 Effective date: 2026-08-17

1. Who we are and scope

1.1. This Privacy Policy describes how Alto Professional Services AB, organisationsnummer 559244-1561, registered address Slottsbacken 8, 111 30 Stockholm, Sweden ("Pace", "we", "us", "our"), processes personal data when you use the Pace service at https://pace.alto.se and related features (the "Service").

1.2. This policy applies to processing for which Pace is the controller. Where we process personal data on behalf of a customer organisation (a "Customer") within their tenant of the Service, Pace is a processor and processing is governed by the Data Processing Agreement ("DPA") between Pace and that Customer.

1.3. Throughout this policy, "personal data" has the meaning given in Regulation (EU) 2016/679 ("GDPR"), as supplemented by the Swedish Data Protection Act (lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning).

2. Controller identity and contact

Controller: Alto Professional Services AB Organisationsnummer: 559244-1561 Registered address: Slottsbacken 8, 111 30 Stockholm, Sweden Data protection contact (Privacy Lead): info@alto.se General contact: info@alto.se

3. Roles and responsibilities

3.1. Pace as processor (for Customer Data inside a tenant). When a Customer signs up and uses the Service, the Customer is the controller for personal data they and their users submit or generate within their Organisation, including time entries, expenses, customer records, project records, dashboards, reports, AI inputs and AI outputs (collectively "Customer Data"). Pace processes Customer Data only on the Customer's documented instructions, as set out in the DPA and these Terms. Individuals (such as employees of a Customer) whose data is held within the Customer's tenant should direct data-subject requests in the first instance to that Customer.

3.2. Pace as controller. Pace is the controller for personal data that we determine the purposes and means of processing for, including account administration, security, billing, support, and communications with administrators and decision-makers at customer organisations.

3.3. This policy describes both perspectives. Sections 4 to 6 inventory categories, purposes and lawful bases for Pace's controller processing; sections 8 to 10 (sub-processors, transfers) apply to both perspectives.

4. Personal data we process

The following categories of personal data may be processed in or by the Service:

4.1. Identity and account data

• Email address
• First name and last name
• WorkOS user ID (stable authentication identifier)
• Google OAuth profile (email, email verification status, subject ID, given name, family name) where you sign in with Google via WorkOS federation
• Role within the Organisation (admin, user)
• Organisation membership
• Expected work percent (employment ratio)

4.2. Authentication artefacts

• Session tokens and expiry timestamps
• API key hash, key prefix and last-used timestamp
• HTTP-only auth_session and auth_refresh cookies (strictly necessary for authentication) and a legal_ok cookie caching terms-acceptance state
• WorkOS-managed credentials (passwords and MFA factors are managed by WorkOS AuthKit; we do not store password material)

4.3. Work and absence data (time entries)

• User identifier, date, hours, free-text description
• Absence type, which may include holiday or sick_leave (see clause 5)
• All-day flag

4.4. Financial and employment-cost data

• Expenses: date, expense type, amount, currency, VAT rate, free-text description, reimbursement flag
• Memberships: user, project, cost-per-hour, currency

4.5. Tenant and counterparty records

• Organisation: name, domain, plan, Stripe customer and subscription identifiers
• Customers (counterparties of the Organisation): name, email, Swedish organisationsnummer, Fortnox identifiers

4.6. Invitations

• Invitee email, inviting user, status — invitations and membership are managed via WorkOS

4.7. Integration credentials and metadata

• Application-encrypted OAuth tokens, refresh tokens, code verifiers, state, and custom auth headers for connected MCP servers
• Slack bot tokens, Slack workspace identifiers, installer identifier
• Fortnox tokens, stored application-encrypted in the Service database and additionally synchronised to a separate access-controlled token store (AWS DynamoDB, encrypted at rest with AWS-managed encryption) for the managed accounting gateway

4.8. AI inputs and voice data

• Text prompts, attachments and free-text content submitted to AI features
• Audio recordings transmitted to the voice agent (ElevenLabs) in real time
• Audio submitted for transcription (dictation, chat audio attachments, Slack voice memos), which is converted to text by ElevenLabs speech-to-text; Pace retains only the transcript
• Per-Organisation ElevenLabs voice agent identifier

4.9. User-generated configuration

• User-authored SQL in dashboards and reports
• Dashboard configurations and widget definitions
• These artefacts may echo personal data from any of the categories above when queried or displayed

4.10. Service operation logs

• Access and request logs at load balancer and CDN (AWS ALB, CloudFront), which may include source IP address, user-agent and request path
• Application logs (limited to operational signals; we strive to avoid logging personal data)
• WebSocket entity-change events (transient, not persisted as audit log)

4.11. Billing-related data (controller processing)

• Stripe customer and subscription identifiers; plan, status and seat count
• Card data is not stored by Pace. Stripe collects and tokenises payment instruments under its own privacy policy.
• Per-user AI usage metering records (counts of AI prompts per user per calendar period), used to enforce the usage allowances described in the Terms

We do not intentionally collect: telephone numbers, postal addresses, dates of birth, government identifiers, social-security numbers, payment-card numbers, precise geolocation, or biometric identifiers used for unique identification.

5. Special categories (GDPR Art. 9)

5.1. Sick-leave records. Time entries with absence_type = sick_leave constitute health data under GDPR Article 9(1).

5.2. Lawful basis (controller = Customer). Within a Customer's tenant, the Customer is the controller for sick-leave records. The Customer must identify and document a lawful basis under Article 9. In a Swedish employment context, the typical basis is Article 9(2)(b) GDPR: processing necessary for carrying out obligations and exercising specific rights of the controller or of the data subject in the field of employment, social security and social protection law, in accordance with Swedish employment law (including the Lag (1991:1047) om sjuklön (sick-pay obligations) where applicable).

5.3. Lawful basis (processor = Pace). Pace processes sick-leave data strictly on the Customer's instructions and applies appropriate safeguards (access controls, logging, encryption at rest and in transit, tenant isolation via Postgres row-level security).

5.4. Voice audio. Voice audio captured by the voice agent is processed for conversational purposes only. We do not use voice audio to uniquely identify natural persons; accordingly, audio is not processed as biometric data under Article 9(1). The same applies to audio submitted for speech-to-text transcription (dictation, chat audio attachments and Slack voice memos), which is converted to text and not retained as audio. We nevertheless treat voice audio as sensitive in our security posture.

5.5. Children. The Service is intended for workplace use and not for individuals under the age of 16. We do not knowingly process personal data of children. If we become aware that we have done so, we will delete that data without undue delay.

6. Purposes and lawful bases (Article 6 GDPR)

The following table summarises the purposes for which Pace, as controller, processes personal data, and the lawful basis under Article 6(1) GDPR.

For Customer-Data processing where Pace acts as processor, the lawful basis lies with the Customer (controller); Pace's processing is governed by the DPA.

7. Retention

7.1. Active account data. Account data and Customer Data are retained for the duration of the Customer's account, plus 90 days after termination, unless longer retention is required by law.

7.2. Invoice and accounting records. Retained for 7 years as required by the Swedish Bokföringslagen (1999:1078) and the Swedish Skatteförfarandelagen (2011:1244).

7.3. Sick-leave records. Sick-leave records are retained as ordinary Customer Data under the Customer's control; Pace applies no separate automatic purge. Retention follows the Customer's documented retention policy and applicable employment-law obligations.

7.4. Security and access logs. Retained for approximately 14 days, then deleted or aggregated.

7.5. Backups. Routine database backups are retained on a rolling basis (currently 1 day at the database layer). Personal data in backups is purged when backups age out.

7.6. AI inputs and chat history. Chat conversations (messages and tool-call records) are persisted as part of normal Customer Data until deleted. AI rewrite inputs, generated SQL/widgets and similar are retained only where the Customer or user saves them (e.g. as a Report or Dashboard). Transient AI input/output that is not saved is held only as long as needed to process the request. Provider-side handling at AWS Bedrock and ElevenLabs is governed by their terms (see clause 8).

7.7. Voice audio. Voice audio passes through ElevenLabs in real time during a session. Pace does not persist voice audio. Audio submitted for transcription is likewise not persisted; only the transcript is retained. Provider-side retention is governed by ElevenLabs' terms.

7.8. Termination. On termination, Customer Data is deleted or anonymised within the period described in the Terms (no later than 90 days, subject to legal-hold and backup retention cycles).

8. Sub-processors and recipients

We use the following sub-processors to operate the Service. Sub-processor relationships, processing locations, and data flows are reflected in the DPA; this list may be updated, with notice provided in accordance with the DPA.

User-configured MCP servers. A Customer or user may connect arbitrary third-party MCP servers to the Service. Where the user does so, data the user sends through the MCP connection is transferred to that third-party service under the user's responsibility. We do not act as sub-processor selector for MCP servers chosen by users; selection, contracts and lawful transfer mechanisms with such third parties are the Customer's responsibility.

No advertising or analytics sharing. We do not sell personal data. We do not share personal data with advertising networks. We do not use third-party analytics or tracking pixels in the application.

9. Cross-border transfers

9.1. The Service is hosted in the EU (Ireland) and we strive to keep personal data within the European Economic Area ("EEA"). However, certain sub-processors are based outside the EEA, principally in the United States (WorkOS, Google, ElevenLabs; Stripe and Slack have US affiliates).

9.2. For transfers of personal data outside the EEA, we rely on appropriate safeguards as required by Chapter V GDPR, including:

• (a) the EU-U.S. Data Privacy Framework ("DPF") where the recipient is self-certified under the DPF;
• (b) Standard Contractual Clauses ("SCCs") as adopted by Commission Implementing Decision (EU) 2021/914, with supplementary measures where appropriate following the Schrems II ruling; and
• (c) for AI inference, an EU-only AWS Bedrock cross-region inference profile that restricts inference to AWS EU regions, avoiding transfer of inputs outside the EU for that processing.

9.3. A copy of the SCCs and information about applicable supplementary measures is available on request from info@alto.se.

10. Cookies and similar technologies

10.1. The Service uses a minimal set of cookies and storage:

• (a) auth_session and auth_refresh: HTTP-only, secure cookies that hold the authenticated session and its refresh token. Strictly necessary for the Service to function (Article 5(3) ePrivacy Directive exemption for technical storage strictly necessary for the provision of a service explicitly requested by the user).
• (b) legal_ok: a signed cookie caching the fact that you have accepted the current Terms and Privacy Policy, so the check is not repeated on every request. Strictly necessary state.
• (c) Other strictly necessary state required for application functionality (e.g. authentication redirect state).

10.2. We do not use advertising cookies, third-party analytics cookies, tracking pixels or cross-site tracking. A consent banner is therefore not required by the ePrivacy Directive for the authentication cookie. If we add any non-strictly-necessary cookies in the future, we will obtain consent before placing them.

11. AI processing: additional disclosures

11.1. What runs through an LLM. The following Service features process input data through large language models hosted on AWS Bedrock (running Anthropic Claude): the chat assistant, time-entry rewrite, AI-generated SQL for reports, and AI-generated dashboard widgets. Speech-to-text transcription is performed by ElevenLabs, not by the LLM (see clause 4.8).

11.2. Inputs sent. Inputs may include the text or audio you provide, the conversation history, relevant Service context (such as schema metadata or selected records you reference), and authentication context required to authorise tool calls performed on your behalf.

11.3. Tool use. The chat assistant may, on your instruction, invoke API operations on your behalf, including operations against your Organisation's data and against external MCP servers you have connected. Such operations execute under your account permissions.

11.4. Provider terms. AWS Bedrock processing is performed under AWS's enterprise terms, which exclude use of customer inputs and outputs for training the underlying foundation models. ElevenLabs voice-agent processing is performed under ElevenLabs' terms.

11.5. Outputs. AI outputs are produced probabilistically and may contain errors. Outputs are not persisted by Pace unless the user explicitly saves them (e.g. as a Report or Dashboard widget) or as part of normal chat history within the Service.

11.6. Voice audio. When you use the voice agent, audio is transmitted to ElevenLabs in real time for the duration of the session. We do not persist the audio. Display name and similar context may be passed to the voice agent to personalise responses.

12. Data-subject rights

12.1. Subject to the GDPR and Swedish law, individuals have the following rights with regard to their personal data:

• (a) Right of access (Art. 15): obtain confirmation of, and a copy of, personal data we process about you.
• (b) Right to rectification (Art. 16): correct inaccurate or incomplete data.
• (c) Right to erasure / "right to be forgotten" (Art. 17): request deletion, subject to applicable exceptions (e.g. accounting-law retention).
• (d) Right to restriction of processing (Art. 18).
• (e) Right to data portability (Art. 20): receive personal data you provided to us in a structured, commonly used, machine-readable format, or have it transmitted to another controller where technically feasible.
• (f) Right to object (Art. 21), including to processing based on Article 6(1)(f) legitimate interests on grounds relating to your particular situation.
• (g) Right to withdraw consent, where processing is based on consent, without affecting the lawfulness of prior processing.
• (h) Right not to be subject to automated decision-making, including profiling, that produces legal or similarly significant effects (Art. 22). We do not currently make such decisions in the Service.

12.2. Where to exercise rights. If your personal data is held within a Customer's tenant (e.g. you are an employee of a Customer), please contact your Customer first; they are the controller for that data. Pace will assist Customers in responding to such requests under the DPA. You may also contact info@alto.se and we will route your request appropriately.

12.3. Verification. We may need to verify your identity before acting on a request.

12.4. Response time. We will respond within one month of receipt, extendable by two further months for complex requests in accordance with Art. 12(3) GDPR.

13. Right to lodge a complaint

13.1. You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

13.2. The Swedish supervisory authority is Integritetsskyddsmyndigheten ("IMY"), located at Box 8114, 104 20 Stockholm, Sweden; web https://www.imy.se. We would, however, appreciate the opportunity to address your concerns directly before you approach IMY. Please write to info@alto.se.

14. Security

14.1. We apply appropriate technical and organisational measures designed to protect personal data, taking into account the state of the art, costs of implementation, nature, scope, context and purposes of processing, and risk to natural persons.

14.2. Measures include, without limitation:

• Encryption in transit (TLS) and at rest for primary data stores (RDS Postgres, S3, Secrets Manager, DynamoDB);
• Tenant isolation enforced at the database layer using Postgres row-level security keyed on organisation identifier;
• Authentication via WorkOS AuthKit with support for Google federation; HTTP-only session cookies;
• Role-based access control distinguishing administrators from standard users;
• Network segmentation with private subnets for application and database tiers;
• Hashed API keys; application-layer encryption of integration credentials;
• Automated daily snapshots of the primary database;
• Access logging at the load-balancer and CDN tiers;
• Least-privilege IAM policies, principle of separation of environments;
• Engineering practices: code review, dependency management, security review prior to release.

14.3. No system is perfectly secure. In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority and, where required, affected individuals or Customers, in accordance with Articles 33 to 34 GDPR.

15. Data Processing Agreement (DPA)

15.1. Customers are offered a Data Processing Agreement governing Pace's processing of Customer Data as processor, including: scope, duration, instructions, sub-processor management, international transfers (Module Two SCCs where applicable), security measures, assistance with data-subject rights, breach notification, audits and return/deletion on termination.

15.2. To request the DPA, please contact info@alto.se.

16. Children

16.1. The Service is not intended for, or directed at, persons under the age of 16. Customers must not provision Service access to such persons. If we become aware that we have processed personal data of a person under 16, we will delete it without undue delay.

17. Automated decision-making and profiling

17.1. We do not currently make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

17.2. The AI assistant may generate suggestions (such as rewritten time-entry text or proposed SQL). These outputs are advisory and require human review and action before they take effect; we do not consider them automated decisions in the sense of Article 22 GDPR.

18. Changes to this Policy

18.1. We may amend this Privacy Policy from time to time. Amendments are versioned (see "Version" at the top of this document) and are effective on the date stated.

18.2. Material changes will be communicated via in-application notice and/or email to administrators of affected Customers, with reasonable advance notice.

18.3. Prior versions are retained for reference and made available on request to info@alto.se.

19. Contact

For any question about this Privacy Policy, or to exercise your rights, please contact:

Alto Professional Services AB Slottsbacken 8, 111 30 Stockholm, Sweden Organisationsnummer: 559244-1561

Data protection contact (Privacy Lead): info@alto.se General: info@alto.se Legal: info@alto.se

Swedish supervisory authority: Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden, https://www.imy.se.