Data Architecture & Processing
Data Processing Note
1. Roles and Content Ownership
- Merchant Ownership: The Merchant retains full, exclusive ownership and intellectual property rights in and to all product images, product attributes, catalog metadata, and the resulting alt text and metadata generated by AltQuill.
- Merchant Control: The Merchant decides which images are submitted for processing, reviews generated suggestions, and retains sole discretion over whether text is published to its storefront.
- Processor Scope: AltQuill acts strictly as a Data Processor, handling image data and metadata solely to execute the Merchant's explicit generation requests.
2. Subject Matter and Data Flow
| Item | Description |
|---|---|
| Purpose | Automated generation of contextual alternative text ("alt text"), image titles, and captions for e-commerce catalogs. |
| Data Received | Product image bytes (the plugin attempts a768px resize; fallback originals are limited to8MiB); product title and attributes; target language; API key sent over HTTPS. The service stores only a SHA-256 hash and short key prefix. |
| Data Subjects | None intended. E-commerce catalog photos are expected to depict commercial inventory. If a photograph depicts a person (e.g. fashion model), the Merchant is responsible for maintaining all necessary model and commercial releases. |
| Retention Period | Zero days for images. Images exist only in ephemeral server memory during inference execution. Minimal usage telemetry and account records are retained for quota accounting and support; automated age-based usage-log deletion is not yet implemented. |
3. Processing Rules and AI Model Safeguards
- In-Memory Processing: Product images are processed exclusively in volatile RAM. No image bytes are saved to permanent disk storage, file systems, caches, or cloud object stores.
- In-House Model Execution: AI inference executes on dedicated hardware infrastructure operated directly by AltQuill using open vision-language model architectures (Qwen-VL).
- No Third-Party AI Subprocessors: Your catalog images and product data are never sent to external AI providers (such as OpenAI, Anthropic, or Google).
- Zero Model Training: Merchant images, catalog metadata, and generated descriptions are never used to train, evaluate, or fine-tune machine learning models.
- No Commercial Data Sharing: Merchant catalog data is never sold, leased, or monetized with any third party.
4. Subprocessors
AltQuill minimizes subprocessor exposure by running vision model inference entirely on first-party infrastructure. The subprocessors engaged for technical infrastructure are:
| Subprocessor | Function | Data Handled |
|---|---|---|
| In-House Infrastructure | AI Vision Inference | Image bytes & product metadata (in-memory only; 0 days retention) |
| Cloudflare, Inc. | TLS Termination, DDoS Mitigation & Tunnel Routing | Encrypted transit traffic (no persistent image storage) |
| Stripe, Inc. | Payment Processing & Billing | Merchant billing details (receives zero catalog images) |
5. Security Controls
- Encryption in Transit: All communications between merchant stores and AltQuill servers require modern TLS (TLS 1.3/1.2).
- API Authentication: API keys are high-entropy random tokens stored as SHA-256 hashes with a short identifying prefix; raw plaintext keys are never retrievable once generated.
- Least Privilege Architecture: Generation requires an active API key and available quota. Signup is rate limited; the API and local model have bounded concurrency and resource limits.
6. Deletion, Purging, and Return of Data
- No Images to Return: Because all images are discarded immediately after in-memory processing (0 days retention), there are no customer image repositories or archives to purge upon account termination.
- Log Deletion: Upon written request to hello@altquill.com, AltQuill will permanently delete the Merchant's account record and associated request logs, retaining only those records required by statutory tax and accounting regulations.
7. Merchant Editorial Responsibility
The Service produces assisted machine suggestions. The Merchant retains sole responsibility for reviewing suggestions in the review queue prior to publishing and verifying that descriptions accurately reflect the products sold on its store.
Direct all compliance inquiries to hello@altquill.com.