Privacy Policy

This Privacy Policy explains what personal data AltTextLab collects, why, who receives it, where it is processed, how long we keep it, and what rights you have. It applies to visitors of alttextlab.com, users of the AltTextLab dashboard, API, browser extensions, Web Snippet and CMS or e-commerce integrations, and business customers and their authorized users.

‍

Processor. For the images, URLs, and contextual information that you submit to generate alt text ("Customer Content"), you decide the purposes and means, and we process it on your behalf as a processor.

‍

Data we collect

• Account data: email address, authentication tokens and session data (Google Firebase Authentication), account settings, API keys. Source: you.
• Customer Content: image URLs; image files sent in Base64 format; contextual information you add (page title, product name, brand, keywords); the generated alt texts. Source: you or your connected CMS or store.
• Integration data: for store and CMS integrations such as Shopify, the shop identifier, the product and image data needed to generate and apply alt text, and installation and uninstall events. Source: your store or CMS.
• API and usage data: timestamps, endpoint, response status, credit usage, IP address, device and browser type, feature usage events. Source: collected automatically.
• Billing data: plan, transaction history, billing email. Card and bank details are collected only by Paddle, never by us. Source: you and Paddle.
• Support data: name, email, and message content when you write to us or use the live chat. Source: you.
• Analytics and cookie data: pages visited, referrer, device information, cookie identifiers, your cookie consent choice. Source: collected automatically, with consent where required.

Contextual information that you submit may sometimes contain personal data, for example a person's name in a product description. We process it only on your instruction to generate alt text, and we ask you not to submit special categories of data (such as health data) or images you have no right to submit.

‍

We do not knowingly collect personal data from children under 18.

‍

Why we use data

• Provide the Service (create accounts, generate and store alt text, apply it through integrations, deliver the Web Snippet). Data: account data, Customer Content, integration data.
• Billing, invoices, tax and accounting records. Data: billing data.
• Security, abuse prevention, rate limiting, fixing errors, service improvement. Data: API and usage data.
• Customer support and replies to enquiries. Data: support data.
• Product and website analytics. Data: analytics and cookie data.
• Service emails (account, billing, changes to terms). Data: account data.
• Marketing emails, if you subscribe. Data: email address.
• Defending legal claims and meeting legal duties. Data: any data as needed.

We do not sell your personal data. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI is used only to generate alt text for images that you submit.

‍

AI processing

To generate alt text, the Service sends the image (or its URL) and the contextual information you provided to AI model providers listed in section 5, which act as our subprocessors. They process it only to return the result.

‍

No AI training. We do not use Customer Content to train AI models.

‍

Review the output. AI output can be inaccurate. You are responsible for reviewing generated alt text before publishing it, as explained in our Terms.

‍

Subprocessors and other recipients

We share personal data only with the companies below, and only what each needs for its purpose. They are bound by data protection agreements or terms that require them to protect the data. We will update this list before adding a new subprocessor that processes Customer Content.

• Amazon Web Services (AWS). Purpose: hosting and private S3 storage of Base64 image files. Data: all Service data, Customer Content. Location: US (us-east-1, N. Virginia). Safeguard: EU-US DPF, SCCs.
• MongoDB Atlas (MongoDB, Inc.). Purpose: primary database. Data: account data, alt texts, image URLs, usage data. Location: US. Safeguard: EU-US DPF, SCCs.
• OpenAI. Purpose: AI model that generates alt text. Data: images or image URLs, contextual information. Location: US. Safeguard: EU-US DPF, SCCs.
• Cloudflare. Purpose: CDN, security, and Workers for edge delivery of alt text. Data: request data, IP address, cached alt texts. Location: global edge network, US. Safeguard: EU-US DPF, SCCs.
• Google (Firebase Authentication). Purpose: user sign-in. Data: email address, authentication tokens. Location: US and other locations. Safeguard: EU-US DPF, SCCs.
• Google Analytics (GA4). Purpose: website analytics, only with consent. Data: pseudonymous usage data, IP address (anonymized where possible). Location: US and other locations. Safeguard: EU-US DPF, SCCs.
• PostHog. Purpose: product analytics and feature flags, only with consent where required. Data: usage events, device data, account identifier.
• Cookie Script. Purpose: cookie consent management. Data: consent choice, cookie identifiers.
• tawk.to. Purpose: live chat on the website. Data: chat messages, name and email you provide, IP address.
• Attio. Purpose: customer relationship management. Data: name, email, plan, usage and support history.
• Customer.io. Purpose: service and transactional emails. Data: email address, message content.

Independent controllers. Paddle.com Market Limited acts as Merchant of Record and processes payment and billing data as an independent controller under its own privacy policy. Shopify and other platforms you connect process their own data under their own policies.

‍

Other recipients. We may disclose data to legal authorities when the law requires, and to our accountants and legal advisers under confidentiality duties. We do not sell personal data.

‍

International transfers

Our primary infrastructure is hosted by AWS in the United States (us-east-1), and several subprocessors process data in the US or other countries outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we rely on one of these safeguards under Chapter V of the GDPR:

• EU-US Data Privacy Framework (DPF). The recipient is certified under the DPF, which the European Commission recognizes as providing adequate protection.
• Standard Contractual Clauses (SCCs). Where DPF certification is not available, or as an additional safeguard, we use the SCCs adopted by the European Commission (Decision 2021/914).

Retention and deletion

• Account data: while your account is active, and deleted or anonymized within 30]days after you delete the account.
• Image URLs and generated alt texts: while your account is active, deleted after account deletion. We do not retain the image behind a URL.
• Image files sent in Base64: stored in private AWS S3 until you delete them or ask us to, and deleted within 30 days of a verified request or account deletion.
• Billing and transaction records: as required by Polish accounting and tax law, generally 5 years from the end of the tax year.
• Analytics data: according to the retention settings of PostHog and Google Analytics
• Backups: overwritten in a regular cycle within 30 days.

We may keep data longer where needed to defend legal claims or comply with the law. You can delete your content in the dashboard at any time. Deleted data may not be recoverable.

‍

Cookies, security, children, changes and contact

Cookies. We use three categories:

• Strictly necessary: sign-in sessions (Google Firebase Authentication) and security tokens. They need no consent.
• Functional: remember your preferences, such as language and your cookie choice, and support the live chat [CONFIRM the cookies set by tawk.to and whether you load it only after consent].
• Analytics: PostHog and Google Analytics (GA4) cookies, set only after you accept them in the cookie banner.

We use Cookie Script to manage cookie consent. When you first visit alttextlab.com, you will be shown a cookie banner allowing you to accept or reject non-essential cookies. You can change your preferences at any time by clearing your browser cookies and revisiting the site. Rejecting analytics cookies does not affect your ability to use the AltTextLab service.

‍

Security. We protect data with encryption in transit, access controls, private storage for uploaded files, and regular vulnerability scanning of our software. No system is completely secure. If a personal data breach puts your rights at risk, we will notify you and the supervisory authority as the law requires.

‍

Children. The Service is not directed at children, and we do not knowingly collect their personal data. Contact us if you believe a child has provided data and we will delete it.

‍

Changes. We may update this Policy. The latest version is always on this page with its update date.

‍

Contact. If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

‍Email: contact@alttextlab.com

‍Website: alttextlab.com