Privacy policy

Version 2.17. Last updated: October 29, 2026.

AlvarCreations, a sole proprietorship registered in Sweden ("we", "us"), is the data controller for the personal data described in this policy. It applies to alvarcreations.com, the Alvar Suite panel for Adobe After Effects, any other product or service we offer, and purchases of any of them. Our registered name, postal address and organisation number are stated on every invoice we issue and are provided on request; all data protection enquiries should be addressed to info@alvarcreations.com.

In summary: we process personal data to run the Service, to keep it secure, and to make it better, and no more widely than those purposes need; we do not sell personal data; and material submitted to the AI features is transmitted solely upon your invocation of the feature concerned.

Categories of personal data processed

  • Account data. Your email address, the date the account was created, and the date of last sign-in. No password exists; one-time sign-in codes are stored only as hashes. A device identifier is retained for each device you sign in on, which is necessary to enforce the two-device limit. In the panel this identifier is a hash derived from the machine; on the website it is a random value generated in your browser, and in neither case does it identify you by itself.
  • Purchase data. Payment is processed by Stripe. Card details are never transmitted to or stored on our systems; we receive the card brand and last four digits, your email address, the items purchased, and the billing country. Checkout requires you to tick a box accepting the policies that form the contract, and we record the exact wording you accepted, the time, and the transaction it relates to, as evidence for both parties. For purchases made through our previous store we also keep the item bought, the time, and the town or region of the buyer, which is what the recent-purchases notice on the site draws on; no email address or name is attached to it. If you choose to give us an optional contact handle when you buy (such as a Discord username), we store it so we can reach you about support and membership; it is optional, and you can ask us to remove it at any time. Linking a Discord account is a separate choice, described under Discord data below. If you cancel a subscription, Stripe tells us the reason you chose from its list, or that a payment failed or was disputed (never anything you type there), together with the plan, when it started, when you cancelled and whether you changed your mind. We use this to understand why people leave, and the reason you choose can decide which offer, if any, Stripe's cancellation page shows you (our legitimate interest, Article 6(1)(f) GDPR).
  • How you found us. When you arrive on our website through a link that carries campaign tags (the utm_ values in the address), or from another website, your browser keeps, for that tab only, those tag values, the name of the site you came from (never its full address) and the path of the first page you opened. A visit that comes straight to the site keeps nothing. Nothing is sent while you browse. When you start a checkout, the tags go with it to Stripe and into our record of that checkout, together with the page you started it on and, when you came from the panel after reaching a locked feature, that feature and the plan you were shown; we then note whether the checkout was paid or left unpaid, and when you are signed in the record is tied to your account. The tags are also sent when you sign in on the website, and kept only if that sign-in creates your account, together with where the account was created: on the website (and on which page), in the panel, or at a checkout. A later checkout that carries no tags of its own, for example one started in the panel, is credited to the visit you signed up from. We use this to see which of our videos, posts and links bring customers. We do not use the tags to choose what we send you; whether you started a checkout and did not finish it can be, as described under Making what we send you relevant.
  • How you use the Service. So that we can see what is working and what to build next, we keep a record of significant events in your use of the panel and the website, tied to your account or to a device identifier. These include when you sign in, which presets and features you open and use, the order and frequency of that use, when you reach a plan limit or a credit ceiling, and when you come across a feature your current plan does not include. We use this to prioritise what we improve, to compare different versions of a feature, and to judge which of our features, plans or offers are likely to be genuinely relevant to you, so that anything we send is worth reading rather than generic.
  • AI usage data. Metering records identifying the feature invoked, the quantity of material processed, and the time, associated with a pseudonymous account identifier. These records determine credit consumption and therefore constitute billing records.
  • Support and chat data. Correspondence you send us, and conversations with the website chat assistant, which are stored to improve responses and to enable follow-up where you request it. An email address and name are recorded only if you give them to us, in the chat or earlier: if your browser still holds them from a purchase in our previous store, or from an earlier chat, the assistant reads them from there and they are stored with the conversation. Where a message is flagged as suspicious, a short extract of it is kept with the flag so that we can tell a real problem from a false alarm.
  • Technical request data. Keeping the Service available to everyone means being able to tell ordinary use from automated abuse. Our servers therefore record the IP address a request came from, together with the function called and the time, for every request to the parts of the Service that carry a rate limit, and on each licence activation and check (deactivations, sign-in code requests and deliveries of presets and styles are recorded without the address). Some limits count by your account, licence, device or a scrambled form of your email address instead of, or as well as, the address. This is counting rather than watching: the records exist to enforce limits and to investigate abuse, and they are never used to build a picture of you. For the panel's usage and security records the limit uses a scrambled form of the address that changes every day, never the address itself. For downloads under our older store links, the address is stored as a salted hash rather than in the clear. Separately, for some of our server functions, such as downloads, the tutorials list, Scene switch detection and the panel's usage records, we count each call with the time, the function called, the panel version, whether it succeeded, how long it took and the country it came from, with no account, IP address or other identifier attached. We work out that country from the IP address at the moment of the call, using a list of address ranges kept on our own servers (see the credit under Contact), and keep only the country: the address is not stored with the count and is not sent to anyone for this.
  • Discord data. Linking your Discord account is optional. When you link it, we store:
    • your Discord user ID, username, display name, nickname and profile picture link;
    • your level on our server, and when our bot last saw you there;
    • your past usernames, display names and nicknames;
    • the Discord rewards you receive, and when you received them.
    The bot keeps this up to date while you stay linked. We use it to give you the right role, send your rewards and help you faster with support. Our team can look up your email, plan, credits and rewards from Discord. Only our team sees that reply. We may also use it to choose which offers we send you, for example a reminder before reward credits expire. You can unlink at any time. After that, we stop updating this data.
  • Affiliate program data. We run an affiliate program that people apply to and that we approve by hand. If you buy with an affiliate's code, or through an affiliate's link, we record which affiliate's code you used and, for the twelve months after that, the amounts you pay, so that we can work out that affiliate's commission. The affiliate sees what they earned and when, and a numbered list of the customers who used their code (“Referral 1”, “Referral 2” and so on) showing the date each one joined, whether their subscription is still active and when it next renews, and what the affiliate earned from them. They never see your name or email address. An affiliate who knows who they referred could still recognise you from the date you joined, which is why we show nothing more. If you apply to the affiliate program, we keep your application: your name (or the name you use online), your email address, the social profiles you give us (Instagram, YouTube or TikTok), your Discord name if you choose to give us one, the country you live in, and that you accepted the Affiliate Program Terms, which is also how you confirm you are old enough to take part, and that you were shown this policy. For each affiliate in the program we also hold their code, their account, a scrambled copy of their private dashboard link if they have one, the payments their customers made, our own notes about them, and a record of each commission payment: its date, who it was paid to, the amount in dollars and in the currency we paid, the exchange rate, the affiliate's country and the Stripe transfer reference. We email affiliates about the program: when someone uses their code, about setting up payouts and getting paid, and about changes to the terms. If an affiliate's country is missing we may record it ourselves from what they have told us; they can ask to see it and correct it. Payouts go through Stripe. When an affiliate sets up payouts, we give Stripe their email address, their name as it appears in their application, their country and their referral link. Stripe then collects their identity and bank details directly and holds them under its own privacy policy. Stripe gives us access to the identity it holds for an affiliate. From it we keep only their legal name and whether they are a person or a company, which Swedish bookkeeping law requires us to record for each payment. We do not keep their address, date of birth, identity number or bank details. We also keep what Stripe reports about the account: an identifier for it, its country, whether it is ready to be paid, and what Stripe is still waiting for. If an affiliate is registered for VAT they may give us their VAT number, and we use it to identify them in our books.
  • Email engagement. For the email we send you, we keep a record of what was sent and whether it was delivered, opened, or a link in it was followed. This is how we tell a useful message from an unwelcome one and send fewer of the latter.
  • How an update turned out (sent whatever you choose). From panel version 1.1.0, when the panel checks for updates it also tells us how the last update went: that it installed, that it was running after you restarted After Effects, that it failed and at which step, or that it had to be undone. What we receive is one word and two version numbers, the version you had and the version you moved to. Nothing else travels with it. We keep it only as a daily count for each pair of versions and each outcome, with no account, device, IP address or other identifier of any kind, so there is nothing in it that can be traced back to you or to your computer. We send it whether or not you agree to diagnostics below, because a bad update can stop the plugin working altogether, and without this we would have no way of knowing that it had.
  • Diagnostic data (on unless you turn it off). When something in the panel fails, it sends us a report: an error code, a short technical description of what failed, which feature was involved, your After Effects and operating system versions, the panel version, and hashed identifiers. A short reference number is included so you can quote it to us. When the failure happened during an AI job you paid for, the report also carries that job's reference, so we can match the failure to the run and give the credits back where they were taken for nothing. It also carries a short list of the panel's own last few steps, in our internal names, such as which tab was opened, which tool was expanded, and which calls the panel made. It contains no files, file names, project contents, or email address, and nothing you type or name. The same reports, under the same switch, also tell us when you click to buy credits or to see the plans after reaching a limit, and which of the two you chose; when you are signed in we link that click to your account, to see whether a purchase followed within a week. Because the hashed identifiers are the same scrambled account and device references already used to run your licence, a report can be linked to your account; it is pseudonymous, not anonymous. Diagnostics are on when you install the panel. You can turn them off at any time with the Send diagnostics switch in the panel's Account tab, and the panel works identically either way. One message is not covered by that switch and is sent whatever you choose: when an AI job you paid for produces nothing usable, the panel tells us the job's reference and a short failure code so the credits can be returned. That is part of settling what you paid for, it carries nothing else, and without it we could not give the credits back.
  • Usage information from the panel (the same switch). From version 1.8.0, the panel also sends short records of how it is used: when it starts and how long that takes, when you turn Send diagnostics on or press Got it on the notice below, how long a session lasts and how many tabs, tools and errors it had, which tabs you open and for how long, which tools you run, whether each one worked and how long it took, which style and look you insert with Manual captions, when you run out of credits or reach a feature your plan does not include, when you click to buy credits or to see the plans, error codes, when your connection drops or comes back, and your operating system, After Effects version and panel version. Every name in these records is one of ours, such as the name of a tool, a tab or one of our caption styles; a style you made yourself is recorded only as your own style, never by its name. The records never contain your footage, audio, captions, transcripts, prompts, file or folder names, project contents, or anything you type. Each one carries a random identifier for your installation, a random identifier for that session, the tab that was open and when it happened. When you are signed in, our server normally links the records to your account. That lets us see how each plan is used and notice when one account shows up on far more installations than its two-computer limit explains; such a flag only alerts us, and never blocks an account by itself. Records made while you are signed out carry the installation and session identifiers but no account. We do not store your IP address in these records, and we do not use them to choose what we send you. Trying to use a feature your plan does not include is also recorded separately, as described under How you use the Service; that record is kept for 24 months and is used to judge which plans or offers suit you. This information is on when you install or update to version 1.8.0. The first time the panel opens with it on, it tells you so once, in a short notice that also says where to turn it off; when you press Got it on that notice, and the version of the notice, are kept on your computer. Turning off Send diagnostics in the Account tab, at any time, stops these records, and from version 1.8.0 that separate record too.
  • Security checks (the same switch). From version 1.8.0, shortly after it starts (or after you turn Send diagnostics back on), the panel looks for signs that it is a pirated copy that gets around the licence, or a modified panel used to pull out our paid presets and styles. It checks whether After Effects is set to run extensions in debug mode, whether the panel's own folder holds a debug file or is a link to another folder, and whether the panel is running from somewhere other than its normal extensions folder or under a name other than its own. If none of these applies, nothing is sent. When one does, the panel sends a record saying which, with the time, the panel version, the installation and session identifiers and, when you are signed in, your account. It never sends a file path or a file name; the record holds only what is listed here. Debug mode is also used by developers and by some other extensions, so a record proves nothing by itself, and it never blocks anything. Turning off Send diagnostics stops these checks: the panel then no longer reads these settings for them.
  • When After Effects stops unexpectedly (the same switch). From version 1.8.2, while the panel is open it keeps a small file on your computer about the current session: when it started, the tab that is open, which of the panel's own functions is running and for how long, and its last 20 steps in our internal names, such as a tab opened, a call to our server, the connection dropping, a step of an update, or After Effects coming to the front or going to the back. It never holds what a function was given, a file or folder name, or anything you type or name. When the panel closes normally, the file is marked closed and later deleted without being reported. If the panel finds a file that was not marked closed the next time it starts, it asks your operating system how that session ended: on Windows it reads the crash and hang entries in the Application event log from that time and uses only those about After Effects; on a Mac it reads the crash reports macOS keeps for After Effects in your Library folder. It then sends us one record for each such session, at most three at a time: whether After Effects crashed, stopped responding, or closed without the panel noticing, how long the session had run, how long ago it ended, what the panel was doing last, your After Effects, operating system and panel versions and, for a crash or a hang, the name and version of the program part the operating system says failed (which can be part of After Effects or another plugin you have installed), the error code and where in that part it happened. That record is part of the usage information above, with the same identifiers, and is kept like it; a crash or a hang is also sent as an error report, with the same hashed identifiers as one, and kept like one. We never send the operating system's crash report itself. The file is deleted once it has been read, and one that is never read is deleted after 14 days. Turning off Send diagnostics stops this: the panel then keeps no such file, reads no crash records, and deletes the files it holds.
  • While the panel is open (the same switch). While the panel is open and you are signed in it sends a short message every three minutes to say it is still running: your account, the panel version, and the time. We use this to see how many people have the panel open right now, roughly how many accounts use it over a day, how long a working session lasts, and which panel versions are in use, so that we can tell whether a release is healthy. It carries no IP address, no project or file names, and nothing about what you are working on. We keep only the current session, one row per account, and never a history of when you had the panel open. Turning off Send diagnostics stops this too.
  • What you choose in a Flow (the same switch). When you use a step of a Flow that changes your project, the panel also sends a short record of the shape of your edit and what you chose, so that the panel can learn to suggest those choices: the number of clips, how many frames each one runs and the gaps between them, where the edit starts in the composition and how long the composition is, the frame rate, how many of the clips are tracked or already pre-composed, which clips a step was limited to, which of our transitions, hits and looks you put on which clip or that you used a look of your own, and which effects were involved, by the fixed name After Effects gives each effect rather than any name you gave it, with how each one is timed. Clips are identified only by their position in the edit. The record carries no account, device, IP address or other identifier, and no names, files, footage, text or settings of yours, so nothing in it can be traced back to you or to your computer. Turning off Send diagnostics stops this too.

Processing of audiovisual material submitted by you

The AI features operate on material you select. No material is transmitted until you invoke the feature concerned. When you do:

  • Auto Captions sends the composition's audio to ElevenLabs for speech-to-text. The resulting text transcript is then sent to Anthropic, which decides where captions should break and which phrases must be kept together. Where you additionally enable Smart Emphasis, a second analysis pass is sent to Anthropic to choose styling. No audio is sent to Anthropic, only text.
  • Dialogue Isolation sends the audio to ElevenLabs and returns the cleaned track directly.
  • Sound Effects sends only your text description to ElevenLabs.
  • AlvarAI, the assistant, sends what you type together with a short description of the composition you have open, so that it can answer usefully. That description lists the names, types and timings of your layers and compositions. It contains no media: no video, no audio and no images are sent to Anthropic at any point.
  • Auto Tracker and Scene switch detection send the video clip to our own model hosted at Replicate, where inputs and outputs are automatically deleted within one hour.

Improving the assistant. Conversations with AlvarAI are kept so that we can find the things it gets wrong and put them right. In an early product this is how it improves: a request it misunderstood, or a tool it reached for incorrectly, is only visible in the exchange itself. Conversations are reviewed for that purpose alone. They are never used for advertising and never sold or shared, and no provider trains a model on them. Were we ever to want to use them to train an AI model, our own or anyone else's, we would ask for your agreement first. Where you rate an answer with the thumbs beneath it, that rating and any comment you add are kept with the exchange, because a rating is the clearest signal we receive.

You decide whether this happens. The setting sits in the panel, in the Account tab, under Keep my AlvarAI conversations. It is on to begin with, and turning it off stops conversations being kept from that moment on; AlvarAI carries on working exactly as before. You can also ask us to turn it off, or to delete what has already been kept, by writing to the address at the end of this policy, and we will do it.

This is separate from the plugin's Send diagnostics switch, which covers the diagnostic, usage, crash and security information described above and never contains your footage, audio, files or anything you type.

We keep no copy of your media. It passes through our servers to the provider that performs the feature, the result comes back to you, and all we keep is the metering record described above. The providers hold it briefly on their own side in order to do the work: Replicate deletes the inputs and outputs of a prediction within one hour; Anthropic deletes API content within 30 days, unless its systems flag it under its usage policy, in which case it may keep it for up to two years; ElevenLabs retains an API history on its own systems, which we can and do have deleted on request. Our ElevenLabs workspace is configured with provider model training disabled, and Anthropic is contractually prohibited from training on API content, so nothing you submit trains a provider's model. If we ever wanted to use submitted material to train a model of our own, we would ask you first and it would be your choice to opt in; we do not do so today.

One narrow exception, for everyone's protection. Where we have specific reason to believe a submission breaches clause 8 of the Terms of Service, for example because someone has reported it to us under clause 8.3, we may keep the material involved for up to 30 days so that the report can actually be looked into, and longer where it is needed to establish or defend a legal claim. This rests on our legitimate interest in preventing misuse of the Service and in being able to act on a complaint.

Face and voice processing. Auto Tracker locates and follows a face in your footage so the shot can be stabilised or re-framed, and the audio features analyse or separate speech. This processing detects and follows those characteristics only to perform the function you request. It does not identify anyone, does not match anyone against any database, and creates no persistent facial or voice template; the video or audio is processed and then deleted as described above, and nothing derived from a face or a voice is stored. Data of this kind may be considered biometric data under some laws (for example in certain U.S. states), which is why we describe our handling of it here in full. Because the people in your footage are yours to record, obtaining any consent that the law of your location requires from them is your responsibility, not ours.

Purposes of processing and the legal bases relied upon

  • Providing what you bought (accounts, delivery of content, AI processing you request, support): performance of our contract.
  • Billing, receipts, and bookkeeping: legal obligation (Swedish bokföringslagen) and contract.
  • Preventing fraud and abuse, including rate limits, trial caps, licence-sharing checks, download-abuse controls and the security checks described above: our legitimate interest in protecting the Service and our content against fraud and unauthorised use, specifically a pirated or modified copy of the panel used to get around the licence or to pull out our paid presets and styles, one account used on more computers than its licence allows, and our content being downloaded in bulk, applied no more broadly than necessary (Article 6(1)(f) GDPR).
  • Diagnostics, the usage information, crash reports and security checks in the panel, and the open-panel message: our legitimate interest in keeping the plugin working, in finding failures we would otherwise never hear about, in telling whether a release is healthy, in deciding what to improve and build next, and in spotting a pirated or modified copy of the panel, under Article 6(1)(f) GDPR. All of these are on by default and, apart from the two messages described above as sent whatever you choose, all of them stop the moment you turn off the Send diagnostics switch in the panel's Account tab; you may also object to this processing at any time by writing to us. For the same reasons our servers count the calls to some of their functions; that count carries no identifier and does not depend on the switch. Turning them off has no effect on the panel or on anything you have bought.
  • Understanding and improving the Service: we examine how the tools are actually used, at the level of individual events tied to an account or device as well as in aggregate, to decide what to build next, to find what is not working, and to run experiments comparing different versions of a feature. This rests on our legitimate interest in developing our own products, and you may object to it at any time by writing to us. From panel version 1.8.0, the records of reaching a plan limit or a locked feature described here are not sent if you have turned off Send diagnostics. Earlier versions of the panel send that record whichever you choose.
  • Making what we send you relevant: we use the same usage information to work out which of our features, plans or offers are likely to suit how you actually work, so that a message we send is worth your time. This rests on our legitimate interest in promoting our own similar products. You have an absolute right to object to your data being used for direct marketing, at any time and without giving a reason, and we will stop; the unsubscribe link in any message does this immediately, or you can simply write to us.
  • Measuring which of our videos, posts and links bring customers: the How you found us information, where an account was created, and whether a click to buy credits or see the plans in the panel was followed by a purchase. This rests on our legitimate interest in knowing which of our marketing works, under Article 6(1)(f) GDPR. It is not used to build a profile of you, and you may object at any time by writing to us.
  • Improving the assistant: keeping and reviewing AlvarAI exchanges so that the things it gets wrong can be found and corrected, as described above. This rests on our legitimate interest in improving the quality of the assistant, and the account setting described in that section turns it off.
  • Running the affiliate program: reviewing applications, recording which affiliate's code a purchase used, and working out and paying that affiliate's commission. For customers this rests on our legitimate interest in paying affiliates accurately for the customers they send us; for affiliates it is part of our agreement with them, the Affiliate Program Terms (Article 6(1)(b)). The record of each commission payment is also needed to meet the Swedish Bookkeeping Act (Article 6(1)(c)), and checking where an affiliate lives, to know that we can pay them, rests on our legitimate interest in running the program lawfully (Article 6(1)(f)).
  • Website analytics: understanding which pages people visit and where they run into trouble, so the site can be improved. This is counted as totals only, with no cookie and nothing stored on your device, and rests on our legitimate interest in knowing whether the site works.
  • Marketing email: any promotional email is sent either with your consent or, to existing customers, about our own similar products on the basis of legitimate interest, and always carries a working unsubscribe link. Transactional email (sign-in codes, receipts, important service notices) is part of the service.
  • Smaller purposes: linking Discord, the Discord data described above, and giving us an optional contact handle rest on your consent, which you withdraw by unlinking or asking us to remove it; the recent-purchases notice on the site rests on our legitimate interest in showing that people buy here, and uses no name or email address; the message that returns credits for a failed paid AI job is part of performing our contract with you.
  • What you must give us: to create an account we need your email address, and to buy we need what Stripe asks for to take payment; without them we cannot provide the Service. Everything else is optional or collected automatically as described above.
  • Children: the Service is not meant for children under 13, and we do not knowingly keep their accounts. As our Terms say, to buy you must be 18, or have the permission of a parent or guardian.

Recipients and processors

Personal data is disclosed to the providers that operate the Service, listed below. We do not sell personal data and do not disclose it for any purpose other than those stated in this policy, save where required by law.

  • Stripe (payments, and affiliate payouts; Stripe Payments Europe Ltd, Ireland, or the Stripe company in the affiliate's country). For affiliate payouts we give Stripe the affiliate's email address, name, country and referral link. For fraud prevention, compliance, its Link feature, and the identity and bank details it collects from affiliates in order to pay them, Stripe acts as an independent controller under its own privacy policy.
  • Apple and Google, where you choose to pay with Apple Pay or Google Pay. These wallets are offered inside Stripe’s hosted checkout, on Stripe’s own domain, and we neither see nor receive your wallet credentials. If you use one, the wallet provider processes the transaction as an independent controller under its own terms, and may use data about the transaction for its own purposes, including analytics. See Apple’s privacy policy and Google’s privacy policy. Choosing a card instead avoids this entirely.
  • Supabase (our database and backend; hosted in the EU, Ireland).
  • Cloudflare (website hosting and content delivery).
  • Resend (sends our email; processes in the United States, retains email data about 30 days).
  • ElevenLabs (audio processing, as above).
  • Anthropic (text analysis and the site chat assistant, as above).
  • Replicate (video processing for Auto Tracker and Scene switch detection, deleted within one hour, as above).
  • Google (Gmail), where we prepare a reply or a follow-up to a customer by email; the recipient address and message pass through that account.
  • Better Stack (availability monitoring; Better Stack, Inc., United States). It checks from the outside that our website and services are responding, by requesting a few of our own addresses on a schedule. It receives no information about you: no page views, no browser or device details, no media, no projects, and nothing from your account.
  • Discord, where you have chosen to link your Discord account. We tell Discord which role your account should have on our server. Our team can look up your account from Discord. The details shown to them then pass through Discord.
  • The affiliate whose code or link you used, limited to what is described under Affiliate program data.
  • Shopify, for orders placed through our previous store and for the store knowledge base the chat assistant consults. This role ends when our migration away from Shopify completes.

Our providers use providers of their own. Each provider above relies on its own sub-processors, for example hosting and infrastructure vendors. Data protection law (Article 28 GDPR) requires our providers to pass the same duties on to those sub-processors by contract, and each provider publishes its own current sub-processor list. We review those lists when we choose a provider and when we revise this policy.

If the business changes hands. If we sell, merge or reorganise the business, personal data may pass to whoever goes on running the Service, so that your account and your purchases continue to work. They would be bound to keep processing it for the purposes set out in this policy, and we would tell you of any change to those purposes.

Aggregated and anonymised information. We may compile and publish statistics about how the Service is used which do not identify anyone and from which no individual can be picked out. Information in that form is no longer personal data, and we may use it without restriction, including in our own marketing.

Transfers to third countries

Our database lives in the EU, but several providers above process data in the United States, and some Supabase platform operations (edge computing, platform logs) also run outside the EU. For these transfers we rely on the EU-U.S. Data Privacy Framework where the provider holds an active certification, and on Standard Contractual Clauses in the providers' data processing agreements otherwise. As at the date of this version, Stripe, Cloudflare, Resend and ElevenLabs hold active certifications, and Supabase, Anthropic, ElevenLabs and Better Stack are covered by Standard Contractual Clauses. Certifications are renewed annually, and we re-check each provider's status whenever we revise this policy. Replicate (United States) has not published a data processing agreement or transfer safeguards, so video is sent to it only when you run Auto Tracker or Scene switch detection, relying on Article 49(1)(b) GDPR (the transfer is necessary to perform the service you asked for), and it is deleted within the hour.

Retention periods

  • Account data: for as long as the account exists. It is deleted on request.
  • Purchase and credit records, and the checkout acceptance record: seven years, as required by the Swedish Bookkeeping Act (bokföringslagen). These are retained notwithstanding a request for erasure, because keeping them is a legal obligation and the record is evidence for both of us of what was agreed. This covers the record of the terms accepted at checkout, and not any other permission you give us, which you remain free to withdraw at any time.
  • Records relating to a suspected or established breach of our Terms: for as long as necessary to establish, exercise or defend legal claims.
  • Sign-in codes: valid for ten minutes, and the expired records are deleted within seven days.
  • Chat records (the website chat and AlvarAI conversations): deleted automatically after twelve months. Diagnostic records: deleted once they are 12 months old, or sooner on request.
  • Open-panel message: one row per account, overwritten each time the panel checks in, and deleted 24 hours after the last message. The deletion runs every hour whether or not any panel is open. Turning the switch off stops new messages immediately; the existing row then ages out through the same sweep, within 24 hours. It is deleted immediately if you delete your account.
  • Flow choice records: deleted automatically two years after they are made. They carry no identifier, so no record can be found for, or deleted for, any one person.
  • Usage and event records: the panel's usage information described above (from version 1.8.0, not the error reports) is deleted once it is 90 days old; the deletion runs every day. The record made when you try to use a feature in the panel that your plan does not include is deleted once it is 24 months old, and the record of which presets your panel fetches from us (including when it keeps your library up to date) once it is 12 months old; both deletions run every day. Other usage and event records are kept while they remain useful for understanding how the Service is used, and reviewed periodically so that anything no longer serving that purpose is removed.
  • Security check records: deleted once they are 13 months old, with the session records they belong to. An installation record is deleted once it has been unused for 90 days and no kept security record refers to it. Security records are kept longer than usage records so that misuse noticed later can still be looked into. When a check raises a flag, our note of it is deleted after 12 months.
  • Records of which files your account downloaded, and of download requests we refused, are kept for 12 months and then deleted.
  • Technical request records: the rate-limit records are deleted every hour once they are 24 hours old. Licence activation and check records are deleted once they are 24 months old, and the address of a routine check is removed after 90 days; the records of presets and styles delivered to your account are deleted once they are 12 months old. Licence records are kept this long so that misuse of a licence and payment disputes, which can arrive long after a payment, can still be looked into. The count of calls to our server functions, which carries no identifier, is deleted once it is 90 days old.
  • Cancellation reasons: deleted 24 months after the subscription ended; if you changed your mind and it is still running, 24 months after it finally ends.
  • How you found us: the tags and where an account was created are kept with the account and deleted with it. The record of each checkout started, with its tags, page and outcome, is kept while it remains useful for understanding which of our marketing works, and reviewed periodically so that anything no longer serving that purpose is removed; if your account is deleted, the record no longer points to it.
  • Email engagement records: deleted once they are 24 months old, or sooner on request.
  • Affiliate program records: which affiliate's code a purchase used is kept for as long as commission can be owed on it; an affiliate's application and details are kept while they take part in the program and deleted on request, except the record of each commission payment, which the Swedish Bookkeeping Act requires us to keep until the end of the seventh year after the calendar year in which it was paid, even if you ask us to delete your account. The identity and bank details an affiliate provides to Stripe are held by Stripe under its own policy and retention rules. We cannot delete them on your behalf. Deleting your affiliate record with us does not delete what Stripe holds, and financial regulation requires Stripe to retain some of it regardless; a request to remove that data must be made to Stripe.
  • Free starting credits withheld: the note that a new account did not receive the free starting credits, because the computer it was first used on already had two other accounts, is kept while the account exists, because it is what stops those credits being given twice.
  • Discord data: kept while your account exists. It is deleted with your account, or earlier if you ask.
  • Submitted media: no copy retained, save for the narrow abuse-investigation exception described above.

Rights of the data subject

Your right to object. Where we rely on our legitimate interests, you may object at any time, on grounds relating to your particular situation, and we will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for a legal claim. Where we use your data for direct marketing, you may object at any time without giving a reason, and we will stop. For the panel's diagnostic, usage and security information (panel version 1.8.0 and later), the Send diagnostics switch in the Account tab stops new records at once; to have what was already collected deleted, use Delete my usage data, described below, or write to us. For anything else, write to info@alvarcreations.com.

Under the General Data Protection Regulation you have the right to access your personal data, to rectification, to erasure, to restriction of processing, to object to processing carried out on the basis of legitimate interests, and to data portability. To exercise any of these rights, write to info@alvarcreations.com from the address registered to your account; we respond within one month. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out beforehand. You can also ask us for the assessment behind each legitimate interest named in this policy.

You can delete the panel's usage and security records tied to your account yourself, at any time: sign in, open the Account tab and click Delete my usage data. They are deleted from our live systems straight away, together with the records of the sessions they belong to and any flag we raised from them. Anything still waiting to be sent from your computer is discarded, and the panel carries on with new identifiers. Records made in an earlier session while you were signed out are not tied to your account (they carry only the installation identifier), so they cannot be found this way; they are deleted after 90 days like the rest. Error reports, the other diagnostic reports, and the records of reaching a locked feature are kept separately; write to us to have those deleted.

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se) about how we process your personal data, and with the Swedish Post and Telecom Authority (Post- och telestyrelsen, PTS, pts.se) about what the panel, the website or our emails store on or read from your device, described below under Cookies and local storage. We would ask that you raise the matter with us first.

We do not make solely automated decisions that produce legal or similarly significant effects about you, and we do not sell your personal data.

Personal data breaches

If a security incident affecting your personal data occurs and is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, describing what happened, the likely consequences, and the steps we are taking, in accordance with Article 34 of the General Data Protection Regulation. We also report a breach to the Swedish Authority for Privacy Protection within 72 hours of learning of it, unless it is unlikely to put anyone's rights at risk (Article 33 GDPR), and we keep a record of every breach.

Cookies and local storage

This site sets no advertising cookies and takes part in no advertising network. A limited amount of browser storage is used: the chat session and, if you have given the chat assistant your email address and name, those, so that it can recognise you next time; dismissed prompts; interface preferences, such as the currency you chose or were last shown; a creator's discount code when you arrive through their link; how you arrived at the site, described under How you found us; and, when you come to the site from the panel after reaching a locked feature, which feature and plan that was, so that a purchase can be credited to it. The discount code, how you arrived and the panel feature are kept only in that tab and are gone when you close it.

Website analytics. We use Cloudflare Web Analytics to count how many people open each page. It sets no cookies. It stores nothing in your browser. It does not follow you between visits, does not build a profile of you, and is not shared with any advertiser. What we see is totals: how many people opened a page, roughly which part of the world they were in, and what kind of browser and device they used. Cloudflare sees your IP address to deliver the page, as on any visit, but we see only totals, which is why this site shows you no cookie banner. If you would rather it did not run at all, any browser setting or extension that blocks analytics scripts will stop it, and the site works exactly the same.

Embedded video uses YouTube's no-cookie player and loads only on interaction. Stripe's checkout is hosted on stripe.com and sets cookies under Stripe's own policy; if you pay there with Apple Pay or Google Pay, that wallet's provider may also set storage of its own, again on Stripe's domain rather than ours.

The panel. The Alvar Suite panel, unlike the website above, keeps on your computer what it needs to work, such as your sign-in, your settings, your AlvarAI conversations and copies of the presets and styles you have downloaded. What follows is not needed for the panel to work, which is why the Send diagnostics switch turns it off. While the switch is on, the panel keeps the random installation identifier described above, holds usage records and error reports on your computer until they can be sent (for example while you are offline), and, for the security checks, reads the debug-mode setting that Adobe stores for extensions by asking your operating system, and looks at the panel's own folder: where it is, whether it is a link, whether it holds a debug file, and the name After Effects gives it. From version 1.8.2 it also keeps the small session file described under When After Effects stops unexpectedly and, when a session did not close, reads the operating system's crash and hang records from that time. Turning the switch off removes the identifier, anything waiting to be sent and those session files. The panel also keeps a few markers noting which one-time milestones it has already reported; they hold nothing else and never leave your computer on their own.

Amendments to this policy

Where this policy is amended, the revised version is published at this address with a new version number and date. Amendments that materially affect your rights are notified to account holders by email in advance.

Contact

AlvarCreations, Sweden. Data protection enquiries: info@alvarcreations.com. Registered name, postal address and organisation number are stated on every invoice and provided on request.

Country data: IP Geolocation by DB-IP, used under the Creative Commons Attribution 4.0 licence.