Privacy Policy (GDPR / CCPA Aligned)

Last updated: September 9, 2026 · Controller: Alvin AI Lab · Contact: privacy@alvinailab.com

1. Data we collect

  • Account: username, email, password hash (Argon2id/PBKDF2 — we never store plaintext).
  • Service use: watch history, watchlist, subscription status/expiry.
  • Payments: gateway, amount, currency, plan, sender number + provider TrxID for manual verification; SSLCommerz validation IDs. Full card numbers never touch our servers.
  • Technical: IP, user-agent, rate-limit counters, error logs (security & abuse prevention).

2. Purposes & legal bases (GDPR Art. 6)

  • Contract: provide streaming, subscriptions, support.
  • Legitimate interests: security, fraud prevention, rate limiting.
  • Consent: cookies/marketing (see banner), trailers.
  • Legal obligation: tax/fraud records, DMCA handling.

3. Sharing

Processors: hosting provider, SMTP provider, TMDb (catalog metadata lookups — no user data sent beyond title queries by admins), SSLCommerz (payment processing). No sale of personal data (CCPA). No advertising trackers by default.

4. Retention

  • Account + history: until deletion. Payment ledger: retained up to 7 years for tax/fraud law, anonymised where possible.
  • Logs: 90 days rolling. Backups: 30 days.

5. Your rights

Access, rectify, delete (Profile → Danger Zone, or email privacy@alvinailab.com), restrict, portability, object. GDPR: lodge a complaint with your supervisory authority. CCPA: right to know/delete/non-discrimination; submit via privacy@alvinailab.com. We respond within 30 days.

6. Security

TLS in transit, hashed passwords, HttpOnly Secure SameSite cookies, rate limiting, server-side payment validation, least-privilege admin access. No method is 100% secure; report issues to security@alvinailab.com.

7. Children

Not directed to children under 13. Accounts found to be underage are removed.

8. International transfers

Servers may process data in the EU/US and other regions via processors with SCCs/DPF safeguards as applicable.

9. Cookies

Strictly necessary: session, CSRF, consent flag. No marketing cookies unless you opt in. Manage via the cookie banner (re-open from footer).