Privacy Policy

01Scope

This policy explains how Altavera Technologies handles personal data when you use SceneUI. It covers the website, your account, saved designs and projects, and our support inbox.

It does not cover third-party sites we link to. If a design you copy depends on an external package, that package's own terms apply.

02What we collect

• Account details: your email address, a display name if you provide one, and — if you sign in with Google or GitHub — the account identifier and email that provider shares with us.
• Credentials: if you use email and password, we store a salted hash of your password. We never store the password itself.
• Your work: the designs you save, projects you create, and any text or media you add to them.
• Billing details: your plan, billing period, renewal date, and the last four digits and card brand of the payment method. Full card numbers never reach our servers — Lemon Squeezy collects and stores them.
• Technical data: IP address, browser and device type, and timestamps, generated in server logs when you make a request. We use these to keep the service secure and working.
• Support messages: whatever you send us when you contact us.

03What we do not do

• We do not run third-party advertising or cross-site tracking scripts.
• We do not sell personal data, and we do not share it for behavioural advertising.
• We do not record your screen, keystrokes, or the contents of pages outside our service.
• We do not ask for more than we need to run the product.

04Why we use it

• To create and secure your account, and to sign you in.
• To provide the library, save your work and render your projects.
• To take payment, issue invoices and manage subscriptions.
• To answer support requests and fix problems you report.
• To detect abuse, prevent fraud, and keep the service available.
• To meet legal, tax and accounting obligations.

05Our legal bases

Where data protection law requires a legal basis, we rely on: performance of our contract with you (running your account and the service); our legitimate interests (security, fraud prevention, improving the product, and answering you); your consent where we ask for it, such as optional product email; and compliance with legal obligations (tax and accounting records).

You can withdraw consent at any time, and it will not affect processing that already happened.

06Cookies and local storage

We use a small number of strictly necessary cookies. The main one is a signed, HTTP-only session cookie that keeps you signed in; it cannot be read by page scripts. We also use local storage to remember interface preferences such as light or dark theme.

Because these are needed for the service to work, they are not optional. We do not set advertising or analytics cookies.

07Who processes data for us

We share personal data only with providers that are necessary to run the service. They act on our instructions and are bound by their own data processing terms.

• Lemon Squeezy — payment processing, subscription management, invoices and tax handling, acting as merchant of record.
• Our hosting and infrastructure providers — serving the website and API, and storing the database.
• Cloudflare R2 or equivalent object storage — storing preview media.
• Our email provider — delivering transactional messages such as sign-in and receipts.
• Professional advisers and authorities — only where we are legally required to disclose, or where needed to establish or defend a legal claim.

08International transfers

We are based in Bangladesh and use providers whose servers are mainly in the United States and the European Union. Your data may therefore be processed outside the country where you live.

Where required, transfers rely on appropriate safeguards such as standard contractual clauses. Write to us if you want details of the mechanism used for a specific provider.

09How long we keep it

• Account and work data: while your account is open, then deleted within 30 days of a verified deletion request — except where we must keep something for a legal obligation.
• Billing and tax records: kept for the period required by accounting and tax law, which is generally six to ten years.
• Server logs: kept for a short period, typically under 90 days, then deleted or aggregated.
• Support messages: kept for up to two years so we can refer back to past issues.

10Your rights

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to certain processing, receive it in a portable format, or complain to a supervisory authority.

To exercise any of these, email us. We answer within 30 days and may ask you to verify you control the account before acting. If we cannot fulfil a request because of a legal obligation, we will tell you why.

11Security

Passwords are stored as salted hashes. Sessions are signed HTTP-only cookies. Access to production data is limited to the people who need it, and transport is encrypted with HTTPS.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as required by law.

12Children

The service is meant for people who can enter into a contract. It is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.

13Changes to this policy

If we change how we handle personal data, we update this page and its date. Material changes are announced in the product or by email before they take effect.

14Contact

Privacy questions and requests: altaveratechnologies@gmail.com. This is also the address for data protection enquiries, and for reaching whoever is responsible for privacy at Altavera Technologies.