Privacy Policy
1. Introduction and Scope
AdVariq ("we", "us", or "our") respects the privacy and confidentiality of your commercial assets and personal information. This Privacy Policy explains how we collect, use, store, and safeguard your data when you visit our website, use our API endpoints, and create commercial imagery in the studio workspace.
By accessing or using AdVariq, you acknowledge and agree to the data handling practices outlined in this policy.
2. Information We Collect
To provide professional commercial image generation services, we collect data required for service fulfillment, plus optional analytics with your permission:
- Account and Identity Information: Email address, username, avatar (if provided), and session tokens managed via the Better Auth authentication framework.
- Product Assets and Creative Inputs: Uploaded product photographs, reference scene images, prompt text, design configurations, batch settings, and generation histories.
- Billing and Transaction Records: Plan selection, credit pack purchase logs, order reference IDs, and payment timestamps. Important: Credit card numbers and sensitive payment credentials are handled directly by PCI-DSS compliant payment gateways (such as Stripe, Creem, or Waffo). AdVariq never captures or stores full payment card numbers on its servers.
- Device and Operational Logs: IP addresses, browser specifications, operating system details, access timestamps, error tracebacks, and operational telemetry used for security monitoring and edge performance optimization.
3. How We Use Your Information
We use collected information solely for legitimate operational and technical purposes:
- Service Delivery: Executing multi-step AI generation pipelines to produce commercial static ads and e-commerce product scenes;
- Workspace Management: Powering your private workspace history, enabling high-resolution asset downloads, and tracking credit balances;
- Communications: Delivering authentication links, order confirmations, balance notifications, and technical support responses;
- Security and Compliance: Detecting automated abuse, filtering prohibited content, and safeguarding system integrity;
- Performance Optimization: Analyzing aggregated and anonymized metrics to minimize latency and improve service reliability across our global edge infrastructure.
4. Third-Party Service Providers and Data Transfers
To maintain edge-first performance and robust AI infrastructure, we partner with industry-leading service providers under strict data protection and confidentiality agreements:
- Edge Infrastructure and Cloud Storage: Cloudflare, Inc. (Workers runtime, D1 relational databases, KV cache, and R2 distributed object storage), ensuring encrypted storage and transfer;
- AI Inference: Enterprise inference partners including Google Cloud (Vertex AI), OpenAI, Fal.ai, and APIMart. When you initiate a generation job, prompt text and necessary reference images are transmitted over secure TLS connections solely for image synthesis. These partners are bound by enterprise data protection obligations and do not use your private uploads to train public foundation models;
- Payment Processing: Stripe, Creem, and Waffo handle checkout transactions compliant with PCI-DSS standards;
- Transactional Email: Resend and Cloudflare Email for authentication and billing notifications.
Your data may be processed in jurisdictions outside your country of residence as part of our global infrastructure. We ensure that appropriate safeguards are in place for all cross-border data transfers.
5. Data Retention and Security
- Encryption: All communications employ TLS/HTTPS encryption in transit. Asset data is stored in isolated Cloudflare R2 object storage buckets.
- User Control: You may delete generated images or entire batches from your workspace at any time. Deleted assets are removed from active access and purged according to our storage lifecycle policies.
- Account Deletion: Upon receiving a valid account deletion request, we permanently remove your account profile and uploaded assets, excluding only transactional records required by applicable financial regulations.
- Retention Period: We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law.
6. Your Data Rights
Depending on your jurisdiction, you may exercise the following rights regarding your personal information:
- Access and Portability: View and download your profile data and generated image history directly from the workspace;
- Rectification: Update your profile details in Account Settings at any time;
- Deletion (Right to Erasure): Request full account deletion and asset removal via our support channels;
- Restriction: Request restriction of processing in certain circumstances as provided by applicable law;
- Opt-out: Unsubscribe from non-essential promotional communications using the unsubscribe link in email footers.
To exercise any of these rights, please contact us using the information provided below.
7. Children's Privacy
AdVariq is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal data, please contact us and we will promptly delete such information.
8. Policy Updates
We may update this Privacy Policy to accommodate new features, service changes, or regulatory obligations. Updates will be posted on this page with a revised date. For material changes affecting how we process your personal data, we will provide prominent notice via website banners or direct email before the changes take effect.
9. Contact Us
If you have questions, feedback, or data privacy requests, contact us:
- Online inquiry: Contact Us
- Privacy email:
support@advariq.com
Optional usage analytics
With your permission, we use PostHog (US region) and Microsoft Clarity to understand visits, feature use and page interactions. Session replay can include visible business content, ordinary form inputs, product descriptions, creative prompts, uploaded product images and generated images. PostHog is configured to record every eligible consented session. Clarity applies its own recording limits and always masks input boxes and dropdown values, even in Relaxed mode. Passwords, one-time codes, API keys and payment credentials are protected. Administration, API-key and security pages and URLs containing authentication credentials are excluded. Ordinary query parameters and fragments do not by themselves prevent recording. Replay reconstructs the page and does not record your entire device screen.
An internal account ID links activity after login. Structured business events exclude email addresses, prompts and image contents; this does not mean those contents are excluded from page replay. Browser exceptions retain only a generic type and public JavaScript asset locations. Request and response bodies and headers are not captured. You can refuse or change your choice using Cookie settings. Refusing stops both browser recorders without affecting core features. On the authenticated App, the choice also controls future server-side analytics after it has synchronized with your account; failed synchronization can delay that change.
PostHog's current free plan retains analytics for up to one year and replay for up to one month. Clarity retains ordinary replay for 30 days and labeled or favorited sessions for up to 9 months. Consent choices, blockers, resource access, provider limits and delivery failures can cause incomplete recordings. Previously masked content cannot be recovered. Deleting a local account does not automatically erase either provider's existing data; contact support for deletion requests.
Google Analytics 4
With your permission, Google Analytics 4 measures page visits on our website and App using the same web data stream. We send sanitized page paths without query strings, fragments, product IDs or page content; authentication, administration, settings and billing pages are excluded. Advertising storage and personalization are disabled. Declining or withdrawing analytics consent disables GA4 collection. After consent, Google Analytics uses _ga and _ga_* cookies to distinguish visits across our subdomains. This does not send PostHog business events or recordings to Google.
Customer support chat
We use Crisp to provide customer support chat on our website and App. Crisp processes the messages and contact details you choose to send, along with technical information needed to operate the chat. Avoid sending passwords, API keys or payment card details. You can also contact support@advariq.com.