Privacy Notice.

Notice at collection

Altifigence processes information supplied through account registration, sign-in, checkout, product workspaces, support, and legal or security communications, together with technical records needed to operate and protect those services. Paddle processes eligible online orders as Merchant of Record. Apart from the consent-based X (Twitter), OpenAI and Google Ads advertising measurement described below when enabled, the public site does not load advertising pixels or advertising profiles.

Information collected

Depending on the feature used, information may include name, email, organization, country or region, age-check results (whether you are 14 or over, and whether you are an adult or a minor), a minor's guardian email address and guardian consent records, authentication and security metadata, plan and entitlement status, Paddle transaction identifiers, currency, tax and receipt data, support or legal messages, and customer content that you deliberately submit to a Cloud, AI, synchronization, or support feature. Company AI may also process account-linked minors’ violation/help-guidance counts and dates, minors’ provider-refusal counts/dates, adult provider-signal counts/dates, general subcategories, very serious categories and individual-account refusal-classification results, and manual-action and legal-request/disclosure audit records. Detailed fields and launch conditions are distinguished below.

Hosting and security systems may create records such as IP address, request time, URL, user agent, response status, session integrity signals, and abuse-prevention events. Essential browser storage maintains language, acknowledgement, account-session, request-integrity, security, and checkout continuity.

This can also include a phone number you choose to add for account recovery, with the time it was confirmed and its page language, and account-recovery request records (request, waiting and end times and the reason it ended).

Purposes of use

Altifigence uses information to create and protect accounts, authenticate users, check age at sign-up and protect minors, provide selected product and workspace features, manage subscription and feature access, deliver public downloads, reconcile orders and refunds, answer requests, prevent misuse and meet legal, tax, accounting and contractual duties. Company-AI minors’ protection records, provider-refusal/adult-signal aggregation, individual-account refusal classification, threshold access and manual adult action by the owner and authorized staff, lawful external-request handling and quarterly reports that do not identify individuals follow the purpose-specific lawful-basis, access and retention conditions below.

Consent records and notice versions

Clarification dated 4 October 2026.

At sign-up, we record agreement to the terms, acknowledgement of the privacy notice, the sign-up notice version and the time. The sign-up notice version identifies that notice; it is separate from the revision of each linked legal document. Checkout separately presents the order, payment and renewal terms and Paddle buyer and privacy notices. Publishing a revised legal page does not itself mean you accepted it or authorized another payment. Optional marketing and analytics choices are separate from the required sign-up choices and can be withdrawn through their respective controls.

Account and organization management explanation: 2026-09-30

This supplement explains the Account features described below when they are offered. Existing orders, statutory rights and purpose-specific retention duties continue to apply. Material changes to an existing contract still require the applicable notice and consent process.

Organization membership and permissions

When you use organization administration, Account processes member and invitation identifiers, names and email addresses, organization membership, group membership, roles and permission assignments, and records of management actions. These records support invitations, access control, administration and review of security-related changes. Audit entries identify the acting account, the action, its target, its outcome and its time; they may include relevant change details.

Members with the required permissions can view or manage the corresponding membership, invitation, group, role or audit information for their organization. Access is limited to the authorized organization and function. A group or role assignment does not authorize access to another organization's information, or enable an external institution's SSO or SCIM connection.

Optional marketing email

Account preference and browser-memory notice version: 2026-09-21. These options apply when the corresponding feature is offered; this notice does not enroll existing accounts.

Altifigence (알티피전스), 160 Landmark-ro, Yeonsu-gu, Incheon, Republic of Korea, asks separately for permission to use your account email for its product news and offers and permission to send those marketing emails. Both choices are off by default; you can create and use an account without either. No other personal information is used for this marketing purpose. The marketing use lasts until you withdraw either choice or close your account. Consent choices, notice version, source and time are recorded to demonstrate and respect your decision; they are not permission to continue marketing after withdrawal.

Change or withdraw your choices without charge in Altifigence Account → Preferences → Marketing email, or contact contact@altifigence.com. Security, account and necessary service messages are separate. Changing your account email resets both marketing choices. Marketing delivery is not enabled by the preference feature alone; any future marketing email must identify Altifigence, include a working unsubscribe method that does not require sign-in, and check your current permission before sending. This optional consent does not replace other applicable privacy rights or legal bases for account processing.

Remembered accounts on this browser

Browser-session notice updated 2 November 2026. Unless you turn remembering off, Auth's account chooser in this browser lists up to 12 accounts that have signed in on this browser, including accounts that are no longer signed in. Browser sessions follow a 30-day inactivity limit. Where session renewal is available, the service may extend the deadline after verifying activity in a visible, focused page; restoring a cookie or keeping a background page open does not revive an expired or revoked session. The server checks the central Auth session and each linked service session separately. Account-selection data is held in encrypted, host-only, HttpOnly, Secure, SameSite=Lax cookies on auth.altifigence.com: the browser-session cookie __Host-altifigence_accounts holds valid sign-ins, and the cookie __Host-altifigence_profiles holds the remembered list. The remembered list contains only an internal entry ID, the account's user ID and a last-used time; it contains no password, sign-in credential, token, email address or name. It is kept for up to 400 days from its last update, and each sign-in on this browser updates it. To show the chooser, the server reads the list and looks up each account's name, email address and profile picture; accounts that are no longer active, such as closed accounts, drop out of the list. Essential authentication cookies may persist for up to 30 days. Browser settings, cookie removal, sign-out or a security action may end access sooner. Expired or revoked sign-ins are removed on the next validation, and signing out does not remove an account from the list. An account that is no longer signed in stays in the list; choosing it never signs you in, and you must sign in again. Removing an account deletes it from this browser's list and, if it is still signed in, also revokes its associated central session. This does not authorize marketing or analytics, share cookies with other sites, or change product permissions. Additional authentication may still be required for sensitive actions. To stop remembering accounts on this browser, choose “Don't remember accounts on this device” in the account chooser: the remembered list is deleted, and the cookie __Host-altifigence_profiles_off, which contains no account information, is set for 400 days. While it is set, no account is remembered and only accounts that are still signed in are listed. “Remember accounts on this device”, deleting that cookie, or its expiry turns remembering back on. After using a shared device, turn remembering off and remove each account.

Public downloads

A public installer download does not require an account or payment information. Files released through the official pipeline are served by Cloudflare from controlled storage. Requests can generate IP, time, requested path, user-agent, response and abuse-prevention records, including rate-limit checks. Public access does not mean anonymous network traffic or an absence of security records.

Service providers and sharing

Cloudflare, Inc. provides hosting, storage and security for the selected account and Cloud features and processes the account identifiers, request and security metadata, and customer content needed by those features. The Paddle entity identified at checkout receives buyer, billing and payment information to handle eligible online orders as Merchant of Record. Authentication, email, repository, accounting and other providers are used as needed for the selected service or legal duties. Altifigence does not sell personal information. Except for the X (Twitter) and OpenAI advertising-pixel disclosures and the Google Ads tag disclosures described below when enabled with advertising consent, Altifigence does not share personal information for cross-context behavioral advertising. Outside authorities’ legal requests for company-AI records follow the separate procedure below; reaching a signal threshold or receiving a request alone does not authorize external disclosure.

When you choose an AI or Cloud feature, the submitted conversation, selected project context or job inputs may contain design source and other customer information. Cloudflare provides hosting, security and API transport; a selected compute route may use Google Cloud. In company-provided AI (Managed AI), Anthropic PBC or OpenAI answers each task under the company API key, and the company-provided AI processing and international-transfer section below applies. Customer API-key connections (BYOK) can include OpenAI, Anthropic, xAI and Z.ai, according to the connection you select; provider billing, processing and retention can also be governed by your own provider agreement. Customer content, API keys and AI data handling.

Twilio Inc. (United States) sends number-confirmation text messages for accounts that add a phone number, and account-recovery text messages once email+SMS recovery opens in a later update. See Optional phone number: text messages sent outside your country.

Public-site analytics, advertising and cookie choices

Necessary technologies are always on. Optional analytics and advertising are initially off and are enabled only if you choose the corresponding category. The analytics option is available when an analytics provider is configured; the current provider is Cloudflare Web Analytics. Accept all enables Cloudflare Web Analytics on eligible public pages and, when the X pixel is enabled, X advertising on marketing pages. When the OpenAI pixel is enabled, Accept all also enables OpenAI advertising on marketing pages without forms. When Google Ads measurement is turned on, Accept all also enables it on the same marketing pages without forms. Reject non-essential keeps both optional categories off; Settings lets you choose each available optional category separately. No analytics or advertising script is requested before a current choice allows the corresponding category. Earlier acknowledgements do not authorize Cloudflare Web Analytics. Choices expire after 180 days. Cookie preferences in the footer lets you change or withdraw permission; withdrawing analytics or advertising reloads the page to stop the script. Global Privacy Control keeps analytics and advertising off. These choices do not change essential Auth sessions: remove an account in the Auth chooser to revoke its central session.

Cloudflare Web Analytics receives page-view and browser performance measurements through its beacon. It does not use analytics cookies or local storage to identify visitors, and we do not add account identifiers to it. Analytics is excluded from sign-in, account, checkout, contact forms and pages with query parameters. Cloudflare still receives network requests needed to deliver this service; ordinary hosting and security logs are separate. We store your analytics choice in altf-cookie-ack, not in an analytics identifier. Further optional tools require a new notice and applicable choice. This cookieless measurement provides aggregate reports.

X (Twitter) advertising measurement

When enabled, we use X (Twitter) for advertising measurement and conversion attribution for our ads on X. This processing is based on your advertising consent. The X pixel loads only after that consent and only on www.altifigence.com marketing pages; it does not run on account, sign-in, checkout or product-workspace pages.

When the pixel runs, X may receive cookie or device identifiers, the page URL, page-view, sign-up-start and checkout-start events (clicks in the content of marketing pages on sign-up, sign-in, Cloud or Account links, or on pricing or checkout links), browser and device information, and your IP address as X receives it. We do not send X your name, email address or Altifigence account ID, including through page URLs or referrers. On www.altifigence.com the pixel sets the first-party cookies _twpid and _twsid, and _twclid when you arrive from an X ad; if you withdraw advertising consent, the site deletes these cookies.

For this advertising feature, your choice is stored only in your browser (altf-cookie-ack) and expires after 180 days. The pixel sends its data to X directly, not to our servers; ordinary hosting and security logs are separate, as described above. X's use and retention of data it receives are described in X's Privacy Policy.

As described in X's international-transfer information, X may transfer information to or store it in the United States, Ireland and other countries where it operates. You can change or withdraw advertising consent through Cookie preferences in the footer. Additional controls are available through X's personalization and data settings guidance; those controls are separate from withdrawing consent on our site.

OpenAI advertising measurement

When enabled, we use OpenAI for advertising measurement and conversion attribution for our ads on OpenAI's advertising services. The recipient is OpenAI OpCo, LLC (United States); OpenAI Ireland Limited processes the data of people in the European Economic Area or Switzerland. This processing is based on your advertising consent. The OpenAI pixel loads only after that consent and only on www.altifigence.com marketing pages without forms; it does not run on pages with forms or on account, sign-in, checkout or product-workspace pages. The marketing pages concerned are listed in the Cookie Notice.

When the pixel runs, OpenAI may receive the pixel's own start-up and diagnostic events (sdk_init and diagnostic), a page-view event (page_viewed), a sign-up event (register) when you click a sign-up, sign-in, Cloud or Account link in the content of those pages, the page URL and referrer limited to their origin and path (without query or fragment), the identifiers stored in the cookies described below, browser information, and your IP address as OpenAI receives it. We do not send OpenAI your name, email address, phone number or Altifigence account ID, including through page URLs or referrers. The pixel's remote matching configuration is blocked by this site's Content Security Policy (CSP). On www.altifigence.com the pixel sets the first-party cookie __obref (a random browser identifier, kept for up to 365 days) and, when you arrive from an OpenAI ad link that carries the oppref parameter, __oppref (OpenAI's ad click identifier, kept for up to 30 days). It also keeps its consent state in the __oaiq_consent cookie, in local storage (oaiq_consent) and in session storage (oaiq_cs: followed by our pixel ID), and may briefly set __oaiq_domain_probe to find the cookie domain. If you withdraw advertising consent, the site stops the pixel and deletes these cookies and storage entries.

For this advertising feature, your choice is stored only in your browser (altf-cookie-ack) and expires after 180 days. The pixel sends its data to OpenAI directly, not to our servers; ordinary hosting and security logs are separate, as described above. OpenAI receives this data as an independent controller under its advertising terms. OpenAI's use and retention of data it receives are described in OpenAI's Privacy Policy and, for the European Economic Area, Switzerland and the United Kingdom, OpenAI's European privacy policy.

As described in those policies, OpenAI may process this information in the United States and in other countries where OpenAI or its service providers operate. You can change or withdraw advertising consent through Cookie preferences in the footer. Additional controls are available through OpenAI's guidance on ads and ad controls and the OpenAI privacy portal; those controls are separate from withdrawing consent on our site.

Google Ads advertising measurement

When Google Ads measurement is turned on, we use Google Ads for advertising measurement and conversion attribution for our ads on Google Ads. The recipient is Google LLC (United States) and its affiliates; under Google's ads controller terms, Google Ireland Limited is the controller for people in the European Economic Area or Switzerland. This processing is based on your advertising consent. The Google tag loads only after that consent and only on the same www.altifigence.com marketing pages without forms as the OpenAI pixel. The marketing pages concerned are listed in the Cookie Notice.

When the tag runs, Google may receive page views and conversion events on these pages, such as starting sign-up or visiting a product page; the tag sends one sign-up conversion event when you click a sign-up, sign-in, Cloud or Account link in the content of those pages. Google may also receive the page URL and referrer limited to their origin and path, the page title, the ad click identifiers that the tag reads from the page address (gclid, gclsrc, dclid, gbraid, wbraid, gad_source, gad_campaignid and _gl), tag, consent and diagnostic information, browser and device information, and your IP address as Google receives it. We do not send Google your name, email address, phone number or Altifigence account ID. The tag loads from www.googletagmanager.com and sends its requests to www.google.com and www.googleadservices.com. Our configuration turns off Google's conversion linker, so the tag sets no cookies on www.altifigence.com; it keeps measurement data, such as an ad click identifier, in the local storage entry _gcl_ls, whose items expire after 90 days, 24 hours or 5 minutes. If you withdraw advertising consent, the site stops the tag and deletes _gcl_ls and any _gcl_* cookies.

For this advertising feature, your choice is stored only in your browser (altf-cookie-ack) and expires after 180 days. The tag sends its data to Google directly, not to our servers. Google receives this data as an independent controller under its ads controller terms; its use and retention of that data are described in Google's Privacy Policy and How Google uses information from sites or apps that use its services.

Google may process this information in the United States and in other countries where Google or its service providers have facilities. You can change or withdraw advertising consent through Cookie preferences in the footer. Google's My Ad Center, partner ads settings and My Activity offer further controls; they are separate from withdrawing consent on our site, and turning off ad personalization there does not stop all measurement.

International processing

Infrastructure, payment and selected AI providers may process data outside your country. Do not assume that a local app, a Korean-language page or an API-key connection keeps every request in Korea. Where applicable law requires transfer-specific disclosure, consent or safeguards, those requirements apply to the relevant feature and contract; accepting these general terms is not blanket consent to every overseas transfer. Contact contact@altifigence.com for a privacy or transfer-related request.

Advertising measurement: international transfer

If you give advertising consent on www.altifigence.com, your browser sends the data in the table directly to each vendor whose measurement is enabled, over encrypted HTTPS and not through our servers, when a measured page loads or a measured link is clicked; for Google, when you consent on pages where Google Ads measurement is on. The data may be processed in the United States and in other countries where the vendor or its service providers operate, and for X also in Ireland. The purpose is advertising measurement and conversion attribution for our ads on that vendor's service, based on your advertising consent. To refuse, do not give advertising consent; nothing is then transferred. You can withdraw at any time through Cookie preferences in the footer, which stops the measurement and deletes its browser storage. Refusing or withdrawing does not affect your use of the site or our services.

Optional phone number: text messages sent outside your country

If you add a phone number in Altifigence Account settings (optional), we entrust a provider in the United States with sending the text messages needed to confirm the number and to recover your account with your email and phone, as set out below. A phone number is never used to sign in, and nothing is transferred if you do not add one. This section applies once number confirmation opens; until then a number cannot be added. Email+SMS account recovery will be provided in a later update, after our sender number is registered; until it opens, we send only number-confirmation codes and no recovery codes or recovery notices.

Altifigence keeps a confirmed phone number, with the time it was confirmed and its page language, until you remove it or the deletion of the account is completed, and then deletes it at once. If a withdrawal or other account deletion is cancelled or stops before completion, the account and its number remain. A number that is not confirmed is not saved to your account. Ended account-recovery request records (request, waiting and end times, state and the reason it ended) do not contain the phone number and are deleted 30 days after the request ends. Rate limits use a keyed hash of the number, counted over 24 hours. Security events for adding or removing a number and for recovery, and database backups, follow the Retention section and the rules for account security records.

We disclose this entrustment and international transfer in this Privacy Notice and on the phone number screen, as entrusted processing disclosed under Article 28-8(1)(3)(a) of Korea’s Personal Information Protection Act.

Company-provided AI: processing and international transfer

The company-AI supplement is published and takes effect at the same time, October 16, 2026 at 10:00 KST. Notice version: company-ai-settings-20261012, which the app presents once the AI settings described below open. Consent given under the earlier version company-ai-20261012 must be given again under this version. Before first use, the app presents recipient-specific details and the same version and obtains separate international-transfer consent. General terms, personal-data consent, transfer consent, guardian approval for use and payment approval are distinguished by purpose. We keep the notice version, decision and time as evidence and preserve the Korean and English notice text for each version without changing it. Changes to content already consented to require a new notice version and consent. Reading this notice or accepting general terms is not consent to these transfers.

Company-provided AI sends requested Digital Design Studio tasks through Altifigence servers using company API keys and displays the results in the app. Anthropic’s Claude API or the OpenAI API responds; failover may send the same request to both. Cloudflare Workers and AI Gateway relay requests and responses. Minors’ inputs and outputs undergo OpenAI safety checks regardless of the responding provider. At launch, for adults on individual accounts (self-service plans such as Free, Plus and Pro), only the user’s latest message in a provider-refused conversation is additionally sent to an OpenAI screening model to classify child sexual exploitation and violent wrongdoing signals. This external classification does not apply to business or academic organization accounts or Enterprise contracts; their arrangements are determined separately by contract. Other adult conversations receive no additional company screening, while provider signals are counted. Bring your own key (BYOK) follows separate settings and the customer’s provider contract. Company AI is closed to minors at launch; the minors’ checks above apply only after it is separately opened. Company-provided AI in the Customer Content and AI Notice.

Altifigence entrusts response generation and return to Anthropic PBC and OpenAI OpCo, LLC, and request/response relay to Cloudflare, Inc. OpenAI OpCo, LLC also performs minors’ input/output safety checks and classification of provider-refused conversations on individual accounts, including Free; that classification transfers the user’s latest message in the refused conversation to OpenAI. Business and academic organization accounts and Enterprise contracts are excluded from this external classification and require separate contractual arrangements. Processing follows the contracts actually applicable to the company. Providers’ own safety, policy-enforcement and legal purposes and retention exceptions are distinguished from processing solely on company instructions. International-transfer consent does not replace a separate lawful basis for collection, use or third-party disclosure. The applicable contracts are each provider's published terms that the company accepted on a self-service basis, including their data processing addenda (DPAs): Anthropic's Commercial Terms (effective June 17, 2025) and DPA (effective February 24, 2025), the OpenAI Services Agreement and DPA (effective January 1, 2026), and Cloudflare's self-serve terms with DPA version 6.4 (effective April 3, 2026). There are no separately negotiated amendments, ZDR agreements or Modified Abuse Monitoring approvals. Under each DPA, providers manage subprocessors through published lists and change notices, and the company may object to new subprocessors. Providers' own-purpose processing and retention exceptions are described in the recipient tables. Company AI is closed to minors at launch; the minors’ processing and records above apply only after it is separately opened.

Transfer details by recipient

These tables form part of notice version company-ai-settings-20261012. The common refusal/withdrawal procedure and effects above apply. The countries, subprocessors and retention conditions below reflect checks made on October 12, 2026.

Anthropic — response generation

OpenAI — response generation (Responses)

OpenAI — safety checks and refusal classification (Moderations)

Cloudflare — Workers / AI Gateway relay

Company records, retention and deletion

Minors (aged 14 to 18)

At launch, company AI is not open to Korean residents aged 14–18, and legal representatives cannot yet grant company-AI approval. This section describes the conditions that apply once it is separately opened.

Company AI is closed to minors at launch. The following conditions apply only after it is separately opened. In plain language: company AI sends your text and selected materials to companies abroad to make an answer. Anthropic or OpenAI answers and Cloudflare relays it; young users’ text and answers also go to OpenAI safety checks. Your consent and your legal representative’s approval are separate requirements. Refusing consent alone does not restrict your account or local work. You can request withdrawal at any time, and payments require separate approval.

Company AI for ages 14–18 is not open at launch. The following conditions apply only once it is separately opened. Adults must be at least 19 and legally adult at residence. Korean residents aged 14–18 must separately give required personal-data/international-transfer consents and obtain company-AI approval from a legal representative. Once opened, the child shares only a link; the guardian enters/verifies their own email and declares adult legal-representative status before approval. This differs from official identity/family verification. AI-use approval is not payment approval; transaction approval follows the guardian section. Minors elsewhere are unsupported until availability is revised; children under 14 cannot register or use company AI.

Company AI for ages 14–18 is not open at launch. The following conditions apply only once it is separately opened. Once opened, routine input/output safety checks apply to minor accounts. Adult refusal classification follows the separate plan and refusal conditions below. Regardless of the response provider, OpenAI omni-moderation-latest checks the latest user input and output portions before display. This does not mean every prior conversation, attachment or tool result is checked in full. Blocked input stops that generation; only checked output portions are displayed. On a check outage, we retry once and, if it fails again, withhold only that answer without displaying unchecked output. Outages do not count as violations and the failed turn is not charged. Already displayed portions cannot be recalled.

Company AI for ages 14–18 is not open at launch. The following conditions apply only once it is separately opened. Once opened, the blocking scope is sexual content involving children and self-harm instructions or intent. General references to self-harm or requests for help alone are not blocked; Korea’s 109 crisis guidance is shown, and other categories are not blocked or recorded. A blocked answer is replaced with safety guidance and the conversation can continue. These checks do not detect all harmful content or guarantee counseling, diagnosis or emergency rescue. Provider usage-policy obligations still apply. Guardian approval does not automatically share conversations/crisis information or grant unlimited access to the child’s chats.

Company AI for ages 14–18 is not open at launch. The following conditions apply only once it is separately opened. Once opened, detailed minors’ safety categories, scores and checked text are not stored in company databases or Worker logs. Minimum account-level records are counts/dates of violations for blocked user input involving sexual content about children; self-harm instructions/intent are counted separately as help-guidance events, not violations. AI output blocks, check outages and general help requests are not user violations. These records follow 90-day retention from the event. Linkage to operational account hashes makes them personal data, and their meaning may still allow sensitive inferences. Real-time checks and each retained record require their own lawful basis; sensitive-data requirements, including separate consent where applicable, must be met. Transfer consent or guardian approval does not replace them. Before company AI opens to minors, we will publish the lawful basis for these checks and records. Minors’ provider-refusal counts and dates are recorded separately from these safety-check violation/help-guidance records and adult signals. Each refusal is retained for 90 days from occurrence and deleted with that turn’s execution record, while refusal counts use the preceding 30-day rolling window. Minors’ detailed categories, scores and text are not stored.

Company AI for ages 14–18 is not open at launch. There is no automatic suspension. A block or check outage affects only that answer; accumulating violations does not automatically suspend an account. The owner acting as the privacy contact and staff granted the relevant management permissions personally review violation records and appeals to decide any necessary warning, suspension and duration. Warnings, suspensions and releases require management-write and administrator-management permissions. Only people on the allowlist may perform these operations. Warnings are delivered through app notifications and the user’s own email. At contact@altifigence.com you may request explanations of blocks/manual actions, correction of false positives and human review. The contact checks the minimum necessary facts, corrects records/restrictions and explains the outcome and reasons; applicable rights to refuse or obtain explanations of automated decisions remain. These reviews start only after company AI opens to minors.

Adult provider signals and access conditions

At launch, refusal and policy-violation signals from the responding provider are counted, including an initial refusal subsequently answered by a fallback model and Claude reasoning-extraction attempts. OpenAI misalignment signals are excluded from these counts. Only on individual accounts, including Free, is the user’s latest message in a provider-refused conversation sent to OpenAI omni-moderation-latest to classify child sexual exploitation and violent wrongdoing signals. Adult conversations without a provider refusal receive no additional company screening. Business and academic organization accounts and Enterprise contracts use provider signals without this external classification; separate arrangements are determined by contract. Provider refusals on minor accounts are also counted separately, without merging them into adult records or storing minors’ detailed categories. A provider signal or screening result alone does not establish unlawful conduct. Company AI is closed to minors at launch; the minors’ processing and records above apply only after it is separately opened.

Adult general signals are counted separately as cyber, advanced-AI misuse, reasoning-extraction attempts, general harms, violent wrongdoing and unclassified. A signal without a category remains unclassified. A provider’s biological (bio) signal is classed as very serious weapons of mass destruction. On individual accounts, a child-sexual-content result from classifying a refused conversation is counted as very serious child sexual exploitation, while violent wrongdoing (illicit/violent) is included in the general-signal total. Terrorism is not separately measured and is not displayed as zero. The access threshold for very serious signals is also one occurrence within the preceding 30 days. These are company review signals, not findings of unlawful conduct. Adult records retain only an account-linked identifier, counts, dates and the applicable category, without conversation text, raw refusal messages or screening scores. Minors’ detailed categories remain unrecorded.

Account-level signals are private by default; below a threshold even authorized reviewers see only overall totals. Only accounts with at least one very serious signal or at least five general signals in total within the preceding 30 days are visible at account level to the owner acting as the privacy contact and staff granted the relevant management permissions. Viewing requires management-read and administrator-management permissions; warnings, suspensions and releases require management-write and administrator-management permissions. Only people on the allowlist may perform these operations. Signals older than 30 days are excluded from counts and access thresholds even while retained until day 90. These authorized reviewers personally decide warnings, suspensions or releases for very serious adult violations, recording the actor, time and action in an audit record. These audit records are kept for 90 days after the action and cleaned up daily. Signals, classifications or thresholds do not trigger automatic action, and general-signal counts alone do not lead to sanctions. Explanations, false-positive corrections and review may be requested at contact@altifigence.com. Providers’ own refusals and outside authorities’ legal requests, reviewed and approved by the owner, are separate; staff’s adult-management permissions alone do not authorize external disclosure.

Legal requests from outside authorities and third-party disclosure

When an outside authority makes a legal request, the owner acting as the privacy contact reviews the requesting authority, its powers, applicable law, validity and scope. Only the minimum necessary records may then be disclosed on a lawful basis. Receipt of a request or owner approval alone does not create that basis; requests from foreign authorities also require a separate check of applicable international-transfer requirements. This procedure may cover records below the adult access threshold, but does not grant general access around that threshold. Disclosure is limited to records actually held, such as the minimum account identifier and relevant counts, dates and permitted categories; conversation content that is not retained is not newly collected or reconstructed. User notice, challenge and other rights are respected to the extent permitted by law.

Quarterly transparency reports

Under the launch policy, totals and evaluation metrics that cannot identify individuals are published each quarter at altifigence.com/transparency. Coverage includes minors’ checks, blocks, crisis guidance, outage holds and provider refusals; adult general subcategories and very serious categories; individual-account refusal classification; minors’ blocking and false-positive rates only after company AI opens to minors and only for quarters in which they are measured; legal requests and disclosures; policy history and methodology. Violent wrongdoing is included in the general-signal total. Terrorism is not separately measured and is marked “not measured separately.” The relevant external classification for business or academic organization accounts and Enterprise contracts, which do not receive it, is also marked “not measured”; unmeasured values are not zero or a passed check. Counts of 1–4 (small counts below five) are suppressed; related totals are also suppressed or combined where subtraction could reveal a hidden count. Account identifiers, account-level records and conversation content are not published. Totals that cannot identify individuals are kept permanently, and only human-reviewed quarters are published. Once the transparency guide is available and until a quarter is published, the page explains only what is counted, how it is counted and the suppression rules, without figures. The first report with figures is published after the fourth quarter of 2026 ends, following separate review and approval. At launch, company AI is closed to minors, so minors’ categories are marked not measured.

Provider retention and training policies (official documents checked 12 October 2026)

Anthropic: under its commercial terms Anthropic does not train models on customer content, and it states that retained data is never used for training without express permission. Commercial API inputs and outputs are deleted automatically within 30 days by default; certain highly capable models that Anthropic designates as Covered Models are retained for at least 30 days and then deleted automatically. For conversations its automated safety systems classify as violating its Usage Policy, inputs and outputs may be retained for up to 2 years and safety classification scores for up to 7 years, and longer where the law requires. Anthropic organization data retention policy.

OpenAI’s published API policy excludes training unless sharing is opted into. Responses abuse-monitoring retention is normally up to 30 days, with legal/harm-prevention exceptions. The published Moderations table lists no abuse-monitoring or application-state retention. Content also sent for generation follows that route’s rules. Disabling response storage is not ZDR approval. OpenAI data controls.

The production screens checked on October 12, 2026 show Anthropic data retention enabled for 30 days, no Development Partner Program participation and feedback off, and all three OpenAI data-sharing settings off. The company-AI workspace stores data in the United States and uses the Global inference region. The same-day check confirmed that logs, cache and logpush are off on both Gateways used by the company. Company requests disable OpenAI response storage and request Gateway log/cache exclusion. This is not a ZDR agreement or immediate deletion of every copy; Workers, security, email, D1 records and provider prompt caches are separate. Provider-specific retention and model, safety and legal exceptions follow the recipient tables below.

For transfers based on consent, changes to data, countries, timing, method, recipient names/contact details, purposes, retention or refusal methods/procedures/effects require the notice and consent required by law before changed transfers begin. A privacy-policy announcement does not replace new transfer consent or silently reuse prior consent. User consent does not waive provider safeguards or our oversight and privacy-rights obligations.

Official sources: Anthropic Commercial Terms · Anthropic DPA · Anthropic API data retention · Anthropic organization data retention · Anthropic Covered Models · Anthropic Privacy Policy · Anthropic subprocessors · OpenAI data controls · OpenAI enterprise privacy · OpenAI Services Agreement · OpenAI Privacy Policy · OpenAI sub-processors · Cloudflare DPA · Cloudflare Privacy Policy · Cloudflare AI Gateway logging · OpenAI DPA.

AI settings, web search and account conversation storage

The following settings apply to company AI and customer API-key connections (BYOK) when these features open in Digital Design Studio. A feature that has not opened does not start searches, save new settings or upload conversations. Availability depends on the selected provider, model, host, age, consent and organization policy; an unsupported option is unavailable rather than silently ignored. This notice does not announce that these features are already active.

Saved settings and instructions

To apply your choices across devices, Altifigence stores user defaults, your settings within an organization and your project overrides, including search/domain limits, model and reasoning preferences, response language/output limits, context choices and global/project instructions. The account service holds these settings separately from conversation history, with scope identifiers, versions and change times. Applicable instructions and context that you authorize are sent to the selected AI provider in the answer step; they can contain personal or confidential information. Do not put secrets in instructions. Turning conversation storage off does not remove saved instructions or stop their authorized use in later requests.

Organization administrators can restrict supported models, search, context, instruction transmission and spending, and shorten or disable account conversation retention; they cannot force retention on or override your off choice. Administration does not grant access to your personal instruction text. User and project settings cannot loosen age, consent, organization or provider restrictions. A saved tool-approval preference is not permission for arbitrary execution or external transmission: only the separately authorized scope and duration apply. Instructions and search results cannot override these limits.

Settings and instruction text are stored in our account database in Cloudflare’s Asia-Pacific region; instruction text is stored encrypted. They are kept until you change or reset them or the account is deleted, when they are deleted. Web-search consent records are kept while valid and for 90 days after they are withdrawn, replaced or the account is deleted, and never contain queries, instructions or API keys. Deleted rows can remain in database restore points for up to 30 days. We keep the minimum evidence needed for consent disputes and prevention of procedural abuse on the basis of our legitimate interests (Korean PIPA Article 15(1)(6)), with access limited to the privacy contact.

Optional web search and transfers

Web search is off by default on both company AI and BYOK. It is unavailable to minors aged 14–18 and people whose adult status is unconfirmed; an administrator cannot unlock it. Adults must also be adults under the law where they live. Existing eligibility and under-14 restrictions still apply. Supported search settings include domain allow/block lists, a per-user-message search limit and source display. These choices do not guarantee the accuracy or safety of websites.

Search requires a separate choice and consent covering the selected billing path, providers and search notice. Company-AI consent, an organization administrator’s permission or connecting your own API key does not turn search on. Refusing or withdrawing search consent stops new searches and search continuations while leaving eligible AI use without search available. It cannot recall data already sent. The search notice version is ai-web-search-20261012; a changed company-AI notice requires renewed company-AI consent, separately from search.

Before a search, review and confirm the public query separately. Altifigence sends that query through Cloudflare to the selected AI provider’s search service. Its search-only step receives the confirmed public query and fixed search instructions, without project text, earlier conversation or your saved instructions. The provider can form search terms from that query and retrieve public pages; we cannot inspect every provider-generated term in advance. Search terms, results and source URLs may contain personal data. Do not include private, confidential or export-controlled material in the public query. Search does not send a location setting. The answer step receives permitted context and search evidence without a web-search tool; turning search on is not permission to publish private context.

For Anthropic search, the October 12, 2026 subprocessor list includes Brave Search and TurboPuffer, both in the United States, for web search. They are included when Anthropic web search is enabled, including supported BYOK use. This is conditional search processing through Anthropic, not a claim that every conversation reaches both companies. Anthropic’s general API retention and exceptions remain separate from DDS account storage.

Anthropic’s search step sends search terms that Claude forms from your confirmed public query to the web-search sub-processors listed above and returns results and source URLs. This step follows the Anthropic API retention described in the company-provided AI section: inputs and outputs are normally deleted within 30 days, with usage-policy and legal exceptions. The company has no separate agreement with those search sub-processors.

OpenAI Responses web search can search, open pages and return citations and source URLs. Company requests keep response storage off (store:false). That setting and DDS history controls do not eliminate OpenAI abuse-monitoring retention, prompt-cache retention or applicable third-party processing. The company has no ZDR agreement. The official API pages checked October 12, 2026 do not establish a complete search-specific recipient/country/retention list for our selected route.

OpenAI’s search step runs inside the OpenAI API under the same Services Agreement and DPA. OpenAI’s data controls list the Responses API, which provides this web search tool, with abuse-monitoring logs normally kept for up to 30 days and no stored application state when storage is off (checked October 15, 2026). OpenAI’s sub-processor list (updated July 9, 2026) names no separate search provider, and OpenAI’s public documentation does not name the services it uses to retrieve web pages, so the company cannot see their retention.

Official search and retention sources: Anthropic subprocessors · Anthropic web search · Anthropic API data retention · OpenAI web search · OpenAI data controls.

Account conversation storage: default 30 days for adults

Once account conversation storage opens, new conversations for adults are stored on Altifigence’s servers for 30 days by default, on both company AI and BYOK. You can choose 7 days or turn it off in AI settings. For minors aged 14–18 and people whose age is unconfirmed, the default is off. Organization policy can shorten the period or turn storage off. Existing conversations on a device are not automatically uploaded or deleted. This storage choice is separate from enabling web search.

Account history contains the submitted conversation, permitted context included in it, answers and citations so that you can reopen them across devices. It is a separate account/organization-controlled, encrypted store, not the content-free operations/cost ledger. API keys, hidden reasoning, raw provider replay state and unrelated full project files are excluded from the history payload. Personal data or secrets you type in conversation text can still be retained as part of that text.

Turning storage off stops future saves; it does not delete existing account history. Delete existing account records separately in the history controls, or request assistance at contact@altifigence.com. Expired or deleted items become unavailable for account-history access. The implementation target is to remove the active stored body within 24 hours after expiry or deletion; this is not a promise of immediate physical deletion from backups, devices or providers.

The 7/30-day choice applies only to account conversation history. Device records, saved settings/instructions, provider retention, existing 90-day operations/safety records and their 30-day counting windows, legal-request records, transaction evidence and backups retain their separate rules. History deletion and consent withdrawal do not erase every one of those records or recall previously transferred data. OpenAI response-storage settings and the company’s Gateway logging/cache controls are not switched on by account-history storage.

Stored history is encrypted (AES-256-GCM) in Cloudflare R2 storage in Asia Pacific, and its list is kept in our account database in Asia Pacific. Each period counts from when the answer completes. A cleanup job that runs every minute removes expired or deleted history and retries failures. An R2 lifecycle rule deletes objects 31 days after upload as a safety net. Storage per account and organization is capped. Database restore points can keep list entries, but not conversation text, for up to 30 days. Account conversation storage supports reopening your conversations; consent evidence for dispute handling and prevention of procedural abuse is kept separately on the basis of our legitimate interests (Korean PIPA Article 15(1)(6)).

Search costs and spending limits

When web search is available and you enable it, company AI includes search-tool charges and token use in both the search and answer steps in shared weekly QUOTA, at the applicable AI serving-cost multiplier in the payment terms. A single message can require several provider requests. You can set a weekly Agent cap. Organization owners’ and admins’ caps apply to each member’s own use, with the lower of the personal and organization caps applying. The cap can restrict the existing allowance within the same 7-day window but does not add allowance; changing a plan or cap does not restart that window. BYOK search and both steps are charged under your provider contract and do not deduct company QUOTA. Exhaustion does not authorize an automatic purchase, purchased-Credit spend or switch to another billing path.

A BYOK daily cap estimates only the provider cost of requests you send through DDS in this organization, across all connections, resetting at 00:00 UTC. Organization BYOK caps also apply to each member’s own use, with the lower of the personal and organization caps applying. It is not a billing cap on the whole provider account and does not include requests outside DDS or guarantee the provider’s final invoice, discounts or exchange rate. Missing price/usage information can pause further requests when a cap is set. Source citations are provided for verification, not as an accuracy guarantee or a license to reuse third-party content; external sites have their own terms and privacy practices.

Private error reports

An error or a closed dialog does not send a report. After reviewing the complete report, you explicitly choose to send it. We associate it with your authenticated user and organization identifiers. Automatic report data contains only predefined error codes, components and stages, where it happened (desktop app or Cloud) and what happened (an unexpected stop or a failure to save), product/platform/version information, occurrence counts and times, project-protection state and a randomly generated report ID. Exception messages, source excerpts, file paths, stacks and recent-action text are not collected. An optional comment is written by you and sent exactly as you explicitly confirm it; do not include design code, NDA material, credentials or personal data. Code-like lines are highlighted for a choice to remove those lines, send unchanged or cancel; this does not guarantee detection or removal of code. Comments are disabled for protected or unconfirmed projects, which can send only predefined automatic data. We store the comment confirmation time and version with the report. Only Altifigence receives the report for private support and diagnosis; a public Community post is a separate action. Reports are stored in our Account database in Cloudflare’s Asia-Pacific region and deleted 30 days after receipt. You can delete a report now in the report controls; database restore points can retain deleted rows for up to 30 days. You can send up to 20 reports a day.

Personal project sharing

The owner of a personal project can create or revoke an invitation link, valid for 24 hours. Joining requires Altifigence sign-in and acceptance, with a viewer or editor role. The project owner and authorized member managers in the owner’s organization can see the participant’s name, profile photo, role and acceptance time and, when metering is enabled, usage. Participants see the project name and the owner’s name and profile photo. The owner also sees people who left (name, photo, role and date left) until their record is deleted. Participants can leave and the owner can remove them; access is checked again for revoked links and removed participants. A membership also ends when the deletion of the participant’s account or of the project is completed. When a project’s deletion is completed, its links that are still valid are also revoked, and its sharing settings, such as the per-participant limit, are deleted at once. Ended memberships and links are deleted after 30 days. Under-14 users and protected projects, including NDA-protected material, are excluded. When participant runs are separately enabled, participants with edit access can run supported Cloud engine jobs on the inviting owner organization’s weekly QUOTA under the payment terms. The owner sets a limit per participant over the last 7 days (1–168 core-hours); with several participants the total can reach that limit times the number of participants. Agent and general Cloud runtime are not available to participants.

Guardian information

Guardian approval is not offered at launch. Once it opens, the procedure is as follows: the child shares only an expiring, single-use link tied to their account. The guardian reviews collection/use information and required consent, enters their own email and then receives verification mail. We do not obtain the address from the child or send a request before the guardian enters it. The delivery processor is Cloudflare, Inc., which processes the address, message and delivery information. The form and mail explain source, purposes, data, retention and how to decline approval, request deletion, report mistakes or stop further requests. Guardian privacy choices, AI-use approval and transaction-specific payment approval are distinct; email serves verification, approval, withdrawal and change notices, not marketing. The privacy contact (contact@altifigence.com) handles mistaken/unwanted requests, deletion and stopping further requests. Use approval does not disclose the child’s conversations or crisis information.

The following retention standard applies once guardian approval opens. Raw email in our delivery queue is removed on successful delivery or seven-day request expiry. Delivery metadata after address removal follows a separate 30-day cleanup policy; unapproved requests expire seven days after request. Approval evidence includes email hash/masked value, relevant account, representative declaration, choices, notice version and times. AI-use approval lasts at most 365 days from request and ends at the first withdrawal, replacement, confirmed adulthood, closure, notice change or expiry; 90-day retired evidence follows the purposes, bases and access restrictions in the company table. Removing our queue entry does not immediately delete Cloudflare copies. Message previews are enabled for the company’s sending domain (account.altifigence.com), and Cloudflare keeps the content of mail sent from no-reply@account.altifigence.com for about 7 days while previews are on. Guardians can withdraw through approval instructions or contact@altifigence.com; users can withdraw in the app. Withdrawal stops new company-AI use and use of linked new payment approvals; pending orders/renewals and statutory transaction evidence follow the payment section below.

At launch, paid purchases by Korean residents aged 14–18 and guardian payment approval are not available. Once they open, guardian verification uses mailbox control and a self-declaration of being an adult legal representative. It is not official identity/family verification; additional evidence is checked only where there is doubt or a dispute. Paid purchases require separate representative approval for each transaction specifying product, total price, billing cycle and renewal terms, with separate consent for a trial’s paid conversion. AI-use approval lasting up to one year does not authorize all payments. Declining payment does not cancel free-AI approval. A minor or their legal representative may cancel a contract lacking required representative consent. New charges after withdrawal require valid transaction-specific approval; withdrawal alone is not treated as cancellation of an open checkout or scheduled renewal. Send withdrawal to the privacy contact and request order cancellation, renewal stops or refunds at billing@altifigence.com; statutory cancellation rights remain.

Children under 14

Registration requires age 14 or above, self-confirmed at signup and existing accounts’ next sign-in. This is not age verification using a birth date or identity document. An under-14 answer at signup is rejected without storing the signup information. If an existing user selects under 14, an “Are you under 14?” warning offers “Not under 14” to correct a mistake or a red “Delete under-14 account” choice; the account is not automatically deleted. An existing account that answers under 14 cannot add new personal information through avatar, email, region or marketing opt-in settings, or profile input, until the answer is corrected to 14 or older or the account is closed. Sign-in, reads, account closure and marketing opt-outs remain available. An account that answers under 14 cannot use company AI, web search or account conversation storage. When we confirm that a user is under 14, the privacy contact asks the user or legal representative to delete the account with “Delete under-14 account” or handles their deletion request, and information is then deleted as described under Account closure. The user or legal representative can request deletion, correction or access at contact@altifigence.com; the privacy contact personally handles it after minimum necessary verification and explains the outcome or restriction.

Plugin and external-tool data

Developer integration clarification updated: October 3, 2026

The data handled by an external tool or plugin depends on the actual integration and its permissions. Before choosing to use one, check the publisher's privacy notice, the files and credentials it can access, any external recipients, and the applicable storage and transfer conditions. Where an Altifigence integration handles personal information, this Privacy Notice and the applicable feature notice continue to apply; a third-party notice does not remove Altifigence's responsibilities for its own processing.

Reading documentation, viewing a catalog, or obtaining SDK/example source is not consent for a tool to read project files, execute programs, use credentials, or transmit data. Such access must have the required authorization for the actual feature and data. Public examples and issue reports should not contain credentials, personal information, confidential designs, or other restricted material. Plugin and external-tool availability and licenses.

Privacy requests and user rights

Privacy-related requests may be sent to contact@altifigence.com. Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. Identity verification may be required before action is taken, and legal, security, tax, accounting, contract, and IP evidence records may need to be retained.

You may separately request access, correction, deletion, restriction or withdrawal of consent while automatic account closure needs further review. An unresolved payment, refund, dispute or product connection is not a blanket refusal of these rights. Requests are checked individually under applicable law, and any limitation and its reason are explained through the privacy-request route: contact@altifigence.com.

Account closure and personal information

Request account closure in Altifigence Account. Successful closure ends account sign-in, revokes authentication sessions and withdraws the account's marketing-email choices. The personal profile and primary and additional account-email records held by the Account identity service, authentication credentials, linked social identities and OAuth grants are deleted as part of closure. A minimal closed-account identifier and closure-processing evidence remain to record that the identity is closed and prevent old sessions or credentials from restoring access; they are not an active personal profile.

Necessary transaction, refund, dispute, security and request-processing evidence is handled according to its specific purpose and applicable legal basis. Shared-organization invitation and membership history may remain, and earlier security and administration audit entries may contain account identifiers and relevant prior change details, including email copies. Closure does not authorize continued marketing. Information that must be preserved under another law is stored and managed separately from active-account information, with restricted access. Personal information is destroyed without delay when it is no longer needed and no applicable retention ground remains. This notice does not set one retention period for every record or promise immediate deletion from every protected backup or independent provider.

Account closure does not by itself cancel subscription renewal or delete an organization's or connected product's data. The Account page explains what needs separate handling before automatic processing. Account closure guidance.

Retention

Information is kept only as long as needed for its stated purpose and lawful basis, then deleted when the purpose or period ends. Account, transaction, dispute, company-AI consent, guardian and safety records have their own bases, starting points and periods. Adult company-AI safety signals and minors’ provider-refusal records are retained for 90 days from each occurrence and deleted with that turn’s execution record. Counts and account-level access thresholds use the preceding 30-day rolling window; the longer retention period does not extend that window. Minimum case-level records of outside authorities’ requests are deleted three years after handling ends. Only transparency totals that cannot identify individuals are kept permanently. The company-AI table distinguishes 90-day operational/minor records, separate legal holds, and transaction and backup retention. Backups do not permit indefinite retention of account-linked records. Separately, enabled account conversation storage saves new adult conversations for 30 days by default, with 7 days or off selectable and minors defaulting off; its content and deletion rules are in the account-history section.

Cloud time packs: if your organization buys Cloud time packs, we keep a time-pack ledger for each pack (Paddle transaction and price identifiers, pack size and quantity, whether it was bought at checkout or by auto top-up, purchase and expiry times, and hours granted, held and remaining) and record each grant, use, expiry, refund, dispute or other adjustment with its time. If a billing administrator turns on auto top-up, we also keep a record of each consent (the administrator’s account identifier, the time, the notice version and text shown, and the chosen pack, quantity and threshold) and of each automatic charge and its notice. We use these records to grant, use and expire hours, handle refunds and disputes, send charge notices and prove consent and charges. They are transaction records and follow the transaction-record retention rules: where Korean e-commerce law applies, payment and supply records are kept for five years and consumer-dispute records for three years.

Cloud active-time analytics

Cloud analytics addendum: 4 October 2026. Notice: cloud-privacy-20261004. Optional analytics stays off until you separately confirm adult eligibility and agree to analytics and international processing under this notice. Historical usage is not backfilled.

For overall Cloud product improvement, consenting adults' first-party account identifiers and completed one-minute active-time samples contribute to account-linked daily totals for Digital Design Studio, ALcad and shared Cloud screens. These are personal data, not anonymous statistics. Measurement requires a visible, focused page and recent trusted interaction, with a small batch at most every five minutes per open window. Authorized staff see only whole-product totals for completed UTC days, rounded down to 15 minutes; product/day values with fewer than five contributing accounts are hidden. Individual durations and last-active times are not provided. Estimates are not billing records or live presence.

Minors are excluded. Before choosing analytics, you must separately confirm that you are at least 19 years old and legally an adult where you live; we do not request or store a birth date or identity document for this self-declaration. It is not verified age. Windows and Linux local apps, Business accounts and members of Business or Enterprise-contract organizations are also excluded. This analytics contract does not record raw IP addresses, full URLs, project or file paths, source code, chat contents, or keystroke contents. Security and service/billing records are separate and are not converted into active-time analytics.

Account-linked daily contributions expire within 30 days and are excluded from reports after expiry; scheduled cleanup removes expired rows. A product watermark used only to prevent duplicate delivery expires after seven minutes and is removed by the next successful cleanup. Turning analytics off deletes your operational analytics contributions and blocks new collection. Your current choice is kept for the life of your account. A separate minimal consent receipt binds the adult self-declaration and separately confirmed analytics and international-transfer choices to the notice version, revision and time. A valid consent receipt is kept while that consent remains current; withdrawal, replacement or loss of eligibility retires it. Retired receipts, including withdrawal receipts, expire after 30 days and are deleted by the next successful scheduled cleanup even while collection is disabled. Earlier receipts cannot reactivate consent. New manual backups exclude analytics records, preferences and consent receipts. Deletion from D1 Time Travel recovery copies is not instantaneous: a deleted record may remain there for up to 30 additional days. Older backups and recovery copies must be restored with collection disabled, analytics data and preferences cleared, and fresh consent required before collection resumes. Unrelated security and billing records are not deleted by this control. The separate international-processing disclosure below applies to this feature.

Adult confirmation, optional analytics consent and international-transfer consent each start unchecked. Refusing or withdrawing does not affect product access, quota or pricing. An earlier notice cannot supply these new choices; ordinary software updates do not reset a valid current choice. Global Privacy Control and Do Not Track block collection in that browser. Manage your choice and delete your analytics contributions in Settings > Privacy: Cloud Privacy settings.

Altifigence operates optional analytics on specific, revocable consent. General terms, signup, login and opening the setting are not consent. Privacy requests are handled at contact@altifigence.com. You may request access, correction, deletion or cessation of processing. This feature is not used for advertising profiles, individual work evaluation or automated decisions with legal or similarly significant effects. The separate international-processing disclosure and choice are below.

Optional Cloud analytics: international processing

This disclosure covers only optional Cloud analytics, not every Altifigence service or every Cloudflare product. It identifies the current provider processing scope using our configuration and Cloudflare's public service documents, checked 4 October 2026. Consent is requested separately from analytics and general terms; this page does not grant it.

Cloudflare publishes its processor DPA, service-specific subprocessor list and transfer safeguards. We rely on the applicable provider contract and its safeguards, including the DPA's provisions for covered EU/UK/Swiss transfers, rather than treating your optional choice as a substitute for provider obligations. Cloudflare's Global PRP certification is supporting evidence, not a claim that Altifigence is certified or automatically exempt from Korean transfer-consent requirements. A material change to this feature's purpose, recipient or disclosed transfer scope requires a revised notice and fresh consent; older receipts are not silently reused.

Official sources: Cloudflare DPA · Cloudflare service subprocessors · Cloudflare global network · D1 data location · Global PRP.

Do not submit sensitive material

Do not send passwords, API keys, private keys, full card numbers, government identifiers, customer data, unreleased designs, or other secrets through public email or forms. Use a product workspace or a separately agreed secure channel only when its interface and terms permit that material.

Contact

Effective date of this version

This version (2026.11.5) takes effect on 2 November 2026.