Who is responsible
AAL Studio is operated by the operator whose verified details will be published before paid registration opens, identified in the Imprint. The provider is responsible for deciding how and why personal information is processed for this service.
For privacy requests, email hi@aal.studio or use the contact page.
Data we process
- Account and profile: Clerk account ID, email address, name, profile details, settings and onboarding progress.
- Creative work: prompts, generation settings, uploaded references, generated media, sharing settings and AI assistant conversations.
- Credits and billing: credit balance and ledger, subscription and Stripe identifiers, and purchase or refund records. Card details are handled by Stripe.
- Support: details and messages submitted through the contact form, including the consent record attached to the request.
- Security and operations: request and rate-limit signals, error and service logs, and hashes of prompts blocked by safety checks (older records may include short excerpts until retention cleanup).
- Optional analytics and performance: measurement data only when you enable it in Cookie Preferences.
Why we use it
- Provide your account and creative tools — to authenticate you, save your work, generate media, and administer credits (GDPR Article 6(1)(b)).
- Process payments and meet accounting duties — to reconcile purchases, subscriptions, refunds and required records (Articles 6(1)(b) and 6(1)(c), where applicable).
- Protect and operate the service — to prevent abuse, enforce usage rules, troubleshoot failures and keep the platform reliable (Article 6(1)(f), where our legitimate interests apply).
- Respond to contact requests — to take requested pre-contract steps (Article 6(1)(b) GDPR) or, for other enquiries, to respond in our legitimate interest (Article 6(1)(f)). The form records that you were shown this notice; that acknowledgement is not the legal basis for handling your enquiry.
- Measure optional product usage and performance — only with consent (Article 6(1)(a)) through Cookie Preferences; you may withdraw your choice at any time.
Prompts and reference files may be sent to OpenRouter and the model provider selected for a generation. Do not submit information you are not entitled to share or that you do not want processed by those providers.
Service providers
Depending on the feature you use, data may be processed by:
- Clerk — account authentication;
- Convex — application data and media records;
- OpenRouter and the selected AI model provider — assistant and generation requests;
- Cloudflare R2 — generated media storage and delivery;
- Stripe — checkout, subscription management, payment and refund records;
- Upstash — short-lived rate-limit, queue and operational state;
- Vercel — application hosting and, when enabled, optional analytics and performance measurement.
- Resend — transactional cancellation and withdrawal acknowledgements, when configured and approved; no marketing use.
Each provider processes information under its applicable service terms and privacy documentation. Provider configuration, processing locations and safeguards depend on the feature and production deployment. You can contact us for information about a specific processing activity.
International processing
Some service providers may process information outside the European Economic Area. Where applicable, transfers are governed by the safeguards required under data-protection law, such as an adequacy decision or standard contractual clauses. Contact us for information about the safeguards relevant to a particular service provider.
AI-generated media and German/EU rules
Prompts, reference files, settings and outputs are processed to provide generation and editing features. The EU AI Act (Regulation (EU) 2024/1689), including Article 50 transparency duties, applies in Germany. AAL Studio is designed to identify generated media in product records and to support responsible use. Transparency duties depend on the feature, the parties’ roles and the context in which media is shared. Users should retain provenance information and provide any disclosure required when publishing or distributing generated content.
Privacy information is provided under the GDPR, including Articles 13 and 14. Browser storage and access are governed by Section 25 TDDDG: consent is requested where required, while storage strictly necessary for a service you expressly request may be exempt. You can change optional analytics choices in Cookie Preferences.
How long we keep data
We keep account and creative data while your account is active. Standard account deletion offers a 30-day recovery period; you can also request erasure without that recovery wait in Settings or by contacting us. Permanent cleanup runs in bounded batches. Security events, optional usage records and AI cost records are scheduled for removal after 30 days; spending counters after 62 days; contact messages after 180 days. Minimum payment and reversal evidence is stored separately from creative data for the applicable statutory retention period, configured and reviewed before launch (normally up to eight years for relevant German accounting records). Cancellation and withdrawal declarations are retained for request handling and legal claims; resolved, delivered declarations are scheduled for removal after four years. Provider and backup retention may differ and must follow the documented provider safeguards and deletion lifecycle.
You can request an export or start account deletion in Settings. Deletion first stops future Stripe subscription billing. Restoring an account does not automatically restart a cancelled subscription. Records retained for legal obligations are restricted to that purpose.
Your rights
Subject to the conditions in data-protection law, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing is based on consent, you can withdraw consent at any time; withdrawal does not affect processing already carried out. You may also complain to a supervisory authority.
You may complain to the supervisory authority responsible for your residence, workplace or an alleged infringement. Our operator’s competent authority will be specified with the verified operator details before paid registration opens.
This notice is maintained with reference to the data-protection and digital-services rules applicable to AAL Studio, including the GDPR, EU AI Act, and Section 25 TDDDG.