Legal & Compliance

Privacy Notice

1. Who This Notice Covers

This Privacy Notice governs your access to and use of the AltQuill service, website (altquill.com), APIs, and the AltQuill WooCommerce and Shopify integrations (collectively, "the Service"). AltQuill is operated by AltQuill (“we”, “us”).

Our customers are e-commerce merchants and store operators ("Merchants"). This notice explains how we collect, handle, and protect data transmitted to us when you use the Service.

2. What We Collect and Receive

When an authorized Merchant site makes a generation request, our API receives:

• Image Bytes: The plugin attempts to downscale product images to 768 pixels before transmission. If resizing is unavailable, it can send the original image up to 8 MiB. The Service never fetches arbitrary or unauthorized URLs.
• Product Metadata: The merchant-provided product title, categories, and attributes (e.g., color, material, dimensions, SKU) necessary to produce context-aware descriptions.
• Configuration Options: Requested language (e.g., English, Spanish), and generation preferences.
• Authentication Credentials: The API key is sent over HTTPS as a bearer credential. We store only its SHA-256 hash and a short identifying prefix, never the full key.

When you visit our website (altquill.com), Cloudflare processes connection metadata to deliver and protect the website. Our signup limiter stores a hash of the client IP and hourly counters; counters older than 48 hours are pruned during a subsequent successful signup. Application logs do not contain keys or form bodies. We do not use third-party analytics trackers, advertising pixels, or cross-site tracking cookies.

3. How We Process Data and Our AI Architecture

We use data solely to provide automated alt text, title, and caption generation for your catalog images:

• In-House Private Inference: Model inference executes on dedicated hardware operated directly by AltQuill using open vision-language model architectures (Qwen-VL).
• No Third-Party AI Subprocessors: We do not transmit your images, product descriptions, or store data to third-party commercial AI providers (such as OpenAI, Anthropic, or Google).
• Zero Model Training on Customer Data: We never train, retrain, or fine-tune artificial intelligence models on your product images, metadata, or generated text.

4. Data Retention and Zero Image Storage

• Images: Zero Retention. Image bytes exist solely in volatile RAM during the inference execution cycle. Once the response payload is returned to your server, the image is discarded immediately. We do not write product photos to disk or object storage.
• Generated Descriptions: Suggestions are returned to your store's WordPress database. We do not persist copies of your product descriptions.
• Usage Logs: For billing, quota accounting, and system health, we record per-request telemetry containing the internal key ID, request ID, UTC timestamp, language, character count, processing latency, and success/failure status. These records are retained for account support and quota accounting; automated age-based deletion is not yet implemented.
• Account Records: Signup email, a billing reference, subscription-plan cache, and hashed credentials are retained for account operation. The email and billing reference are used with Stripe to link a completed checkout to the key; entering an email alone does not verify account ownership. We send no signup email.

5. Cookies and Web Trackers

AltQuill does not use tracking cookies or third-party marketing pixels. We do not load Google Analytics, Meta Pixel, or any behavioral tracking scripts on altquill.com or within our WordPress plugin. Any browser storage used is strictly necessary for core functionality and session security.

6. End Shoppers and Store Visitors

AltQuill does not collect, receive, or store any personal data regarding your store's shoppers or end consumers. AltQuill operates exclusively on catalog assets and merchant administrative requests.

7. Security Measures

• All traffic between your store and AltQuill is encrypted in transit using Transport Layer Security (TLS 1.3).
• API keys are stored using cryptographic SHA-256 hashes.
• Our servers enforce strict network firewalling, rate limiting, and minimal surface privilege principles.

8. Your Rights and Data Deletion

Under applicable data protection laws (including the GDPR, UK GDPR, and CCPA/CPRA), you have the right to access, rectify, or request deletion of your account information and telemetry logs.

To exercise any of these rights, or to close your account and delete your merchant records, contact us at hello@altquill.com.

9. Governing Law

This Privacy Notice and any disputes arising hereunder shall be governed by and construed in accordance with the laws of the State of Texas, United States.