← All legal documents

Privacy Policy

Applies to Autonoma. Last updated August 2026.

Not reviewed by a lawyer. This document was drafted to describe what the software actually does, but it has not had legal review and is not legal advice. Do not rely on it for anything that matters to you without checking. The addresses named below are not yet receiving mail — see contact for what does work today.

Autonoma
Effective Date: August 2026
Last Updated: August 2026

1. INTRODUCTION

Autonoma (“Company,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our software, website (https://autonoma-studio.com), APIs, and related services (collectively, the “Service”).

This policy complies with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable data protection laws.

By using the Service, you consent to the data practices described in this policy.

2. INFORMATION WE COLLECT

2.1 Information You Provide

Account Information:

License Information:

Support Communications:

User Content:

2.2 Information Collected Automatically

Device Information:

The desktop application does not send us usage data. It makes two requests to us and no others:

This section previously said the licence check was “the only request it makes”. The update check has always been there and was simply not counted; a privacy policy that undercounts the requests a program makes is wrong in the direction that matters, however harmless the request.

2.3 Diagnostics That Stay On Your Own Machine

The desktop application writes activity and diagnostic files to your own computer so that you can see what it did and troubleshoot problems:

These are not transmitted to us. They are files on your disk, they stay there, and we have no way to read them. They reach us only if you choose to attach them to a support request.

2.4 Information from Third Parties

Payment Processor:

This list named Stripe and Gumroad as well. Neither processes any payment for Autonoma, so no billing event has ever reached us from either.

Earnings that Autonoma reads from YOUR Gumroad, Ko-fi, Payhip or Stripe account are a different thing entirely: those are your own accounts, connected with your own credentials, and that data is read on your machine.

AI Providers:

Marketplace Integrations:

3. HOW WE USE YOUR INFORMATION

We use collected information for:

3.1 Service Provision

3.2 Payment Processing

3.3 Service Improvement

3.4 Communications

For users in the European Economic Area (EEA), we process personal data under the following legal bases:

PurposeLegal Basis
Service provisionContract performance
Payment processingContract performance
License validationLegitimate interest
Security measuresLegitimate interest
Marketing communicationsConsent
Analytics (aggregated)Legitimate interest
Legal complianceLegal obligation

5. DATA SHARING AND DISCLOSURE

5.1 Third-Party Service Providers

We share data with service providers who assist in operating the Service:

Payment Processor:

Stripe, Inc. and Gumroad, Inc. were listed here. We share no data with either, because neither is involved in selling you a licence. A sub-processor list that names parties who process nothing is not a cautious over-disclosure — it is wrong in the direction that matters, because it is the list a reader uses to decide who holds their data.

Hosting:

Email delivery:

AI providers: none, on our side.

This section listed OpenAI, Google, Anthropic, Runway and Pika under the heading “AI Providers (when using AI features)”, which read as though we send your data to them. We do not call any AI provider on your behalf. You supply your own API keys, they are encrypted on your own machine, and every request goes from your computer directly to the provider you chose — so your prompts and the content you generate never reach us at all. That is a stronger privacy position than the old wording described, and describing it wrongly gave away something true.

The same applies to the platforms Autonoma publishes to and reads earnings from. Those are your accounts, connected with your credentials, on your machine.

Analytics: none. There is no analytics service on the website or in the application.

5.2 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.

We may disclose information if required by law, court order, or government request, or to:

We may share information for purposes you have consented to.

5.5 No Sale of Personal Data

We do NOT sell your personal data to third parties.

6. DATA RETENTION

We retain personal data for:

Data TypeRetention Period
Account informationDuration of account + 3 years
Transaction records7 years (legal requirement)
License recordsDuration of license + 3 years
Support communications3 years
Usage logs1 year
Error logs90 days

After retention periods expire, data is securely deleted or anonymized.

7. DATA SECURITY

We implement appropriate technical and organizational measures to protect your data:

7.1 Technical Measures

7.2 Organizational Measures

7.3 Limitations

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. YOUR RIGHTS

8.1 Rights Under GDPR (EEA Users)

You have the right to:

Access: Request a copy of your personal data.

Rectification: Request correction of inaccurate data.

Erasure: Request deletion of your data (“right to be forgotten”).

Restriction: Request limitation of processing.

Portability: Receive your data in a portable format.

Objection: Object to processing based on legitimate interests.

Withdraw Consent: Withdraw consent for processing based on consent.

Complaint: Lodge a complaint with a supervisory authority.

8.2 Rights Under CCPA (California Residents)

California residents have the right to:

Know: Request disclosure of data collected and its use.

Delete: Request deletion of personal information.

Opt-Out: Opt-out of the sale of personal information (we do not sell data).

Non-Discrimination: Not be discriminated against for exercising rights.

8.3 Exercising Your Rights

To exercise your rights, contact us at:

We will respond within 30 days (GDPR) or 45 days (CCPA).

8.4 Verification

We may require identity verification before processing requests.

9. INTERNATIONAL DATA TRANSFERS

9.1 Transfer Locations

Your data may be transferred to and processed in:

9.2 Safeguards

For transfers outside the EEA, we rely on:

10. CHILDREN’S PRIVACY

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we learn we have collected data from a child, we will delete it promptly. Contact us if you believe we have inadvertently collected data from a minor.

11. COOKIES AND TRACKING

Two cookies, both strictly necessary for signing in. There is no analytics cookie, because there is no analytics. The marketing site sets none of its own, and the desktop application sets none at all — it is not a browser.

CookiePurposeDuration
autonoma_sessionKeeps you signed in at app.autonoma-studio.com. HttpOnly and Secure.14 days
autonoma_signed_inThe single character 1, so the static marketing site can show “Your account” instead of “Sign in”. Not a credential; carries no identity.14 days

Through your browser settings. There is no consent banner, because both cookies are strictly necessary and that category does not require consent, and there are no analytics providers to opt out of.

11.4 What this section used to say

It listed preference and analytics cookies with one- and two-year durations, a consent banner, and opt-out links for analytics providers. None of those exist. The Cookie Policy — which had the same defect and was corrected first — sets out the full account, including the eleven cookies that were declared and the two that actually are set. This section is kept in agreement with it deliberately: two documents describing the same cookies differently is how one of them stays wrong.

See our Cookie Policy for the detail.

12. AI DATA PROCESSING

12.1 AI Feature Data

When using AI features, your prompts and inputs may be:

12.2 AI Content

AI-generated content is:

12.3 Opt-Out

You may choose not to use AI features. Core functionality remains available without AI.

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices. Review their policies before providing personal information.

14. DO NOT TRACK

The Service does not respond to “Do Not Track” browser signals. However, you can control tracking through:

15. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. Changes will be:

Continued use after changes constitutes acceptance.

16. DATA PROTECTION CONTACT

For GDPR-related inquiries, including subject access requests:

Email: support@autonoma-studio.com
Subject: “Data Protection Inquiry”
Mark for the attention of: the data protection contact

17. CONTACT US

For privacy questions or to exercise your rights:

Autonoma
Email: support@autonoma-studio.com
Website: https://autonoma-studio.com/legal/privacy-policy

This is the only address we operate. Mark privacy correspondence for the attention of the data protection contact so that it is routed correctly.

18. JURISDICTION-SPECIFIC PROVISIONS

18.1 European Union

If you are in the EU, this policy complies with GDPR. You have rights as described in Section 8.1.

18.2 California

If you are a California resident, this policy complies with CCPA. You have rights as described in Section 8.2. For CCPA-specific requests, contact support@autonoma-studio.com with the subject “CCPA Request”.

18.3 Other Jurisdictions

We comply with applicable privacy laws in jurisdictions where we operate. Contact us for jurisdiction-specific information.

By using Autonoma, you acknowledge that you have read and understood this Privacy Policy.

© 2026 Autonoma. All rights reserved.

Questions about this document? Get in touch.