Effective August 23, 2026
Privacy Policy
The short version
- We store your email, the URLs you submit and the text we scrape from them, the creatives we generate, and billing metadata.
- We never see your card number. Stripe handles payments end to end.
- Your content is not used to train AI models. Our accounts with AI providers are configured to exclude training.
- Analytics is opt-in and off unless you accept. We respect Do Not Track.
- You can export or delete everything from Settings, yourself, at any time.
1. Who we are
ACCTAN is the data controller for personal data processed through Advellum (advellum.com).
Privacy contact: privacy@advellum.com
Placeholder: the registered company address, company number, and any required EU/UK representative or DPO details must be inserted here before launch.
2. What we collect
Account data
Your email address, and if you provide them, your name and company name. If you sign in with Google, we receive your email, name and profile image from Google — never your password.
Content you submit
- URLs you submit for scraping.
- Scraped page text — the readable content of those pages. We retain this so you can regenerate without re-scraping. You can delete any product, which deletes its scraped text.
- Brand assets you upload, such as logos, plus colours, tone of voice, target audience and banned words.
- Generated creatives — the copy, images and scripts we produce, plus any edits you make.
Billing data
A Stripe customer identifier, your plan, subscription status and billing period. Your payment card details are collected and stored by Stripe — we never receive or store card numbers.
Usage data
With your consent, product analytics: pages viewed, features used, generations started and completed. Without consent, we do not run analytics. Server logs recording errors and request metadata are kept for security and debugging regardless, on the basis of legitimate interest.
3. Why we process it, and our lawful basis
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Providing the Service — scraping, generating, storing and exporting creatives | Performance of a contract (Art. 6(1)(b)) |
| Billing, invoicing and fraud prevention | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Transactional email — receipts, export links, security notices | Performance of a contract (Art. 6(1)(b)) |
| Marketing email about new features | Consent (Art. 6(1)(a)) — opt-in, withdrawable in one click |
| Product analytics | Consent (Art. 6(1)(a)) — via the cookie banner |
| Security, abuse prevention, rate limiting, service improvement | Legitimate interests (Art. 6(1)(f)) |
4. AI providers and training
To generate creatives we send the scraped page text and your brand settings to our AI providers (Anthropic for text, Replicate for images).
Our accounts with these providers are configured so that customer content is not used to train their models. Providers retain content only transiently for abuse monitoring in line with their own policies. We do not use your content to train any model of our own, and we never use one customer's brand assets or creatives for another customer.
5. Subprocessors
We use these third parties to run Advellum:
| Provider | Purpose | Location |
|---|---|---|
| Railway | Application hosting, Postgres database, Redis queue, object storage | United States |
| Anthropic | AI copywriting, product extraction and video scripts | United States |
| Replicate | AI image generation (FLUX) | United States |
| Stripe | Payment processing, subscription billing, invoices | United States / global |
| Resend | Transactional email delivery | United States |
| PostHog | Product analytics (only with your consent) | United States |
| Browserless | Rendering JavaScript-heavy pages during scraping | United States / EU |
| Optional Google sign-in (OAuth) — only if you use it | United States / global |
We will update this list before engaging a new subprocessor that materially affects the processing of your data.
6. Who else sees your data
We do not sell personal information, and we do not share it for cross-context behavioural advertising. Beyond the subprocessors above, we disclose data only where legally required (valid legal process), to establish or defend legal claims, or as part of a merger or acquisition — in which case you will be notified and this policy will continue to apply until replaced.
7. Your rights
Depending on where you live you may have the right to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent at any time.
You can exercise the main ones yourself, immediately, in the product:
- Access and portability — Settings → “Download my data” returns everything we hold as JSON.
- Deletion — Settings → “Delete my account”. This cancels billing immediately and, after a 7-day grace period, permanently erases your database records and your stored image objects.
- Correction — edit your profile and brand details directly in the product.
- Withdraw analytics consent — Settings → analytics opt-out, or via the cookie banner.
- Withdraw marketing consent — the one-click unsubscribe link in any marketing email, or the toggle in Settings.
For anything else, email privacy@advellum.com. We respond within 30 days. If you are in the UK or EEA you may also complain to your local supervisory authority.
California (CCPA/CPRA)
California residents have rights to know, delete, correct, and to opt out of sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CPRA, and we do not process sensitive personal information for inferring characteristics. We do not discriminate against anyone exercising these rights. The in-product tools above satisfy know, delete and correct requests.
8. Third-party personal data in URLs you submit
If a page you submit contains personal data about someone else — a founder biography, a named testimonial, a customer photograph — you are the controller of that content and we process it as your processor, on your instructions, solely to generate your creatives. You are responsible for having a lawful basis to submit it.
9. International transfers
Our providers are primarily in the United States, so data may be transferred outside the UK and EEA. Where required we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with the additional safeguards those clauses require.
10. How long we keep things
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account |
| Scraped page text | Until you delete the product, or your account |
| Generated creatives and images | Until you delete them, or your account |
| Export ZIP files | Download links expire after 7 days; files cleared periodically |
| Billing records | Up to 7 years, where tax and accounting law requires |
| Server and error logs | Up to 90 days |
| Analytics events (if consented) | Up to 12 months |
| Deleted accounts | Hard-deleted within 30 days of the grace period ending |
11. Security
Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted to the minimum number of people who need it. Every database query in the application is scoped to the authenticated account, so one customer cannot reach another's data. Stored files are served through short-lived signed URLs rather than public links.
No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the relevant authority within the timeframes the law requires.
12. Cookies
We use a small number of cookies. See our Cookie Policy for the full list and how to control them.
13. Changes to this policy
We will post any updated policy here with a new effective date. For material changes we will email you at least 30 days beforehand.
14. Contact
privacy@advellum.com
Advellum — an ACCTAN product