Alvalan Privacy Policy
Last updated: [19 October 2026]
1. Who we are
PhygitalTwin Ltd, trading as Alvalan (company no. 14146111, registered office Unit 4 Grovelands, Boundary Way, Hemel Hempstead, Herts, HP2 7TE), is the controller of the personal data described in this policy. We are registered with the Information Commissioner's Office, registration number ZC272583.
Questions or requests: info@alvalan.com.
If your organisation uses Alvalan under a separate agreement, we process personal data contained in its uploaded content as a processor, on its instructions, under a Data Processing Agreement.
2. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored securely, never in plain text), date of birth, gender, profile picture | You, when you sign up, or Google if you sign in with Google |
| Your content | Uploaded files, sketches, textures, generated 3D models, exports | You, and the Service |
| Export videos | A short video of each exported garment, with a quality score | Created by the Service when you export |
| Credits and activity | Generations, re-rolls, exports, failures, credits used and earned | The Service |
| Product analytics | Pages viewed, features used, clicks, session recordings, device and browser type, approximate location from IP address | PostHog, only with your consent |
| Communications | Support messages, feedback, ratings, survey answers | You |
| Promotion | Your X handle and post, Roblox marketplace listing links | You, when you claim credits or tag us |
We do not ask for sensitive personal data. Your uploads may contain personal data, for example a model's face or a designer's name in file metadata. Please only upload it if you are allowed to.
Age and gender. At sign-up we ask for your date of birth, to check you are 13 or over and to apply extra protections if you are under 18 (see section 9). We store your date of birth with your account and delete it when your account is deleted. We also ask for your gender, and you can choose "Prefer not to say". We use your gender, on the basis of your consent, only to understand who uses Alvalan, in aggregate, and to shape the product. Choosing "Prefer not to say" does not affect your account, and you can change or remove your answer at any time in your profile.
3. How we use it and why
| Purpose | Lawful basis |
|---|---|
| Create and run your account, generate and export your designs | Contract |
| Track, award and deduct credits; prevent duplicate accounts and fraud | Contract and legitimate interests |
| Record export videos to check and improve output quality | Legitimate interests |
| Send service emails about your account, credits and beta changes | Contract |
| Product analytics and session recordings | Consent |
| Feature your design on our website and social channels | Consent (you tagged us or entered) |
| Marketing emails about Alvalan | Consent, or legitimate interests for existing users, with an unsubscribe link in every email |
| Meet legal, tax and accounting duties | Legal obligation |
4. AI processing
To turn sketches and images into 3D models, we send them to AI providers acting on our behalf. We use paid plans with Tripo and OpenAI. Their terms prohibit them from training on your inputs, such as sketches and reference images, or on the outputs. We do not use your content to train AI models without your permission, and we do not share your 3D models with any other third party.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Who we share it with
We do not sell your personal data. We share it only with service providers who process it for us under contract:
| Provider | What they do | Data location |
|---|---|---|
| Amazon Web Services | Hosting and file storage | London, United Kingdom (eu-west-2) |
| Tripo | 3D model generation | Hong Kong |
| OpenAI | AI processing | United States |
| Sign-in | Not applicable: sign-in only, we store no data with Google | |
| SendGrid (Twilio) | Service emails | United States |
| PostHog | Product analytics (with consent) | European Union |
| Slack | Internal quality alerts on exports | United States |
| Metabase | Internal reporting on accounts, credits and usage | Frankfurt, Germany (EU) |
| Intercom | Support chat and help messages | United States |
We use Intercom to handle customer support messages. Messages and contact details you send through our chat are processed by Intercom, Inc. and its sub-processors and are stored in the United States. Transfers are protected by Standard Contractual Clauses and the UK International Data Transfer Addendum under our Data Processing Agreement with Intercom.
When you export to Roblox or post on X, you send your content to that platform yourself, under its own terms and privacy policy.
We may also disclose data to professional advisers, to a buyer of our business, or where the law requires it.
6. International transfers
Some providers process data outside the UK. We protect these transfers with the UK-US Data Bridge, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account data and your content | While your account is open, then deleted within 30 days of closure |
| Export videos | 12 months, or sooner on request |
| Product analytics | 12 months |
| Session recordings | 30 days |
| Support messages | 2 years after your last contact with us |
| Payment and accounting records | 6 years, as required by law |
If you close your account, we delete your content, export videos, product analytics and session recordings within 30 days, whatever the periods above. We may keep data longer if we need it to resolve a dispute or meet a legal duty.
8. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your data;
- correct it;
- delete it;
- restrict or object to how we use it;
- give you your data in a portable format;
- withdraw consent at any time, for example to analytics.
Email info@alvalan.com. We reply within one month. To delete your account and content, email us from the address on your account; we complete deletion within 30 days.
You can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to resolve it first.
9. Age
Alvalan is for people aged 13 and over. If you are under 18, you need your parent or guardian's permission to use Alvalan. For under-18s we use the most private settings by default: analytics cookies and session recordings stay off, we send no marketing emails, and we never feature your work publicly without your permission. If we learn that someone under 13 has an account, we will close it and delete their data within 30 days.
10. Security
All data is encrypted in transit. Your uploaded files, designs, generated 3D models, exports and export videos are stored privately and encrypted at rest. Our database can only be reached through a private network (VPN), with access limited to authorised team members. No system is completely secure; if a breach affects you, we will tell you as the law requires.
11. Changes
We will post updates here and email you whenever we change this policy. For material changes, we will email you at least 14 days before they take effect.