ALPHA STUDIO
Privacy Policy
Alpha Studio ("we"), runs this website, the account portal and our Blender extension repository. This policy explains what personal information we handle, why, who else handles it for us, and what you can do about it. We collect as little as the Service needs. We do not sell personal information, and we do not use advertising or analytics trackers.
1. What we collect, and why
| Information | Why | Basis | Kept |
|---|---|---|---|
| Email address; your password, stored only as a salted one-way hash; a display name if you give one | To run your account, confirm your address and let you sign in | Contract | Until you delete the account |
| If you sign in with Google: your Google account ID, email, name and whether Google has verified the email | To sign you in with Google | Contract | Until you delete the account |
| Whether you asked for news about launches and major updates | To send that news, and only if you said yes | Consent | Until you withdraw it (Settings, or the link in any such email) |
| What your account owns: product, which versions, where it was bought, the order reference | To let you install and update what you bought | Contract; legal obligation | While the account exists; purchase records for as long as the law requires |
| Access tokens: a hash of each token, the name you gave it, and when it was made and last used | To let Blender install and update your products, and to let you see which token is in use | Contract | Until you revoke the token or delete the account |
| Sign-in sessions: a random identifier in a cookie, of which we store only a hash | To keep you signed in | Contract | 30 days, or until you sign out |
| IP address and email address of sign-in, sign-up and password-reset attempts | To stop password guessing and abuse | Legitimate interest (security) | 1 day |
| One-time links sent by email, stored only as a hash | To confirm your address, or to reset your password | Contract | 24 hours (confirmation) or 1 hour (reset), or until used |
| What you write to support | To answer you | Contract; legitimate interest | As long as needed to resolve it; deleted within 3 years |
Payments are handled by our reseller, who acts as merchant of record (named at checkout; for example Paddle). The reseller collects your payment and billing details under its own privacy policy. We receive the order details we need, such as your email, the product and the order number, but never your card details.
What we do not collect
Our Blender add-ons do not send us your scenes, characters or files, and they do not report usage. When Blender checks our extension repository, the request carries your access token and your IP address, and may carry your Blender version and platform. We use these only to serve the list and the download.
2. Cookies
The portal uses only the cookies it needs to work:
__Host-ahs_session: keeps you signed in, for 30 days;ahs_oauth: holds a one-time check value for about ten minutes while you sign in with Google.
We use no advertising or analytics cookies. Our pages load their fonts from Google Fonts, so your browser's IP address reaches Google when a page loads. The store page also loads our reseller's checkout script when you buy.
3. Who handles information for us
These providers process personal information on our behalf, and only to provide their service to us. Some of them are in other countries, so using the Service may transfer information abroad. The transfer happens over an encrypted connection at the moment you use the feature concerned. If you do not want a transfer that an optional feature needs, such as Google sign-in or news emails, do not use that feature. The account itself cannot work without Cloudflare and Resend.
| Provider | Country | What for | Information | Kept |
|---|---|---|---|---|
| Cloudflare, Inc. | USA (data centres worldwide; our database is in the Asia-Pacific region) | Hosting, database, security, forwarding mail sent to our support address | Everything in section 1 | As in section 1; database backups roll off within 30 days |
| Resend | USA | Sending account emails (confirmation, password reset, notices) | Email address, the message | Delivery records, under Resend's policy |
| Google LLC | USA | Google sign-in, if you use it; our support inbox | Google account ID, email, name; support mail | Sign-in: not kept by us beyond section 1; support mail as in section 1 |
| Our reseller (e.g. Paddle.com Market Ltd) | United Kingdom | Payments, tax, receipts, refunds | Email, billing details, order | Under the reseller's policy |
We may also disclose information when the law requires it, or to protect the Service and its users against fraud or abuse.
4. How we protect it
Every connection to the Service is encrypted. Passwords are stored only as salted one-way hashes. Sessions, access tokens and emailed links are stored only as hashes, so a copy of our database could not be used to sign in. Sign-in attempts are rate-limited. Changing your password signs out your other devices. Only Alpha Studio can reach the database.
5. Your rights
- See and correct: your account details are in the portal under Settings, where you can change your name, your password and your news preference.
- Delete: Settings → Delete account removes your account from our live database at once. Backups roll off within 30 days. Purchase records the law requires us to keep are kept apart and used for nothing else.
- Get a copy, restrict or object: write to us, and we will answer within 10 days (at the latest within one month).
- Withdraw consent to news emails at any time. This does not affect emails your account needs, such as receipts or password resets.
If you are in the EU, the UK or another country with similar law, you have the rights that law gives you, including the right to complain to your data protection authority.
6. Children
The Service is not meant for children under 14, and we do not knowingly collect their information. If you believe a child under 14 has made an account, tell us and we will delete it.
7. Changes
We will post any change here with a new date. If a change affects how we use information you have already given us, we will email account holders before it takes effect.
8. Contact
For privacy requests and questions, write to Alpha Studio Support, who handles privacy matters: support@alphahumanstudio.com.