DALFAST StudioOpen the Studio

DALFAST Studio › Legal documents › Privacy policy

Privacy policy

DALFAST Studio · DALFAST, s.r.o. · Last updated and effective: 13 November 2026

This notice explains how DALFAST uses personal data for its own purposes, and how it processes customers' content on their instructions. It covers account holders, visitors, collaborators, reviewers and people whose information is included in the Studio.

1 Controller and contact

DALFAST, s.r.o., Na pasekách 20, 831 06 Bratislava, Slovakia. IČO 52 237 826; DIČ 2121001949; VAT number SK2121001949. Email: support@dalfast.studio. Telephone: +421 940 376 654. Website: https://dalfast.studio.

For privacy requests write to support@dalfast.studio or to our postal address. We have not appointed a data protection officer.

DALFAST is the controller for running accounts, its own payments, security, support and its own measurement of the service. A customer normally decides the purposes for personal data in their designs, website forms and the collaboration they set up; for those operations DALFAST acts as processor or subprocessor under the Data processing agreement. Which role applies depends on the purpose, not on a label.

Contract: where processing is needed to provide what a person asked for or to take steps they requested before a contract. Legitimate interests: where we have weighed what is needed against the person's rights; you can object (section 13). Consent: for optional processing that needs it. Legal obligation: for records and disclosures the law requires.

Account and access: your name, email, a one-way hash of your password, the version of the Terms you accepted and when, your settings, plan and two-step sign-in settings. Purpose: registering you, signing you in and providing your plan. Basis: contract.

Orders and billing: order number, what you bought, amount, currency, payment status, the Stripe payment reference, the words you agreed to before paying and when, tax amounts, and any withdrawal notice or refund. Purpose: fulfilling purchases, refunds and withdrawals, and keeping the accounting records the law requires. Basis: contract and legal obligation. Stripe handles your card details; we never receive or store your card number.

Security and fair use: network (IP) addresses for limiting failed sign-ins and repeated requests, device type and a shortened network address for your list of signed-in devices, the number and kind of AI requests, and a log of important account actions. Purpose: protecting accounts, preventing fraud and applying the plan allowances. Basis: our legitimate interest in a secure and reliable service. We never use these records for advertising.

Support and applications: your messages, contact details, attachments and account or order references; for a free plan for a charity, school or place of worship, the organisation, website, country and your note. Purpose: answering you and assessing applications. Basis: contract where you ask about your account or an offer; otherwise our legitimate interest in answering correspondence and in establishing or defending claims. Please do not send us sensitive information we do not need.

Our own measurement: described in sections 9 and 10. Customer website content and visitor counts processed only on a customer's instructions are described in section 8 and the Data processing agreement; the customer decides its own legal basis and notices.

Safety checks: before a real person's photo is animated, or a presenter script is spoken, the photo or script is checked by OpenAI's moderation service. Purpose: preventing harmful or deceptive videos of real people. Basis: our legitimate interest and our legal obligations.

Legal requests: where we must answer a valid legal demand or keep records, the basis is the relevant legal obligation.

We do not use your data for marketing and do not send marketing emails. The emails we send are about your account, orders, withdrawals, security and things you asked for.

3 Your account data and your work

Passwords are stored only as secure one-way hashes. Your designs, uploads, comments and settings are stored in your browser; when you sign in, they are also stored on our servers for the features you use. Templates and kits you save are handled the same way. Sharing, publishing and links show content to the audience you choose; anyone with an unrestricted link may be able to see it.

Please avoid including personal data about other people that you do not need. If we process such content for you, you need the right to share it and must give the people concerned any notice the law requires. If you give us someone else's email to share or invite, we use it only for that sharing or invitation, never for unrelated marketing.

We process the email addresses of people you invite, reviewers' names, comments, decisions and the shared content. The project owner and the people they authorised can see the review information. We do not email invitations or review links ourselves: the person sharing passes the link on. Review links expire. For the projects and reviews a customer runs, we act as their processor.

While editing together, the Studio shares your name, the page you are on, what you have selected and where your pointer is. The pointer and presence information is deleted after one minute; live changes and chat messages are deleted after six hours. Changes you save stay in the project until deleted.

To make editing together smooth, browsers may connect directly to each other. To set this up, each browser contacts Cloudflare's STUN server (stun.cloudflare.com), which sees its network address, and the participants' browsers see each other's network addresses. Only pointer positions, the page and the position, size and rotation of items being dragged pass directly between browsers; changes themselves go through our server. No relay server is used. The messages that set up the connection are deleted as soon as they are delivered, and after two minutes at most.

5 AI features and their providers

When you use an AI feature, we send the prompt and the content needed for it (for example text, a photo or a selected area, audio, or the picture you choose to animate) to the provider of that feature, to return the result:

Google's Gemini picture engine is listed in the Studio's settings but is not switched on; it would receive your prompt if it were.

For the AI service you ask for as our customer, the basis for our necessary processing is contract. Where we act on a customer's instructions for content containing other people's personal data, the Data processing agreement applies and the customer needs a legal basis. Sensitive data may need an additional condition.

DALFAST does not train AI models and does not use your content to train any. Each provider's own use, retention and training terms are:

We do not send your content to Higgsfield: its standard terms allow it to use requests to train its models. It stays off unless it confirms in writing that it will not.

We count AI requests against your account to apply plan allowances; each record holds your account number, the kind of request and the time, and is deleted after 32 days. When you give Brand brain a web address, our own server reads that public page; no outside service is used for it.

6 Security and technical records

Records kept for security: failed sign-ins by network address, for 15 minutes; limits on review comments and other repeated requests by network address, for up to one hour; your signed-in devices (device type and a shortened network address), deleted 31 days after their last use; and a log of important account actions, kept for 12 months (your name and email are removed from it when you delete your account). Content reports to us keep a scrambled code made from the reporter's network address and the date, never the address itself. The hosting server also records each request (network address, time, page and browser) in access and error logs; they are archived each month and the previous month's archive is deleted, so they are kept for up to two months.

Connections are protected with HTTPS. Passwords are hashed. Two-step sign-in is available for every account, and you can see and sign out your other devices. Share and review links can be switched off or expire. Only the people named as DALFAST admins can use the admin tools. We hold no security certification.

We notify affected people and the supervisory authority of a personal data breach when the law requires it. When acting as processor, we notify the customer under the Data processing agreement so they can meet their own duties.

7 Other services and outside requests

Hosting: Namecheap, Inc. (servers, storage and our email; our server is in Phoenix, Arizona, United States). Payments: Stripe. Advertising measurement, only if you accept it: Google, Microsoft, Meta, TikTok, Pinterest and LinkedIn (section 10). AI: the providers in section 5. Editing together: Cloudflare (STUN, section 4). Addresses and places: the OpenStreetMap Foundation's Nominatim service, through our server (below).

Some features make your browser contact an outside server the first time you use them, which then receives your network address: cdnjs (Cloudflare), jsDelivr, Hugging Face and Google (storage.googleapis.com) for code and models of the on-device tools, Google Fonts for a font not stored with the Studio, and Pexels and Pixabay for the small previews of stock videos and photos (your searches themselves go through our server, which keeps search results for 24 hours). The voice typing button uses your browser's own speech service (for example Google's in Chrome).

Importing from Google Drive or Dropbox, when offered, uses their own sign-in windows. Google Drive is asked only for access to the files you pick (the "drive.file" permission); its access key is kept only in your open browser tab for up to 50 minutes and never stored. Dropbox uses its file chooser. Continue with Google, when it is offered: when a sign-in or sign-up window opens, Google's sign-in button loads from Google (accounts.google.com), which receives your network address and may use its own cookies under its own policy (https://policies.google.com/privacy). Only if you press it does Google tell us your name, your email address and that Google has confirmed it; we use them only to sign you in or create your account, and no Google password or access to your Google account reaches us.

If you use "Use my location" or "Find address", the place (rounded to about 11 metres) or the text you typed goes through our server to Nominatim (OpenStreetMap Foundation); your network address is not passed on. Results are kept in our cache for 30 days so repeated lookups are not sent again. A precise location can identify someone even without a network address, so use these features only where you need them.

Using DALFAST Studio from Claude, ChatGPT or another assistant app: only if you connect your account yourself (dalfast.studio/connect). The app then sends us only what you ask it to do, for example "find a flyer template" or "make an invitation for 6 December", and we send back the result. We keep which app is connected, when it last used your account, its sign-in records and the designs it made, the same as designs you make in the Studio. We do not receive your conversation, your chat history or files in that app. The app's own provider handles your conversation under its own privacy policy. You can end a connection at any time at dalfast.studio/connect/apps; the app then has no further access, and the designs it made stay yours.

People you share or publish to receive the content you choose. We may disclose necessary records to professional advisers, authorities or courts for lawful purposes. We do not sell personal data.

8 Published websites and customers' visitor counts

Forms on websites published with the Studio store what visitors submit, with a scrambled code made from their network address, on the site owner's instructions. Members-only websites also use a sign-in cookie on that website. The site owner must tell visitors who controls their data, why, on what basis, for how long and how to use their rights. DALFAST processes these data under the Data processing agreement.

For published websites, short links and QR codes, we count: the page, the referring site or campaign, the device type, the browser language, outbound clicks, and a daily code. The daily code is made from a random value that changes every day, the visitor's network address, browser details and the site, and the day's random value is deleted the next day; the network address itself is never stored. Visits by bots and by signed-in Studio users are not counted. These records are kept for 400 days, then deleted; the counts the site owner sees are worked out from them. Until they are deleted, the records may still count as personal data.

9 Visits to the Studio

To understand how the Studio is used, we count the page, the referring site or campaign, the device type, the browser language and a daily code made in the same way as in section 8. Nothing is stored on or read from your device for this. The records are kept for 400 days. Basis: our legitimate interest, which we have weighed against your privacy; you can object (section 13). If your browser sends Global Privacy Control, your visits are not counted.

When you create an account, the referring site or campaign of the visit in which you create it (for example the campaign name in a link you followed) is kept with your account, so that we can see which of our campaigns bring customers. It is only held while that visit's page is open (never stored on your device), kept for as long as the account exists, and never shared. Basis: our legitimate interest; you can object (section 13). It is not recorded if your browser sends Global Privacy Control.

10 First-visit measurement

First-visit measurement is optional and off unless you switch it on in Settings → Privacy & data → "Help improve the Studio". When on, it records how far a new user gets (opening, editing, then downloading, printing, sharing, publishing or saving a design), with the time taken, the number of clicks and the last screen, under a session code that changes after 30 minutes without activity; a note of the steps reached is kept in your browser. It records no name, email, network address or browser details; records are kept for 400 days. Basis: consent. You can switch it off at any time in the same place, which deletes the note in your browser. Global Privacy Control turns it off too.

Advertising measurement. While we advertise the Studio on other sites, a banner may ask whether the platforms we advertise with (Google Ads, Microsoft Advertising, Meta, TikTok, Pinterest, LinkedIn; the banner names those in use) may see which of our ads brought you here. Only if you accept, their tags load in your browser and tell them, once each, that an account was created or an order was paid (with its amount and currency, and an order number). The platform then receives your network address and browser details and its own cookie identifiers, and is responsible for them under its own privacy policy (Cookie policy, section 6). We switch off personalised advertising where the platform allows it and send no name or email. Basis: consent. You can withdraw it at any time in Settings → Privacy & data → Advertising cookies; Global Privacy Control means you are never asked and no tag loads.

11 Transfers outside the European Economic Area

Some recipients are outside the EEA: in the United States (our hosting provider Namecheap, whose server holds the Studio's data, and OpenAI, Anthropic, Cloudflare and Google) and in Malaysia, Indonesia and Singapore (BytePlus). Only if you accept advertising cookies (section 10), the advertising platforms we use also receive data in the United States (Google, Microsoft, Meta, Pinterest, LinkedIn) and, for TikTok, in the United States and Singapore. Where the law requires, we rely on an adequacy decision (including the EU-US Data Privacy Framework for a recipient currently certified under it) or on the European Commission's standard contractual clauses, with the necessary assessments and safeguards. The Data Privacy Framework does not cover Singapore. You can ask for information about these safeguards, or a copy of them, at support@dalfast.studio.

12 How long we keep data, and deletion

We keep account data and work stored on our servers while we provide the service. When you delete your account (your account → "Delete my account"), we delete at once from our servers: your projects and their history, uploads used by no one else, published websites and their form entries, short links and their counts, teams you own, your profile, reviews and family links, sessions, AI request records and your credit balance. Comments you wrote in other people's projects stay for them as "Former member"; their text may still contain personal data, and you can ask us to remove it. Reports you made stay without your name. Downloads of Store products end with the account.

Backup copies are made by our hosting provider: a weekly copy of the server, kept only for restoring it, and automatic copies of our account kept for up to five months (six daily, three weekly and five monthly). If a backup is ever restored, deletions made since are applied again.

Order, payment, refund and withdrawal records are kept for ten years from the end of the year they relate to, as Slovak accounting law requires; when you delete your account they are kept without the link to your account. Records needed for a legal claim are kept until the claim is settled or time-barred, with access restricted.

Other periods: emails we send are kept in our outbox for 90 days (their content is removed once sent); support emails are kept for two years after the last message; the evidence of the Terms you accepted and of what you agreed before paying is kept with your account and your orders. Provider retention is in section 5; security, editing-together and measurement records in sections 4, 6, 8, 9 and 10.

13 Your data protection rights

Depending on the processing and the legal conditions, you may ask for access, correction, deletion, restriction and a portable copy of data you gave us. You may object to processing based on legitimate interests, and always to direct marketing (we do not send any). Where processing is based on consent, you may withdraw it at any time; earlier processing stays lawful.

In your account: "Download my data" gives you a copy of your account data in a machine-readable file, "Delete my account" deletes your account, you can change your profile and password, and Settings → Privacy & data controls optional measurement. For anything else, including correcting your name or email, write to support@dalfast.studio. We reply without undue delay and normally within one month; where the law allows, for complex or many requests, we may take up to two more months and tell you why within the first month. We may ask for reasonable proof of identity. Some rights have legal exceptions; if we refuse, we explain why and how to complain.

If a customer is the controller (for example for a website form or a review they run), contact that customer using the notice on their site or review page; we help them and pass on requests we receive about their data. You can complain to the Slovak Office for Personal Data Protection, https://dataprotection.gov.sk/, or to another competent supervisory authority, including where you live or work.

14 What you must give us, and automated decisions

An account needs a name, email address, password and acceptance of the Terms. A paid order needs the payment details Stripe asks for and the billing details the law requires. Without them we cannot provide that feature; optional information is never needed for anything else.

We make no decisions with legal or similarly significant effects about you by automated means alone. Automatic security measures, such as a short lock after too many failed sign-ins, are temporary; AI providers may refuse a request under their own safety rules; you can always contact us for a person to look at it.

15 Age and optional family settings

We do not ask for or collect an age group at registration. Age groups supplied under the previous registration form remain in existing account records and data exports until those records are deleted; they no longer control access to features. A linked parent or guardian account is not a registration or feature-access requirement. Legal requirements concerning children's personal information still apply; this notice does not waive them. Contact support@dalfast.studio with questions or requests about a child's information.

Family linking is optional. For accounts that choose to link, the linked family member can set feature permissions, daily time limits and quiet hours, but cannot see designs. Linked accounts receive stricter AI safety settings and cannot use videos of real people or talking photos. Either account can unlink through Family & safety in Settings; the other account is notified. We keep the link and settings while the link exists.

16 Changes

We tell account holders in the Studio and, for important changes, by email at least thirty days before new processing begins. Where a new use needs consent or another legal step, changing this notice alone does not allow it. The date at the top shows the current version; earlier versions are available on request.

Terms of use · Refund and cancellation policy · Cookie policy · DALFAST Store licence · Data processing agreement · Legal notice