Privacy Policy
Last updated: 21 August 2026
This Privacy Policy explains how ArchAdemia Tools (archademia.tools), operated by Archademia Ltd, collects, uses, and protects your personal data. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data Controller
The data controller is Archademia Ltd, registered in England and Wales. Company number: 13602105. Registered address: Independence House, 6 Tapton Way, Liverpool, Merseyside, L13 1DA.
We have not appointed a Data Protection Officer as we do not meet the threshold requiring one under UK GDPR Article 37. For all data protection queries, contact: hello@archademia.com
2. What We Collect
Data you provide directly
| Data | When | Purpose |
|---|---|---|
| Email address | Account creation, waitlist signup | Account management, communications |
| Name (optional) | Account profile | Personalisation |
| Payment information | Subscription/purchase | Payment processing (handled by Stripe; we never see your full card number) |
| Images, audio, video, and 3D files you upload | Using the platform | Processing your generation requests |
| Prompts and settings | Using the platform | Processing your generation requests |
Data collected automatically
| Data | How | Purpose |
|---|---|---|
| IP address | Server logs | Security, abuse prevention, approximate location for compliance |
| Browser and device info | Standard web headers | Platform compatibility, debugging |
| Usage data | First-party analytics (no third parties) | Pages visited, referrer, approximate country, device/browser/OS, and ad campaign parameters if you clicked through from an ad. Runs in one of two modes depending on your cookie choice (see Cookie Policy below). Stored for 90 days then automatically deleted. Opt out entirely via Do Not Track or Global Privacy Control. |
| Device registration | Signing in on a browser or app | An ArchAdemia Tools account covers a set number of devices at a time. To count them we store a random identifier generated by that browser or app, a plain description taken from your browser (for example “Chrome on Windows”), the dates it was first and last used, and a coarse region such as the country you signed in from. Your IP address is stored only as a one-way hash, never in a form we can read back. You can see this list, and deactivate any device on it, on your account page. |
| Cookies | See Section 7 | Authentication, preferences, analytics |
Data we do NOT collect
- We do not collect biometric data
- We do not collect data from social media profiles unless you explicitly connect them
- We do not purchase data from third-party brokers
- We do not use your uploads, prompts, or generated outputs to train AI models (see Section 5)
3. Legal Basis for Processing
| Purpose | Legal Basis (UK GDPR) |
|---|---|
| Providing the service (account, generations) | Performance of a contract (Art. 6(1)(b)) |
| Processing payments | Performance of a contract (Art. 6(1)(b)) |
| Sending service-related emails (receipts, account changes) | Performance of a contract (Art. 6(1)(b)) |
| Platform analytics and improvement | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails (product updates, blog posts) | Consent (Art. 6(1)(a)); you can unsubscribe at any time |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
4. How We Use Your Data
4.1 To operate the platform: creating your account, processing your generations, managing your subscription and credits.
4.2 To process payments via Stripe. We pass your email and subscription details to Stripe for payment processing. We never store your full card details.
4.2a If you connect a Stripe account to sell from a published site. Selling through a site you publish is optional and off unless you set it up. If you do, you connect your own Stripe account through Stripe's own hosted onboarding, and we never see or store your Stripe login. When you provide personal data in connection with connecting that account, Stripe receives that personal data and processes it in accordance with the Stripe Privacy Policy. We store your Stripe account identifier and the order records for sales made through your site (including the buyer's email and what they bought) so we can show you an orders inbox and keep your stock counts right. We never receive your customers' card details, and we never hold their money.
4.3 To send you essential service emails: receipts, subscription confirmations, credit alerts, security notices. You cannot opt out of these as they are necessary for the service.
4.4 To send you marketing communications: product updates, new features, blog posts. Only with your consent. You can unsubscribe at any time via the link in every email.
4.5 To improve the platform. We analyse aggregated, anonymised usage patterns (which models are popular, average generation times, error rates) to improve the service. This analysis uses only aggregate statistics. Your individual prompts, uploads, and outputs are not used for this purpose.
4.6 To prevent abuse. We monitor for violations of our Acceptable Use policy and may review flagged content.
5. Your Uploads and Generated Content
5.1 Images, audio, video, and other files you upload, and prompts you submit, are processed solely to fulfil your generation requests. They are transmitted to the relevant third-party AI model provider for processing and then returned to us.
5.2 We do not use your uploads, prompts, or generated outputs to train AI models. This applies to everything you create on ArchAdemia Tools, without exception and regardless of your plan. We do not train models of our own, and we do not supply your work to anyone else for that purpose.
5.3 Generation runs on third-party model providers. We do not operate the AI models ourselves. To produce an output, your inputs are passed to the relevant provider, processed on their infrastructure, and returned to us. Each provider operates under its own terms, which govern what it may do with content passing through it. Those terms are the provider's and not ours, and we cannot vary them on your behalf. Our access is governed by B2B agreements between Archademia Ltd and each provider; under some of those agreements a provider may retain or use inputs and outputs for its own purposes, including model training and improvement. That is a separate question from our own commitment in 5.2, which is unaffected.
Provider terms at a glance
- fal.ai retains generated media on their CDN for a limited period (typically 7 days) before deletion.
- EvoLink (the gateway that routes Seedance requests onward to ByteDance) does not publish specific input-retention or model-training terms; the Seedance models themselves are operated by ByteDance (see Section 12).
- Runway reserves the right to use inputs and outputs for model training on non-Enterprise API plans.
- Kling (Kuaishou) retains a permanent, royalty-free licence to use content for AI training and promotional purposes.
- ElevenLabs retains a perpetual licence to create derivatives from voice data for model improvement.
These summaries are a guide, not the providers' terms, which may change at any time. Current terms and privacy policies for every provider are linked at archademia.tools/providers.
5.4 Generated outputs (images, videos, audio, 3D models) are stored on our own infrastructure (Supabase storage). When a provider returns a generated file, we download it to our storage. The provider's temporary copy typically expires within hours to days depending on the provider.
5.5 You can delete generated content at any time from your dashboard. When you delete content, it is removed from our storage within 30 days to allow for backup cycle completion. Orphaned temporary files are automatically cleaned up by a scheduled maintenance process. If your account is on the free trial and does not upgrade before the trial ends, your generated outputs are automatically deleted from our storage 30 days after the trial ends (see the retention table in Section 9); your account and generation history are not affected.
5.6 Generated output URLs. Your generated files are stored in our storage using unique, non-guessable file paths. Files are accessible via direct URL without additional authentication, which enables features such as sharing and embedding. However, file paths cannot be listed or enumerated by other users. Access requires knowing the exact URL.
5.6A Export metadata. Files you export from ArchAdemia Tools, including PDF drawings and sheets, DXF files, Layout documents, Corb handouts, and documents you export from Research, Writing and Canvas, carry your account identifier in their file metadata. It is the opaque identifier your account is known by in our database, and it is the only thing we add: never your name, never your email address, never your IP address, and never your location. It is metadata, not a watermark. It is invisible on the drawing, it does not print, and it has no effect on the drawing itself or on the scale it plots at. We include it so that a leaked or redistributed file can be traced back to the account it came from. In a PDF you can see it, and remove it, under the document properties in any PDF editor. In a DXF it is written as a comment at the very top of the file, which you can read or delete in a text editor.
6. Data Sharing
We share your data only with:
| Recipient | What | Why |
|---|---|---|
| Stripe | Email, subscription data | Payment processing |
| Supabase | Account data, generation records, and, for a Linea drawing attached as a reference, the original CAD file it was built from, kept for as long as the reference exists and removable by the member at any time | Database, authentication and storage hosting |
| Vercel | IP address, request data | Website hosting and CDN |
| AI Model Providers | Prompts, uploaded files, generation parameters; outputs are generated and initially stored on provider infrastructure before being transferred to our storage | Processing your generation requests |
| ArchAdemia's own render servers (DigitalOcean, London, UK) | Video, PDF, screenshot, and CAD (DWG and DXF) files, processed transiently and deleted immediately afterwards, except that a DWG or DXF attached as a Linea reference has a copy kept separately (see the Supabase row above) | Video export, PDF export, and CAD conversion: DWG-to-DXF for import and DXF-to-DWG for export, processed transiently |
| Brevo | Email address, name | Transactional and marketing email delivery |
We do not sell your personal data to anyone. We do not share your data with advertisers. We do not share your data with data brokers. We do not send analytics data to any third-party analytics provider. All analytics are first-party (see Section 7 and the Cookie Policy).
7. Cookies
Essential cookies: Required for the platform to function, including authentication and session management. These cannot be disabled.
Analytics cookies: Help us understand how the platform is used. You can opt out of these via the cookie banner on first visit.
We do not use advertising or tracking cookies.
8. Your Rights (UK GDPR)
You have the following rights regarding your personal data:
Right of access: Request a copy of all personal data we hold about you.
Right to rectification: Request correction of inaccurate data.
Right to erasure: Request deletion of your personal data ("right to be forgotten"). Note: we may retain certain data where required by law (e.g., financial records for HMRC).
Right to restrict processing: Request that we limit how we use your data.
Right to data portability: Request your data in a structured, machine-readable format.
Right to object: Object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.
To exercise any of these rights, email hello@archademia.com. We will respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
9. Data Retention
| Data | Retention Period |
|---|---|
| Account data | Until you delete your account + 30 days |
| Generated outputs — paid plans | Until you delete them + 30 days |
| Generated outputs — free trial, not upgraded | 30 days after the trial ends, then deleted automatically |
| Generation metadata (prompt, model, parameters, status) | Until you delete your account + 30 days |
| Payment records | 7 years (HMRC requirement) |
| Server logs (IP, requests) | 90 days |
| Waitlist emails | Until you unsubscribe or the waitlist closes |
| Seedance generation logs | Minimum 12 months (see Section 12) |
When you delete your account, we delete or anonymise your personal data within 30 days, except where we are legally required to retain it. Account deletion removes all your stored files from our infrastructure and deletes any third-party resources created on your behalf (such as cloned voices held by external providers).
10. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption in transit (TLS/HTTPS on all connections, including internal services)
- Encryption at rest (via Supabase and Stripe's infrastructure)
- Row Level Security on database tables (Supabase RLS) enforcing per-user data isolation
- Secure authentication via Supabase Auth
- No storage of card details (handled entirely by Stripe, PCI DSS compliant)
- User ID derived from authenticated sessions only; never accepted from client requests
- Scrubbed server-side logging: personal data such as email addresses and prompt content is excluded from application logs
- Regular security reviews of dependencies and access controls
11. International Transfers
Your data may be transferred to and processed in countries outside the UK, specifically:
United States: Supabase, Vercel, Stripe, fal.ai, Runway, Runware, Google, Anthropic, OpenAI, ElevenLabs, Tripo3D, World Labs, and Perplexity all operate infrastructure in the US. US transfers are protected by Standard Contractual Clauses (SCCs) and/or UK International Data Transfer Agreements (UK IDTAs), as adopted by these providers.
Hong Kong: EvoLink (EVO GLOBAL TECHNOLOGIES LIMITED), the gateway that routes Seedance generation requests, is based in Hong Kong and its terms are governed by the laws of Hong Kong. When you use Seedance, your prompt, reference files (which may include images of real faces), generation parameters, and a unique user identifier pass through EvoLink's infrastructure on the way to ByteDance. See Section 12 for full details of the Seedance data flow.
China: ByteDance operates the Seedance video generation models, and Kuaishou operates the Kling video generation model. When you use Seedance specifically, your prompts, reference files, and a unique user identifier are processed on ByteDance's infrastructure, reached via EvoLink (Hong Kong). In respect of Kling, generation requests are routed via fal.ai's infrastructure; we have confirmed with fal.ai that Kling inference runs on fal.ai's own GPU infrastructure and does not route directly to Kuaishou's servers in China. If this changes, we will update this policy accordingly.
- The transfer for Seedance is conducted via EvoLink (Hong Kong) as an intermediary processor and onward to ByteDance (China). Neither Hong Kong nor mainland China benefits from a UK adequacy decision, so this transfer relies on the derogation for the performance of a contract with you (UK GDPR Art. 49(1)(b)). You can avoid this transfer entirely by choosing not to use any Seedance model.
12. Seedance: Data Processing
In plain English: When you use Seedance, your prompts and uploads are sent through EvoLink (a Hong Kong company) to ByteDance's infrastructure in China. A unique identifier tied to your ArchAdemia Tools account is included with every request, and we keep logs of your Seedance generations. “Seedance” here means the ByteDance Seedance models that are routed through EvoLink: Seedance 2.0, Seedance 2.0 Fast, Seedance 2.0 Mini and Seedance 2.5. Other models on ArchAdemia Tools do not involve EvoLink or ByteDance.
12.1 Data Transmitted. When you use Seedance, the following data is sent to EvoLink and ByteDance for processing:
- Your text prompt
- Any reference files (images, audio, video clips) you include
- Any video you supply for editing or extension (Seedance 2.5 video-edit and video-extend)
- A unique end user identifier linked to your ArchAdemia Tools account
- Generation parameters (resolution, duration, aspect ratio, audio settings)
12.2 Data We Log. In addition to the data transmitted, ArchAdemia Tools logs: timestamps, generation status, error categories, and the EvoLink task ID for each Seedance generation.
12.3 Processing Chain.
- ArchAdemia Tools (United Kingdom): data controller
- EvoLink, operated by EVO GLOBAL TECHNOLOGIES LIMITED (Hong Kong): data processor, routing generation requests
- ByteDance (China): sub-processor, running the Seedance models
This chain is specific to Seedance. Other models on ArchAdemia Tools involve different processors (see Section 6).
12.4 Purpose. Prompts, references, and parameters are processed solely to generate the video content you requested. The end user identifier is required by our distribution agreement for user identification and compliance. Generation logs are maintained to comply with identification and restriction requests if required by ByteDance or EvoLink.
12.5 Retention. Generated video URLs expire within 24 hours on EvoLink's infrastructure. Seedance generation logs are retained by ArchAdemia Tools for a minimum of 12 months.
12.6 Your Choice. You are not required to use Seedance. All other video, image, 3D, audio, and writing models on ArchAdemia Tools remain available without the data processing described in this section. If you do not wish your data to be processed by ByteDance, simply choose a different video model.
13. Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of our assets, your personal data may be transferred to the successor entity. We will notify you of any such transfer via email before your data is transferred or becomes subject to a different privacy policy.
14. Children
ArchAdemia Tools is not intended for anyone under 18 years of age. We do not knowingly collect personal data from children. If we become aware that a user is under 18, we will delete their account and associated data.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the platform. The "Last Updated" date at the top will always reflect the most recent version.
As AI-specific regulations develop in the UK and internationally, we will update this policy to reflect any new requirements.
16. Contact
For privacy-related questions or to exercise your data rights:
Email: hello@archademia.com
Data Controller: Archademia Ltd
Cookie Policy
Essential cookies keep you logged in and the platform working. These are required.
Analytics. We run first-party analytics only. No Google Analytics, no Meta Pixel, no third-party marketing trackers. Analytics runs in one of two modes depending on your cookie choice:
1. Accepted mode. If you accept cookies (or you are signed in, which counts as accepting), we store a random anonymous ID in your browser's localStorage so we can group your page views into sessions and recognise you across visits. This ID is not linked to your name, email, or any other personal data. You can clear it at any time by clearing your browser storage.
2. Cookieless mode. If you reject cookies, we still count your visit, but we store nothing on your device. Instead, we derive a temporary ID on our server by hashing your truncated IP address together with your user-agent string and a daily rotating salt. That ID only works for one day; by the next day, the salt has rotated and your previous visits cannot be linked to the new ones. This mode is PECR-exempt because nothing is stored on your device, and it relies on UK GDPR Article 6(1)(f) legitimate interest as the lawful basis. It is the same technique used by privacy-respecting analytics providers like Plausible and Fathom.
Opting out entirely. If you enable Do Not Track or Global Privacy Control in your browser, we honour both signals and do not track your visit at all, not even in cookieless mode.
Analytics data is automatically deleted after 90 days. We do not sell or share analytics data with third parties.
Data controller: Archademia Ltd. For questions, contact hello@archademia.com.