Privacy Policy

Alanthic • alanthic.com

1. Scope & Applicability

This Privacy Policy applies to all users of the Alanthic Platform (alanthic.com) and applications, whether accessed from India or internationally. You act as a Data Controller and Alanthic acts as your Data Processor. You must execute a Data Processing Agreement (DPA) with Alanthic and ensure your own compliance with applicable data protection laws.

2. Data We Collect

2.1 Account & Identity Data

  • Full name, email address, username, and password (stored in hashed form).
  • Business or organisation name for paid Plan subscribers.
  • Billing information — collected and processed by our PCI-compliant third-party payment processor. Alanthic does not store full payment card numbers.

2.2 Input Content (User-Uploaded)

  • Product images, garments, brand assets, and photographs uploaded for AI photo shoot generation.
  • Text prompts, style parameters, background preferences, and other generation instructions.
  • Any personal data contained within uploaded images, including biometric data where applicable under Indian law.
Important: If your uploaded images contain identifiable individuals, you are solely responsible for obtaining their valid, informed consent prior to uploading.

2.3 Usage & Technical Data

  • IP address, device type, browser version, and operating system.
  • Pages visited, features used, session duration, click patterns, and navigation data.
  • API request logs including timestamps, endpoints called, credit consumption, and response codes.
  • Error logs and platform performance metrics.

2.4 Communications Data

  • Messages, enquiries, and attachments sent to our support team.
  • Survey responses and product feedback you voluntarily submit.
  • Email engagement data (open rates, click-through rates) for transactional and marketing communications.

2.5 Cookie & Tracking Data

Information collected via cookies and similar technologies as described in our Cookie Policy.

3. How We Use Your Data

Alanthic processes your personal data only for lawful purposes, including:

  • Creating and managing your Account and authenticating your identity.
  • Delivering the AI photo shoot generation and all related Services.
  • Processing payments, managing subscriptions, and Credit tracking.
  • Providing customer support and resolving technical issues.
  • Sending transactional communications (account activity, payment receipts, service alerts).
  • Sending marketing communications where you have provided explicit opt-in consent. You may opt out at any time.
  • Analysing aggregated and anonymised usage data to improve platform features, AI models, and user experience.
  • Detecting and preventing fraud, abuse, security incidents, and unauthorised access.
  • Complying with legal obligations under Indian law, including responding to lawful regulatory and government requests.
  • Where you have explicitly opted in: using anonymised or aggregated derivatives of usage data to improve AI model performance. We do not use your identifiable personal images or Input Content to train our AI models without your explicit, separate written consent.

4. Data Retention

  • Account data: retained for the duration of your Account and 3 years after Account closure, unless earlier deletion is requested.
  • Billing and transaction records: retained for 7 years in compliance with Indian accounting and tax regulations.
  • Generated Content and uploaded images: retained for 12 months after Account closure, then permanently deleted. Enterprise clients may negotiate custom retention terms in their DPA.
  • Support communications: retained for 3 years.
  • You may request deletion of your personal data at any time by contacting privacy@alanthic.com.

5. Data Sharing & Disclosure

Alanthic does NOT sell your personal data to any third party under any circumstances. We may share data with:

  • Authorised service providers and sub-processors who assist in operating the Platform (cloud hosting, payment processing, analytics, email delivery, customer support tools), bound by data processing agreements.
  • Law enforcement, government authorities, or regulatory bodies when required by applicable Indian law, court order, or judicial warrant.
  • A successor entity in the event of a merger, acquisition, or asset transfer, with notice to affected users.

All third-party processors are required to maintain adequate security standards and may not use your data for any purpose beyond the specific service they provide to Alanthic.

6. International Data Transfers

Alanthic is incorporated in India. Where we engage cloud infrastructure or sub-processors located outside India, all cross-border data transfers are conducted in compliance with Chapter VII of the DPDP Act, 2023 and any applicable Government of India notifications regarding permitted transfer destinations. We maintain appropriate contractual safeguards for all such transfers.

7. Data Security

  • AES-256 encryption for data at rest; TLS 1.3 for data in transit.
  • Role-based access controls restricting data access to authorised personnel only.
  • Regular security audits, penetration testing, and vulnerability assessments.
  • Secure data deletion procedures for data no longer required.
  • Incident response procedures for breach detection, containment, and notification.

In the event of a personal data breach likely to cause harm to a Data Principal, Alanthic will notify the Data Protection Board of India and affected users without undue delay, as required by the DPDP Act, 2023.

8. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

  • Right to Access: Request a summary of personal data Alanthic holds about you and the purposes of processing.
  • Right to Correction: Request correction or completion of inaccurate or incomplete personal data.
  • Right to Erasure: Request deletion of your personal data, subject to legal retention obligations.
  • Right to Grievance Redressal: Have your complaints addressed by Alanthic's Grievance Officer within 30 days.
  • Right to Nominate: Nominate an individual to exercise your rights in the event of your death or incapacity.
  • Right to Withdraw Consent: Withdraw previously given consent at any time, without affecting the lawfulness of prior processing.
  • Right to Complain: Lodge a complaint with the Data Protection Board of India if unsatisfied with Alanthic's response.

To exercise these rights, contact privacy@alanthic.com. We will respond within 30 days. Identity verification may be required.

9. Children's Privacy

The Alanthic Platform is intended for users 18 years of age or older. We do not knowingly collect personal data from children under 18 without verifiable parental consent. If you believe a child has provided personal data to us, please contact privacy@alanthic.com and we will take prompt steps to delete that data.

10. Grievance Officer

In accordance with the IT Act, 2000 and the DPDP Act, 2023, Alanthic has designated a Grievance Officer:

Grievance Officer
Alanthic Technologies Private Limited

11. Changes to This Policy

Alanthic may update this Privacy Policy periodically. Material changes will be communicated by updating the Policy on the Platform and sending an email notification to registered users. The updated Policy will display the revised effective date.