Privacy Policy

1. Who we are

This policy covers Alvin's Club apps — including Chat with your AI team, Studio, Channel, SEO/GEO, Builder, Insight, BrandPilot, Creators, ROASMax and Merchant Desk — operated by FUTUREVERSE TECHNOLOGIES LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. Contact: service@alvinsclub.ai.

The main website is operated by FUTUREVERSE TECHNOLOGIES LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. This policy covers application data; the main website's separate services are not covered by it.

Where a business customer gives us content about other people, such as its customers or the people in its photos, we process that content on the customer's instructions to provide the apps (section 16). We remain responsible as controller for the account, security, billing and legal records this policy describes.

2. Information we process

Account information: your email address, account identifier, API key (stored so we can authenticate you) and billing records. Card details are handled by Stripe; we do not receive full card numbers.

Sign in with Google: if you choose "Continue with Google", Google tells us only your email address, that Google has verified it and an identifier for your Google account. We use it to open or sign in to your account, and nothing else; we do not receive your Google password, contacts or any other Google data.

Requests: product page links, the product photos and product information we fetch from those pages, any creative brief you provide, the scripts we write, and the videos and photos we generate.

Technical records: request logs such as time, IP address, user agent and error details, used for security, troubleshooting and preventing abuse.

Messages: if you contact us on WhatsApp, we receive your phone number, WhatsApp profile name and the messages you send, and use them only to reply to you. WhatsApp's own privacy policy also applies.

AI assistant connections: when you connect us to ChatGPT (OpenAI), Claude (Anthropic), Grok (xAI) or Meta Muse, we receive an access token that identifies your account and, for each action you ask for, only the details that action needs (for example a product page link, the number of videos, a reference video link or a lookbook occasion). We do not receive your full conversation, your assistant account details or other chats. We use these details only to carry out the action and show it in your workspace, and we do not use them to train AI models. You can disconnect at any time from the assistant's settings or from your account page, which revokes the token.

Social accounts you connect for posting: if you connect a TikTok, Instagram, YouTube, LinkedIn or X account, a Facebook Page or a Hashnode blog so we can post for you, we receive the information described in section 13 ("Posting to your social accounts"), and nothing else from that platform.

BrandPilot: if your workspace uses BrandPilot, we process your brand brief (brand name, website, goal, positioning, offerings, the role of each account, audience, markets, voice, words to avoid, other requirements you write, timezone, up to three competitor websites and how often to post), the text of your website and of those competitor pages, the plans, drafts and approvals made in BrandPilot, the performance counters of posts BrandPilot published (section 14) and, where enabled for your workspace, the read-only sources described in section 14.

We do not ask for personal information about your customers. Please do not include personal data in briefs.

Other features: Chat, company workspaces, Insight, Merchant Desk, the Wallet and payouts, feedback, our emails, visits to our site and SEO/GEO are described in sections 15, 17, 18 and 24.

3. How we use it

To provide the service you request (fetching, preparing photos, writing and reviewing scripts, generating and delivering content), to bill you, to keep the service secure, to prevent abuse, to support you and to improve quality, and to measure our own ads (see section 11). We also use it to send service and, where allowed, product emails (section 17), to comply with the law, and to enforce our terms. We do not sell your account information or the content you make for money; the advertising pixels in section 11 are the only "sale" or "sharing" under California law, and you can opt out of them.

4. Who we share it with

Service providers that process data for us under contract: cloud hosting and storage (including Google Cloud and BytePlus); AI model providers used to prepare photos, write and check scripts, generate videos, photos, articles and cover images, and run Chat (including Google Gemini, OpenAI GPT models and ByteDance Seedance and Seedream models accessed through our gateways, and ElevenLabs for an account's own voice); our affiliated companies that run video generation and merchant systems for us; Apify, to fetch product pages and public details of reference videos when our own systems cannot; Lark (Larksuite), which delivers our emails and our team's internal notifications (these can include an account's email address, purchases and feedback); Stripe for payments; and PayPal for payouts you ask for. When you ask us to post, we send what you asked us to post (a video and its caption, on LinkedIn also text, links or photos, on a Facebook Page also photos or a text post with an optional link, on X the post text, or on Hashnode an article) and the settings you chose to the platform you selected (TikTok, Instagram, YouTube, Facebook, LinkedIn, X or Hashnode), which then handles it under its own terms and privacy policy. In BrandPilot, the content you approved is sent the same way, as described in section 14. We share data received from those platforms only with the cloud hosting and AI service providers described here, as needed for the features you authorize.

When you request AI analysis or approve evidence-based drafting, selected post text, available performance metrics, saved cycle context and selected video context may be sent to the AI model providers described above to prepare the requested analysis or draft. We do not send social account access or refresh tokens to those AI providers.

When BrandPilot prepares a plan or drafts, your brief, the names of your connected accounts, text from your website and the competitor pages you list, the performance counters of posts BrandPilot published, and the sources enabled for your workspace (section 14) are sent to the AI model providers described above (currently Google Gemini, through our gateway). Aggregate order and sign-up totals contain no customer details.

The AI assistant you use (ChatGPT by OpenAI, Claude by Anthropic, Grok by xAI or Meta Muse) sends us your requests and receives our results, such as video links, captions and status; its own privacy policy governs what it does with your conversation. We may also disclose information when required by law or to protect rights and safety.

We also share information: within a company account, with its owner as described in section 15; with the authorization service that connects some channels for you (section 13); with Google when our pages load Google Fonts (section 18); and, if we are involved in a merger, acquisition or sale of assets, with the buyer, who must protect it as this policy describes.

5. Where data is processed

Our servers and providers are located in several countries, including the United States and Singapore. Where required, we use appropriate safeguards for international transfers.

If you are in the European Economic Area, the United Kingdom or Switzerland, your information is transferred to countries that may not have equivalent data protection laws. Where those laws require it, such a transfer must rest on an approved safeguard, such as standard contractual clauses or the UK and Swiss equivalents. Contact service@alvinsclub.ai to ask which safeguard applies to a transfer, or, as a business customer, to ask for a data processing agreement.

6. Retention

We keep generated videos and photos, the product photos we prepared, and the scripts and product details of each request for 90 days after they are created, then delete them automatically, so please download anything you want to keep. Billing records are kept as long as required by law, and security logs for a limited period. You can ask us to delete your content earlier. Access tokens for social accounts you connect are kept only while the account is connected (see section 13). Records of posts we made for you (the post ID, link, status and time) are kept for 90 days, then deleted. Hashnode article drafts and records, and BrandPilot briefs, plans, drafts, approvals, publishing records and post performance readings, are kept with your workspace as the record of what you approved and what was published; you can ask us to delete them at service@alvinsclub.ai, and we keep only what is needed to show what was authorized. Copies of videos prepared for BrandPilot posts are deleted after 90 days.

A video or photo that is still needed for an order, edit or post in progress is kept until that work ends, then deleted on the same schedule. Order and billing records (what was ordered, when, and the credits charged), wallet, reward and payout records, and consent records are kept for as long as the law requires or we need them to show what was agreed and paid. Account details are kept while the account is open.

Chat conversations and their files are kept until you delete the conversation or ask us to delete them; records of Chat's business actions are deleted after 365 days. Feedback you send, our email records (sends, opens, clicks and unsubscribes), site visit records and Merchant Desk records, including signed agreements and their signing evidence, are kept until you ask us to delete them or close your account, unless we must keep them by law or to show what was agreed. Sign-in codes, links and sessions are deleted about a day after they expire. Deleted information can remain in our backups after it is deleted: database backups are kept for up to 30 days, and backup copies of media, Chat archives and publishing files are removed on their own schedule, which can be longer; some off-site copies are kept until we remove them. We use backups only to restore the service, and keep them protected.

7. Your choices and rights

You can request access, correction or deletion of your information, or close your account, by emailing service@alvinsclub.ai or following the steps at https://studio.alvinsclub.ai/data-deletion. We complete deletion requests for data received from connected social accounts within 7 days. Depending on where you live (for example California or Canada) you may have additional rights, including under the California Consumer Privacy Act where it applies; we will respond as required by applicable law.

Sections 19 and 20 describe the rights of people in the European Economic Area, the United Kingdom, Switzerland, Brazil, California and other U.S. states. To protect your account, we verify a request by confirming it from the email address of the account; if you have no account (for example you appear in content), we verify it with details that match what we hold, such as the content link. Opting out of sales or sharing needs no verification. Someone you authorize can make a request for you with your signed permission, which we may confirm with you. If we decline a request, you can appeal by replying to our answer; if we decline the appeal, you can contact your state attorney general or data protection authority. We will not treat you differently for using your rights. Where your request concerns content a business customer controls, such as its members' work or its customers' details, we may refer it to that customer and act on its instructions.

8. Security

We use access controls, encryption in transit and separate credentials per account. No system is completely secure; tell us promptly if you believe your API key has been exposed.

Platform access tokens are encrypted at rest, API keys are stored as hashes (and encrypted where you can view your key again; a new key is held only until it is first shown to you), and sign-in codes and links expire. If a security incident affects your personal information, we will notify you and the authorities as the law requires. Report security issues to service@alvinsclub.ai.

9. Changes

We will post changes on this page with a new version date and notify active accounts of material changes.

10. Photos of people for your own models

If an account adds its own model, we process the photos of that person and a short description of their appearance (for example age range and hair) to show that person in the account's lookbooks and videos. We do not create face-recognition templates or other biometric identifiers, do not use the photos to train AI models, do not show them to other accounts and do not sell them. They are sent only to the AI model providers listed above, to generate that account's content.

The photos are deleted when the account deletes the model, when the account is closed, or after 90 days without use. The account's record of the person's consent (what was confirmed and when) is kept as proof. The person shown can ask for deletion at service@alvinsclub.ai. Photos already sent to an AI model provider to make a video or photo follow that provider's own retention.

11. Advertising pixels and your opt-out

On our public pages (not inside your studio, and not on pages that carry sign-in links, keys or payment details) we use advertising pixels from TikTok, Meta and Google to measure our ads: page views, submissions of the free-trial email form, trial sign-ups and clicks on buy buttons. These providers may set cookies and receive your IP address, browser details and the page visited. We do not send them your email, name, API key or account details.

After a payment, the page you return to also reports the completed purchase to them: the amount and currency and, for Google, a scrambled (hashed) order reference used to avoid counting it twice. The payment link is removed from the address before the pixels load. A hashed reference can still be linked to the purchase, so we treat it as personal information.

Under California law this may count as "selling" or "sharing" personal information for cross-context behavioral advertising. You can opt out at any time on our "Do not sell or share my info" page (/privacy/choices, linked at the bottom of every page), and we honor the Global Privacy Control signal: if your browser sends it, the pixels do not load.

12. Your voice

If an account adds its own voice, we process the recording to make a digital copy of that voice (a voice clone at ElevenLabs, through our gateway) and use it only to voice that account's videos. The recording is sent to ElevenLabs twice, once to remove background noise and once to make the clone, and is then deleted from our servers. We keep the provider's voice reference while the voice is in use, and a record of the consent given (what was confirmed, when, and a fingerprint of the recording) as proof. We do not use the voice to train AI models, show it to other accounts or sell it.

When you delete the voice or record a new one, when the account is closed, or after 90 days without use, we stop using it and delete the copy held by ElevenLabs (usually within an hour; retried until confirmed).

13. Posting to your social accounts

X. Where enabled, you can authorize us to post a finished Studio video with the caption you confirm, including a Made with AI disclosure, and, through BrandPilot, the text and video posts approved by you or under the automatic-publishing permission you turned on. We request tweet.read, users.read, tweet.write, media.write and offline.access to identify your account, upload the video, publish your confirmed post and refresh access. We store your account ID, display name, username and encrypted access and refresh tokens, and retain post records for 90 days. Disconnect in Post channels to delete the stored connection and cancel unsent posts; already published posts remain on X. You can also revoke access in X under Settings and privacy > Security and account access > Apps and sessions > Connected apps. X's terms and privacy policy apply to your use of X (https://x.com/tos and https://x.com/privacy).

You can connect your own TikTok, Instagram, YouTube or LinkedIn account or Facebook Page and ask us to post to it. Connecting is optional. We post only to the account you connected yourself and only on your instructions. Outside BrandPilot we do not decide on our own what to post or when; in BrandPilot, posts follow your approvals or the automatic-publishing permission you turned on (section 14). We never ask for or store your password for these platforms.

On TikTok, Instagram and YouTube, we post a video you made with Alvin's Club Studio, after you choose it and confirm the post. Every such video is posted with the platform's AI-generated content label where the platform provides one (TikTok and YouTube); this cannot be turned off. Optional "Made with AI" caption wording follows the choices you confirm.

On LinkedIn, we post what you ask us to post: text, links, photos or videos that you or your AI assistant (such as Meta Muse) provide, or a video you made with Alvin's Club Studio. A post is published when you ask for it, or at a time you set yourself in your assistant (for example a weekly post you scheduled there). You can ask us to edit the text of a post we published for you, or to delete it.

What we receive and store, for each connected account: the account or channel ID, the display name or username, the profile picture or channel thumbnail URL, and the access and refresh tokens the platform gives us. Tokens are encrypted at rest and only our posting service can use them. For each post we make, we keep the ID, link, status and time the platform returns; for LinkedIn posts, also the text, the link and the web addresses of the photos or videos you asked us to post.

Channels connected through our authorization service: the service handles platform authorization and holds the platform tokens. Studio stores the channel ID, display name, username and binding time, associated with your Studio account. Connecting a channel does not publish a video. Unlinking removes that association from Studio; to revoke the service's platform access, remove the authorized app in the platform's settings as well.

Channel performance analysis. When you request analysis, we read the authorized native account's video or post catalog, titles, captions, publication times and available performance counters, including content published outside Studio. Optional TikTok video.list, Instagram instagram_business_manage_insights and YouTube yt-analytics.readonly consent adds the data those approved platform APIs permit. We use this data to compare performance and suggest production experiments and posting times. Missing metrics remain unknown. Analysis does not publish or change an approved schedule. Reports returned to your assistant follow that assistant's data policy.

Saved content cycles. Only when you explicitly request a saved cycle, we retain its goal, selected account and video, draft versions, feedback, publication link and bounded account/post metric snapshots to prepare the next draft. Automatic observation and bounded follow-up writing require your cycle plan approval; automatic writing is off unless you opt in. Each publication still needs separate approval. These records are deleted 30 days after the cycle is created, even if it is updated or paused. You can erase them sooner with the assistant. Disconnecting the selected native account or unlinking its provider binding deletes the associated saved cycles immediately. Deleting a cycle does not delete the original Studio video or a post already on the platform. We do not use these records to train AI models.

AI writing. On your request, the existing writing service uses your selected Studio video's product notes and script to draft platform-specific titles, captions, hashtags and calls to action. Review drafts before publishing. Writing and analysis do not give permission to generate or publish a video.

What we do not do: we do not read your personal feed, followers or connections, comment text or messages. We do not use data received from these platforms for advertising, do not sell it, do not share it with third parties except as described in section 4, and do not use it to train or improve AI models.

How long we keep it (for Hashnode, see the Hashnode paragraph below): tokens and account details are deleted as soon as you disconnect the account in your studio, when you remove our app in the platform's settings (where the platform tells us), or when the platform no longer accepts the token. Post records are kept for 90 days, then deleted (BrandPilot and Hashnode records: see section 6).

TikTok. We use TikTok Login Kit and the Content Posting API with the permissions user.info.basic (your display name and avatar, so you can see which account is connected) and video.publish (to post the video you confirmed, with the privacy, interaction and commercial content settings you chose). Optional video.list reads your public video catalog and available counters for requested analysis. TikTok's Privacy Policy (https://www.tiktok.com/legal/page/us/privacy-policy/en) applies to your use of TikTok. You can remove access in the TikTok app under Settings and privacy > Security > Manage app permissions; we then delete your TikTok data.

Instagram. We use the Instagram API with Instagram Login with the permissions instagram_business_basic (your professional account's ID, username, profile picture, media catalog and available basic counters) and instagram_business_content_publish (to publish the Reel you confirmed). Optional instagram_business_manage_insights reads available media insights for requested analysis. Only Instagram professional accounts can be connected. Meta's Privacy Policy (https://www.facebook.com/privacy/policy) applies to your use of Instagram. You can remove access in Instagram under Settings > Apps and websites; Meta then sends us a deletion request, we delete your Instagram data, and you can check the status at the link Meta shows you.

Facebook Pages. We use Facebook Login with the permissions pages_show_list (to list the Pages you manage so you can choose one), pages_read_engagement (to read the chosen Page's ID and name) and pages_manage_posts (to publish on that Page the video, photo post or text post you confirmed, publicly). Only Pages can be connected, not personal profiles. We store the Page ID, the Page name and the encrypted Page access token; for each post, the text, link and photos you approved and the ID, link, status and time Facebook returns. We do not read the Page's feed, followers, comments or messages. Meta's Privacy Policy (https://www.facebook.com/privacy/policy) applies to your use of Facebook. Disconnect the Page in Post channels to delete the stored connection, or remove our app in Facebook under Settings and privacy > Settings > Business integrations; Meta then sends us a deletion request, we delete the Pages connected through that Facebook account, and you can check the status at the link Meta shows you. Posts already on the Page stay there until you delete them.

YouTube. Alvin's Club Studio uses YouTube API Services. We request youtube.upload (to upload the video you confirmed to your channel, with the title, description, privacy status and "made for kids" setting you chose, marked as altered or synthetic content) and youtube.readonly (to show which channel you connected and the processing status of videos we uploaded, and to read your uploaded video catalog and counters). Optional yt-analytics.readonly reads your channel's performance and watch-time reports for requested analysis. By posting to YouTube you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and the Google Privacy Policy (https://policies.google.com/privacy) applies. You can revoke our access at any time from your Google account security settings at https://security.google.com/settings/security/permissions. If you revoke access, we delete the YouTube data we stored about you within 30 days (immediately if you disconnect in your studio), and we re-check that stored YouTube data is still authorized at least every 30 days. We do not allow third parties to serve ads in Alvin's Club Studio.

The use and transfer to any other app by Alvin's Club apps, including Alvin's Club Studio, of information received from Google APIs (including Google sign-in, YouTube and Search Console) will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

LinkedIn. If you connect LinkedIn, we request openid, profile, email and w_member_social to show which member is connected and to publish, edit and delete the posts you ask for. LinkedIn gives us no refresh token, so the connection ends after 60 days and you connect again. You can disconnect at any time by asking your assistant (for example "disconnect my LinkedIn") or in your studio, which deletes the connection, and you can remove our access in LinkedIn under Settings > Data privacy > Permitted services. Posts already on LinkedIn stay there until you delete them.

Hashnode. If you connect a Hashnode blog, you authorize us through Hashnode's own sign-in (OAuth) and we use Hashnode's official MCP service; Hashnode decides the access it grants and shows it to you when you approve. We store the access and refresh tokens Hashnode gives us, encrypted, and for each blog you connect its publication ID, title and address. For each article you ask for, we send its title, its text (Markdown), its web address and, where you or our SEO/GEO agent add them, a subtitle, up to five tags, a cover image link and a meta description. We publish an article only with your approval: in Channel we save a draft first and publish it after you approve publishing; in BrandPilot, an approved article is published under the publishing mode you chose; and if you turn on automatic publishing for our SEO/GEO agent, it publishes the articles it prepares for your blog after its source and quality checks, without asking you again. To confirm an article's status we read your blog's list of drafts or posts and the matching article. We keep each article's title, text, status, Hashnode ID, link and SEO details so you can see them in your workspace. We do not read your Hashnode followers, comments or analytics. Unlinking a blog deletes that blog's connection, and we delete its tokens once no other blog you connected uses them, and when we delete them we also ask Hashnode to revoke them. When you connect a blog again, the new tokens replace the earlier ones, which we delete unless another connected blog still uses them. We also delete the tokens of an authorization in which you did not choose a blog, and if Hashnode no longer accepts a connection when we renew it, we delete its tokens and ask you to connect again. Articles already on Hashnode stay there. You can also remove our app in your Hashnode account where Hashnode offers this. Hashnode's terms (https://hashnode.com/terms) and privacy policy (https://hashnode.com/privacy-policy) apply to your use of Hashnode.

To delete your data from connected accounts, disconnect them in your studio, remove our app in the platform's settings, follow https://studio.alvinsclub.ai/data-deletion or email service@alvinsclub.ai.

14. BrandPilot

BrandPilot runs your brand like a media company: it builds and runs your content matrix across every account and platform you connect, in one voice, on one plan. From your brief and the sources below, it prepares a positioning, audience findings and a plan with drafts for each connected account, using the AI model providers in section 4. It publishes only to the X, LinkedIn, TikTok, YouTube Shorts, Instagram and Hashnode accounts you connected yourself (section 13), and only with your approval: you approve the plan or individual posts, one at a time or in batches, or you turn on automatic publishing, a standing permission under which BrandPilot approves and publishes its drafts for the accounts, content types and daily limit you set without asking you again. You can change or turn off automatic publishing at any time.

Post performance: for posts BrandPilot published to X, TikTok, Instagram and YouTube accounts you connected directly, we regularly read the counters the platform makes available for those posts (such as views, likes, comments and shares) and keep each reading, to prepare BrandPilot reports and later plans.

Read-only sources, where enabled for your workspace: search performance for your own sites from Google Search Console (top search queries with clicks, impressions and position, and site totals), read from reports we prepare with read-only access, and your brand's results in AI search (articles we published and where your brand was mentioned); your active Shopify products (title, description, product link and up to three images) through the Shopify connection you already have; for your own Shopify store, daily totals of orders that came from BrandPilot campaign links (number of orders and amount by day, campaign, content and currency): we read recent orders with read-only order access, but keep no order IDs or customer details; and counts of early-access sign-ups on your own landing page by source and campaign, without emails or any details of the people who signed up. These sources never publish anything.

Reviewed library videos: where enabled for your workspace, BrandPilot can use finished videos from our video library that passed human review and were already published. We remove embedded metadata before using them and offer a video only for platforms where it has not appeared yet.

Operators: only the workspace owner can approve plans, change brand accounts or set the publishing mode. Where enabled for a workspace, operators designated for it can also open it, edit the brief and drafts, prepare plans and send approved posts. Records of approvals, publishing permissions and posts are kept as described in section 6.

15. Chat, company workspaces, Insight, Merchant Desk and the Wallet

Chat: the messages, images and files you send, the replies, drafts, reports and actions of your AI team, and what Chat remembers to help you in later conversations. They are sent to the AI model providers in section 4 to prepare replies. Voice input is turned into text and the recording is not kept.

Company workspaces: the company's details, its members' email addresses, roles and status, company limits and member budgets, the company wallet and its ledger, and each member's tasks, videos, reviews and spending. The company's owner can see this for every member; members see only what their role allows.

Insight: business data and commerce reports (for example sales, orders, products, creators and video performance) for the merchants and companies your account or company is allowed to see. Access details for these sources are stored encrypted, and each account sees only what its permissions allow.

Merchant Desk: merchant details (business name and description, contact name, phone and email, brands, websites and products), wallet and statement records, documents you or our team upload, and, for agreements signed electronically, the signing evidence described in section 26 of our Terms (the signer's account, email, name, title, typed name and any drawn signature, the time, IP address and browser, the consent and email verification, and a fingerprint of the document).

Wallet and payouts: balances, invitation rewards, commissions, top-ups and withdrawal requests, including the PayPal email address you give us for payouts. When someone follows a creator's affiliate link, the affiliate network receives a reference for that visit, not the creator's name or email.

Feedback: what you write and any email address you add, which goes to our team, including through our internal notifications.

16. Information about other people

If you give us information about other people, for example the photos of a model, your customers, your company's members, people in a reference video or the contacts in an agreement, you must have the right to share it and must give any notice and get any consent the law requires. We process it on your instructions to provide the apps to you, and you can ask us to delete it at any time. People whose information a customer gave us can contact service@alvinsclub.ai; we will help or pass the request to that customer.

17. Emails and messages

We send service emails that are part of the apps, such as sign-in codes, receipts, delivery and security notices; these continue while you have an account. We may also send account holders occasional emails about our products, such as tips, reminders and offers. Each product email includes an unsubscribe link, and once you unsubscribe we stop sending them. Some product emails contain a small tracking image and tracked links, so we can tell whether the email was opened and which link was clicked. Our emails are delivered by Lark Mail. We do not send text messages (SMS).

18. Cookies, site visits and fonts

We use our own cookies to keep you signed in (up to 30 days), to secure sign-in and payment steps (minutes to an hour), to remember your language, workspace and last sign-in method, to remember your opt-out choice (one year), and to measure visits: a random visitor ID (one year), a visit session (30 minutes), where you came from and the referral or campaign (30 days), and whether you started a trial. Visit records keep the campaign tags, referring site, landing page and browser language, not your IP address or browser details.

Advertising pixels on our public pages are described in section 11. Our pages load fonts from Google Fonts, so Google receives your IP address and browser details under Google's privacy policy. You can block or delete cookies in your browser; the apps need the sign-in and security cookies to work.

19. If you are in the EEA, the UK, Switzerland or Brazil

FUTUREVERSE TECHNOLOGIES LLC is the controller of the personal information described in this policy, except where we act for a business customer (section 16). We rely on these legal bases: to perform our contract with you (providing the apps, billing and support); our legitimate interests in keeping the apps secure, preventing abuse, improving quality, measuring our ads, and communicating with business customers; your consent (for your own voice and model, and the optional connections you make); and our legal obligations.

You can ask to access, correct or delete your information, to restrict or object to its use, and to receive it in a portable format, and you can withdraw consent at any time without affecting earlier use. You can also complain to your local data protection authority (in Brazil, the ANPD). In Brazil these rights are those of the General Data Protection Law (LGPD), including to confirm whether we process your information and to learn with whom we share it.

20. California and other U.S. states

In the last 12 months we collected these categories of personal information, from you, from the platforms, stores and assistants you connect, and from your use of our site: identifiers (name, email, account and device or cookie IDs, IP address); customer records (billing and payout details); commercial information (purchases, credits, subscriptions); internet activity (pages visited, email opens and clicks); approximate location from IP address; audio and visual information (photos, videos, voice recordings); professional information (business and company details); sensitive information (account sign-in credentials such as API keys and access tokens, and the voice and face information in section 21); and the content of your messages and Chat. We use and disclose each category only for the purposes and to the recipients in sections 3 and 4, and keep it as described in section 6.

We do not sell personal information for money. The advertising pixels on our public pages may be a "sale" or "sharing" for cross-context behavioral advertising of identifiers, internet activity and purchase information; opt out on our "Do not sell or share my info" page or with Global Privacy Control (section 11). We do not knowingly sell or share the personal information of anyone under 16. We use sensitive information only to provide the apps you ask for, not to infer characteristics about you.

Depending on where you live (for example California, Colorado, Connecticut, Oregon, Texas, Utah or Virginia), you can ask to know or access the personal information we have about you, to correct it, to delete it, to receive a copy, and to opt out of sales, sharing and targeted advertising, and you can appeal if we decline. Email service@alvinsclub.ai or follow section 7. We do not use personal information for decisions that produce legal or similarly significant effects about you.

21. Voice and face information

Some laws, such as those of Illinois, Texas and Washington, treat voiceprints and face geometry as biometric information. We treat the recordings and voice copies in section 12, and the model photos in section 10, as this kind of information wherever such laws apply. We use them only to make that account's content, after the confirmations described in sections 12 and 14 of our Terms, and we never sell, lease, trade or otherwise profit from them. We do not create face templates or voiceprints ourselves; the providers described in sections 10 and 12 process them to make the account's content.

Retention and destruction: we destroy them once their purpose ends, that is when the account deletes the voice or model, when the account is closed, or after 90 days without use, whichever comes first, and in any case within the time the law requires. We disclose them only to the providers named in sections 10 and 12, and when the law requires it; copies already sent to a provider follow section 10 and section 12.

22. Children

The apps are for businesses and adults and are not directed to children. You must be 18 or older to use them, and we do not knowingly collect personal information from children under 13 (or the age the law sets where you live). If you believe a child has given us personal information, email service@alvinsclub.ai and we will delete it.

23. Automated checks and AI training

Some steps are automated: for example, we check model photos and reference links before they are used, check our generated scripts and videos, and apply your spending limits. A check may refuse a photo or reference, or hold back an output. If you think an automated result is wrong, email service@alvinsclub.ai and a person will look at it.

We do not use your content, outputs, Chat conversations, photos, voice or data from connected platforms to train or fine-tune AI models. Our AI providers process the data we send them to return results for your request.

24. SEO/GEO

If you use SEO/GEO, we process the websites, brand names and competitor names you give us, the public pages of your site, and the articles we draft and publish with their results. If you connect Google Search Console, we read, with read-only access, search performance (queries, clicks, impressions and position) and indexing status for the properties you choose; the access token is stored encrypted. For a connected Shopify store we read your active products (title, description, link and search fields) and your blogs, so we can publish articles and, if you turn it on, fill in missing product search fields. If you turn on sharing to LinkedIn, we share new articles on the LinkedIn account you chose.

We use Google data only to provide SEO/GEO and BrandPilot reports to you, under the Limited Use requirements in section 13. You can revoke our Google access at any time at https://security.google.com/settings/security/permissions.

Alvin's Club SEO & GEO, our app for Shopify stores, works with the access you approve in Shopify. It reads your store name and primary domain and, for active products, the title, description, product page link and the SEO title and meta description; it saves an SEO title or meta description only for a product you approve. We keep the store's primary domain, the optional product category you enter, each store check's results and history, and a receipt of each product change (product ID and title, the SEO title and meta description before and after, and Shopify's answer). The app does not read or store Shopify customer or order data. Uninstalling the app stops its weekly checks; Shopify's store-redaction request then deletes the store's domain, category and store check results, while change receipts (identified by an internal ID, not the store domain) and subscription records are kept for accounting and security.