Privacy Policy
This policy explains how Alvin AI Lab, an international AI SaaS provider serving customers worldwide, handles personal data on ai.alvinailab.com. Payments are processed by our payment partners Lemon Squeezy and Payoneer.
1. Data we collect
- Account data: email, name, optional phone number, sign-in method (email/password, Google or GitHub) and a salted password hash — never your plaintext password.
- Payment records: pack, amount, currency, payment provider, and order and transaction IDs. Card and PayPal details are entered on the Lemon Squeezy checkout and never reach our servers; Lemon Squeezy shares with us the order status and the email and billing country needed for receipts and tax.
- Creation data: prompts, settings, files you upload and the images, video and audio you generate, plus your credit ledger.
- Security data: IP address, approximate location derived from the IP (country/region/city), browser user-agent and sign-in history, used for fraud and trial-abuse prevention.
- Optional device location: only if you click "Allow" on the in-app location prompt, your browser shares approximate coordinates with us for stronger account protection. We ask once, you can decline ("Not now") with no loss of features, and you can withdraw consent in your browser settings at any time.
- Support messages you send us.
We never ask for, and you should never send us, mobile-banking PINs or OTPs.
2. Why we use it
To run your account and studio; deliver generations and keep your credit balance accurate; verify payments, issue invoices and prevent fraud (including limits on free-trial abuse); send transactional emails (invoices, security alerts, password reset); keep the service safe and reliable. Legal bases (GDPR-style): contract performance, legitimate interests (security and fraud prevention), legal obligation (tax and accounting records) and consent (optional device location).
3. Sharing
We share data only with processors that need it for the stated purpose. We do not sell personal data.
- AI generation providers: fal.ai (primary) and, if it is unavailable, fallback model providers — receive your prompts and uploaded files to produce the output.
- Payment providers: Lemon Squeezy (checkout and merchant of record) and Payoneer (international payments and payouts). Local providers (bKash, Nagad, SSLCommerz, UddoktaPay) are coming soon and will be listed here as active when launched.
- Sign-in providers: Google and GitHub, if you use social sign-in (we receive your verified email, name and avatar).
- Email delivery: Resend.
- Hosting & security: Hetzner (servers) and Cloudflare (DNS / network protection) where enabled.
- Authorities only when legally required (for example CSAM reports or valid court orders).
Some providers process data outside your country, including outside Bangladesh and the EU/EEA; we rely on their contractual safeguards where required.
4. Retention
Account, credit-ledger and order records are kept while your account is active and up to 3 years after closure for accounting, tax and dispute purposes. Sign-in and location logs are deleted automatically after 90 days. Generated files are kept in your library until you delete them or close your account. Support tickets are kept up to 2 years. You may request earlier deletion (see §6) unless the law requires retention.
5. Cookies & local storage
We use one strictly-necessary, HTTP-only session cookie to keep you signed in, plus a few browser-storage entries for your preferences (for example your location-prompt choice). No advertising or cross-site tracking cookies.
To count visitors we also set an anonymous, random first-party identifier cookie (alvin_vid, up to one year). It lets us show aggregate figures such as people online now and daily visitors. It contains no personal data, and we do not store your IP address or build a device fingerprint for this purpose. Pages that also show partner promotions (for example Amazon or AlvinFlix) link out to those sites; any tracking there is governed by their own policies.
6. Your rights
You may request access, correction, export or deletion of your data, object to processing, or withdraw consent, by emailing support@alvinailab.com with the subject "Privacy request". We respond within 30 days. Deletion removes your studio data but retains minimal order records that the law requires us to keep.
7. Children
Accounts require age 13+. We do not knowingly collect data from under-13s; such accounts are removed on discovery.
8. Security & changes
Passwords are stored as salted hashes, sessions use secure HTTP-only cookies over HTTPS, and API keys live server-side only and are never exposed to browsers. No system is perfectly secure; tell us at once if you suspect a problem. Material changes to this policy will be announced in-app or by email before they take effect.
← Back to ALVIN.AI