Privacy Policy.
What we collect, why we collect it, and the control you have over it.
Last updated: 7 August 2026
1. Who we are
D8alytics ("D8alytics", "we", "us") is an early-access service operated from Texas, United States. We generate labeled computer-vision training data from a written description.
For the purposes of the UK and EU General Data Protection Regulation, we are the data controller for the personal data described in this policy. Where you upload or generate content through the service, we act as a data processor on your instructions.
2. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Email address, hashed password, sign-up date, last sign-in | You, when you register |
| Content you provide | Prompts, class names, class definitions and generation settings | You, when you create a dataset |
| Generated content | The images and label files produced for you | Created by the service on your instruction |
| Usage data | Jobs created, images generated, storage used, API requests, timestamps | Recorded automatically as you use the service |
| Billing data | Plan, subscription status, invoices, amounts | You and our payment provider |
| Technical data | IP address, browser type, error and performance logs | Recorded automatically for security and reliability |
| Support data | Messages you send us through the contact form or chat | You |
We do not collect card numbers. Payments are handled by a third-party payment provider; we receive only the plan, status and invoice record.
3. Why we use it, and our legal basis
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Creating and running your account | Performance of a contract |
| Generating and storing your datasets | Performance of a contract |
| Taking payment and issuing invoices | Performance of a contract; legal obligation |
| Enforcing usage limits and preventing abuse | Legitimate interests (protecting the service) |
| Security monitoring, error logging, fraud prevention | Legitimate interests (keeping the service safe) |
| Replying to your support messages | Legitimate interests (customer service) |
| Service emails, such as "your dataset is ready" | Performance of a contract |
| Marketing emails, if we ever send them | Consent, which you may withdraw at any time |
4. We do not train on your data
Our staff do not browse customer datasets. Access to production data is limited to named administrators, and only where it is necessary to investigate a fault you have reported or to comply with a legal obligation.
5. Who we share it with
We share personal data only with service providers who help us run D8alytics, and only to the extent they need it. Every provider operates under published data-processing terms that require them to protect the data and forbid them from using it for their own purposes.
- Cloud hosting and database — stores your account, jobs and metadata
- GPU compute and model hosting — runs generation and labeling
- Object storage — holds your generated datasets in private, per-customer storage
- Payment processing — handles subscriptions and invoices
- Email delivery — sends sign-in, reset and notification emails
- Error and performance monitoring — helps us find and fix faults
We will provide the current list of named sub-processors on request — write to us at the address in section 13. We may also disclose data where we are legally required to, or to protect our rights, safety, or the security of the service.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act.
6. International transfers
We are based in the United States and our service providers may process data in the United States and elsewhere. Where we transfer personal data out of the UK or European Economic Area, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, as applicable.
7. How long we keep it
| Data | Retention |
|---|---|
| Account data | While your account is open |
| Datasets and generated content | While your account is open, or until you delete them |
| Everything above, once you delete your account | Removed from live systems immediately; gone from backups within 30 days |
| Invoices and payment records | Up to 7 years, where tax and accounting law requires it |
| Security and error logs | Up to 12 months |
| Backups | Overwritten on a rolling cycle, no more than 35 days |
Deleting your account is immediate and cannot be undone — there is no recovery period, so export anything you want to keep first. Your datasets and models are erased from storage before the account itself is closed. The only remaining copies are in encrypted backups, which are overwritten as they rotate, within 30 days. During that time those backups are used for nothing except disaster recovery.
8. Your rights
Wherever you live, you may ask us to:
- Access the personal data we hold about you
- Correct anything that is wrong
- Delete your account and its data — you can do this yourself at any time from your dashboard, without asking us
- Export your datasets — you can do this yourself at any time from My Datasets
- Object to or restrict processing based on our legitimate interests
- Withdraw consent where we relied on it
If you are in the UK or EEA, these are your rights under Articles 15–22 of the GDPR, and you may also complain to your local supervisory authority — in the UK, the Information Commissioner's Office.
If you are in California, you have the right to know what we collect, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. We will not discriminate against you for exercising any of these rights.
We answer requests within 30 days and never charge for them. We may ask you to confirm your identity first, so that nobody else can make a request in your name.
9. Cookies
We use a small number of cookies and similar browser storage, and only for things the service cannot work without:
- Authentication — keeps you signed in between pages
- Preferences — remembers small choices, such as your selected code language on the API docs page
We do not use advertising cookies, and we do not run third-party trackers or analytics that follow you across other websites. Because all of our cookies are strictly necessary, no consent banner is required — but you can clear or block them in your browser at any time, though you will then need to sign in again.
10. Security
We describe our technical and organisational measures in detail on our Security page. In summary: data is encrypted in transit and at rest, each customer's content is isolated in private storage, API keys are stored only as irreversible hashes, and administrative access is limited and logged.
No service can promise perfect security. If a breach ever affects your personal data, we will notify you and the relevant regulator without undue delay, and within 72 hours where the GDPR requires it.
11. Children
D8alytics is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
12. Changes to this policy
We may update this policy as the service changes. The "last updated" date at the top always reflects the current version. If a change materially affects your rights — for example, if we ever proposed to use your content differently — we will email you before it takes effect and, where the law requires it, ask for your consent.
13. Contact us
For any privacy question, or to exercise any right above:
- Email: [email protected]
- Or use the contact form