Privacy policy
Last updated:
1. Who we are and what we collect
Afterform is operated by MATSVEI SHULMAN IE (“we”, “us”, or “our”), the controller of personal data described in this policy. This policy covers our website, web workspace, and mobile apps. It explains how we handle information when you create an account, use creative tools, make a purchase, or contact us.
- Account and sign-in information: Your email address, name, account identifiers, password hash or passkey credentials, session records, and information returned by a sign-in provider you choose. We do not receive your password for an external sign-in provider.
- Workspace content: Projects, prompts, uploaded images, video, audio, documents, reusable creator, product, brand and voice records, generated content, versions, sharing settings, and activity. Only upload personal information, faces, or voices you are entitled to use.
- Billing information: Subscription and purchase identifiers, plan, payment status, billing periods, credit balances, usage, and refund records. Payment providers collect payment details directly; Afterform does not store your full payment card number.
- Service and support information: Messages you send us and technical information needed to deliver and protect the service, such as IP addresses, device or browser information, request records, and authentication or security events.
- Operational diagnostics: When enabled, Axiom receives limited technical records such as service, error category, response status, timing, and request or task correlation identifiers. Our Axiom reporting excludes prompts, media, account profile details, raw error messages, and page or asset URLs. If Sentry server error reporting is enabled, it receives error and diagnostic context. Operational reporting is separate from optional usage analytics.
- Optional web analytics: After you allow analytics, DataFast processes visitor and session identifiers, simplified page paths, browser and device information, referral and campaign information, and events such as opening the app, signing up, creating a project, uploading, submitting a generation, sharing, requesting a download, and starting checkout. Its service also receives the IP address used to send the request. Our browser analytics events do not include prompts, media, account profile details, credentials, or private file links.
2. How and why we use information
Where data protection law requires a legal basis, we rely on performing our contract with you to provide accounts, creative tools, storage, purchases, and support; legal obligations for required financial records and lawful requests; and our legitimate interests in securing, maintaining, and diagnosing the service. We balance those interests against your rights. Optional DataFast analytics relies on your consent.
- Provide the features you request, process content through the selected workflow, and manage access to projects and shared content.
- Process purchases, allocate credits, enforce plan limits, and prevent fraud or misuse.
- Keep the service reliable and secure, resolve support requests, and send account, security, billing, or service notices.
- With your consent, understand web usage and which traffic sources lead to purchases so we can improve the product and marketing.
3. Who receives information
We share information needed to operate the features you use with the providers described below. Their role and privacy terms depend on the service they provide. We do not sell your personal data.
If you invite collaborators or create a share link, the people with the resulting access can view or download the shared content. Revoking access cannot remove copies they have already saved. We may also disclose information when required by law, to protect rights and security, or as part of a business transfer subject to applicable privacy requirements.
- AI and media providers: The provider used for your requested operation, such as Atlas Cloud, fal.ai, or ElevenLabs, receives the required prompt, settings, and reference files. Provider retention and permitted use are governed by the applicable service terms and configuration; do not assume every model offers zero retention or the same data-use terms.
- Hosting, storage, and delivery: Hosting providers, Backblaze B2, and Cloudflare process stored content and the network information needed to serve and protect it. The website also requests fonts from Google Fonts, which receives the network information needed to deliver them.
- Account services: Afterform manages authentication. A social sign-in provider processes the sign-in you initiate, and Resend delivers account and transactional emails.
- Payments: Polar processes web purchases and receives the account and transaction information needed for checkout. For supported mobile purchases, Apple or Google processes payment, and RevenueCat helps verify purchases and manage subscription access using purchase records and an app user identifier.
- Analytics and diagnostics: DataFast processes the optional web analytics described here. When Polar revenue attribution is connected, consented visitor and session identifiers can link a checkout and its purchase information to a traffic source. Axiom and, if enabled, Sentry process the operational diagnostics described above. See DataFast’s privacy policy for its processing practices.
4. Retention and deletion
We retain account and workspace data while needed to provide the service. You can delete supported workspace items in the product and request account deletion using our account deletion instructions. Stored media is queued for deletion; deletion is not necessarily immediate across active storage, backups, and providers.
We may retain limited information after deletion where needed for financial and legal obligations, fraud prevention, security, or resolving disputes. Retention depends on the type of information, the purpose, and applicable requirements. Providers and people who received your shared content may hold their own copies. Withdrawing analytics consent stops future browser analytics but does not automatically erase records already received; contact us to request deletion of personal data.
5. Cookies and analytics choices
We use essential cookies and local storage for sign-in, security, preferences, and remembering your analytics choice. Our consent cookies remember that choice for up to one year and share it between the website and app when they use the same Afterform root domain.
DataFast loads and creates analytics identifiers only after you allow analytics. Its visitor cookies are set for up to one year and its session cookies for about 30 minutes; activity can refresh those lifetimes. It also uses browser storage to manage analytics state and queued events. These identifiers are pseudonymous, not a guarantee that the data is anonymous.
You can accept, reject, or revisit optional analytics using the control below or the web app’s privacy settings. Rejecting analytics stops future browser tracking and clears queued events and known DataFast cookies and storage on the relevant browser origins as your choice is applied. Your choice is specific to that browser; set it separately on other browsers or devices.
Rejecting analytics does not prevent sign-in, purchases, subscription access, security processing, or operational diagnostics. When analytics is rejected, our web checkout does not attach DataFast visitor or session identifiers for new attribution. Payment records still need to be processed to provide your purchase.
6. Your privacy rights
Depending on where you live, you may have the rights below, subject to applicable exceptions. Contact [email protected] to make a request. We may need to verify your identity before providing or deleting personal information.
- Request access to, correction of, or deletion of your personal information.
- Receive a portable copy of eligible information and download available media from your workspace.
- Object to or request restriction of certain processing, including processing based on legitimate interests.
- Withdraw analytics consent at any time, without affecting the lawfulness of processing before withdrawal.
- Complain to the data protection authority responsible for your location, and exercise applicable rights without unlawful discrimination.
7. Security
We use safeguards such as encrypted connections, authentication, and access controls. No online service can guarantee absolute security. Protect your sign-in credentials and choose carefully what you upload or share.
8. International processing
Our service providers may process information outside your country, where privacy laws may differ. Where applicable law requires safeguards for an international transfer, those transfers must use an appropriate mechanism, such as an adequacy decision or approved contractual safeguards. Contact us for information about safeguards relevant to your data.
9. Children
Afterform is intended for adults aged 18 or older. We do not knowingly collect personal information from children using the service. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.
10. Changes to this policy
We may update this policy as the service or our practices change. We will update the date above and provide additional notice of material changes where required. If a new use of information requires consent, we will obtain it before that use; updating this page does not itself provide your consent.
11. Contact
For privacy questions or requests to MATSVEI SHULMAN IE, contact [email protected]. For general support, contact [email protected].