Privacy policy

01Information we collect

Account data: your name, email address, and organization details when you sign up.

Billing data: plan, invoices, and payment status. Payments are handled by our Merchant of Record, Paddle.com; card details never touch our servers.

Usage data: API requests, job parameters (source URL, requested format and quality), job outcomes, timestamps, and the IP addresses that made the requests. We use this to operate the service, enforce quotas, and debug failures.

Processed media: the files produced by your jobs, stored for the retention window of your plan.

Website and support data: aggregate site analytics and the messages you send us when you contact support.

02How we use information

We use your data to provide and secure the service, run your processing jobs, process payments, enforce plan limits, prevent fraud and abuse, respond to support requests, comply with law, enforce our terms, and send service notices such as incident reports or changes to terms. We send marketing email only if you opt in, and every marketing message includes an unsubscribe link.

03Our role and legal bases

For the media you submit through the API, we act as a processor on your instructions: you decide what to process, and you are responsible for having the rights to it and for any privacy notices your own users need. For account, billing, and usage data, we act as a controller.

Where data protection law applies, we rely on performance of our contract with you, our legitimate interests in operating and securing the service, and compliance with legal obligations.

04How we share information

We do not sell personal information. We share data with a small set of vendors needed to run the service — cloud hosting, content delivery, payment processing (Paddle.com as Merchant of Record), email delivery, and analytics — under contractual safeguards. We disclose data to authorities only when legally required, and we will notify you of such requests unless prohibited from doing so.

05Retention and security

Processed files are deleted automatically at the end of your plan's retention window. Request logs are retained for up to 12 months for security and billing disputes. When you close your account, we delete your account data and remaining files within 30 days, except records we must keep for tax or legal reasons.

All traffic to the API and CDN is encrypted in transit with TLS. API keys are stored hashed, output URLs are signed, and access to production systems is restricted and logged. No system is completely secure, but we apply administrative and technical safeguards appropriate to the data we hold.

06International transfers

Where data is transferred across borders, we rely on adequacy decisions or approved contractual clauses to protect it.

07Your privacy rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on it. Contact us at hello@dalvo.cc to exercise these rights and we will respond within 30 days. You can also lodge a complaint with your local data protection authority.

08Cookies and children

The website uses essential cookies to keep you signed in, and privacy-respecting analytics to understand aggregate site usage; these do not follow you across other sites.

The service is not directed at children, and we do not knowingly collect personal data from them.

09Changes and contact

If we make material changes to this policy we will notify account holders by email before the changes take effect, and the 'last updated' date at the top always reflects the current version. Privacy questions and requests: hello@dalvo.cc.