Privacy Policy
Applies to Autonoma. Last updated 2026-08-07.
Not reviewed by a lawyer. This document was drafted to describe what the software actually does, but it has not had legal review and is not legal advice. If anything here matters to you, ask us at support@autonoma-studio.com before relying on it.
Autonoma
Effective Date: January 2026
Last Updated: January 2026
1. INTRODUCTION
Autonoma (“Company,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our software, website (https://autonoma-studio.com), APIs, and related services (collectively, the “Service”).
This policy complies with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable data protection laws.
By using the Service, you consent to the data practices described in this policy.
2. INFORMATION WE COLLECT
2.1 Information You Provide
Account Information:
- Email address
- Name (optional)
- Password (hashed)
- Billing address
- Payment information (processed by third-party providers)
License Information:
- License key
- Machine identifier (hardware hash for license binding)
- Activation records
Support Communications:
- Support tickets
- Email correspondence
- Feedback submissions
User Content:
- Product listings you create
- AI prompts you submit
- Configuration settings
2.2 Information Collected Automatically
Usage Data:
- Features accessed
- Actions performed
- Error logs
- Performance metrics
Device Information:
- Operating system
- Hardware specifications (for license binding)
- IP address
- Browser type (for web dashboard)
Log Data:
- Access timestamps
- API calls
- Error reports
2.3 Information from Third Parties
Payment Processors:
- Transaction confirmations
- Subscription status
- Billing events (from Stripe, LemonSqueezy, Gumroad)
AI Providers:
- Usage metrics
- Rate limit information
Marketplace Integrations:
- OAuth tokens (encrypted)
- Account identifiers
3. HOW WE USE YOUR INFORMATION
We use collected information for:
3.1 Service Provision
- Account creation and management
- License activation and validation
- Feature delivery
- Customer support
3.2 Payment Processing
- Subscription billing
- Transaction processing
- Fraud prevention
3.3 Service Improvement
- Bug fixing and debugging
- Feature development
- Performance optimization
- Usage analytics (aggregated)
3.4 Communications
- Service announcements
- Security alerts
- Support responses
- Product updates (with consent)
3.5 Legal Compliance
- Responding to legal requests
- Enforcing our Terms of Service
- Protecting our rights and property
4. LEGAL BASIS FOR PROCESSING (GDPR)
For users in the European Economic Area (EEA), we process personal data under the following legal bases:
| Purpose | Legal Basis |
|---|---|
| Service provision | Contract performance |
| Payment processing | Contract performance |
| License validation | Legitimate interest |
| Security measures | Legitimate interest |
| Marketing communications | Consent |
| Analytics (aggregated) | Legitimate interest |
| Legal compliance | Legal obligation |
5. DATA SHARING AND DISCLOSURE
5.1 Third-Party Service Providers
We share data with service providers who assist in operating the Service:
Payment Processors:
- Stripe, Inc.
- LemonSqueezy (Lemon Squeezy, LLC)
- Gumroad, Inc.
Cloud Infrastructure:
- Server hosting providers
- Content delivery networks
AI Providers (when using AI features):
- OpenAI, LLC
- Google LLC
- Anthropic, PBC
- Runway AI, Inc.
- Pika Labs, Inc.
Analytics:
- Aggregated, anonymized usage data only
5.2 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.
5.3 Legal Requirements
We may disclose information if required by law, court order, or government request, or to:
- Protect our rights and property
- Prevent fraud or illegal activity
- Ensure user safety
5.4 With Your Consent
We may share information for purposes you have consented to.
5.5 No Sale of Personal Data
We do NOT sell your personal data to third parties.
6. DATA RETENTION
We retain personal data for:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 3 years |
| Transaction records | 7 years (legal requirement) |
| License records | Duration of license + 3 years |
| Support communications | 3 years |
| Usage logs | 1 year |
| Error logs | 90 days |
After retention periods expire, data is securely deleted or anonymized.
7. DATA SECURITY
We implement appropriate technical and organizational measures to protect your data:
7.1 Technical Measures
- Encryption in transit (TLS 1.2+)
- Encryption at rest (AES-256)
- Secure password hashing (bcrypt)
- API key encryption
- Secure license key storage
7.2 Organizational Measures
- Access controls
- Security training
- Incident response procedures
- Regular security assessments
7.3 Limitations
No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
8. YOUR RIGHTS
8.1 Rights Under GDPR (EEA Users)
You have the right to:
Access: Request a copy of your personal data.
Rectification: Request correction of inaccurate data.
Erasure: Request deletion of your data (“right to be forgotten”).
Restriction: Request limitation of processing.
Portability: Receive your data in a portable format.
Objection: Object to processing based on legitimate interests.
Withdraw Consent: Withdraw consent for processing based on consent.
Complaint: Lodge a complaint with a supervisory authority.
8.2 Rights Under CCPA (California Residents)
California residents have the right to:
Know: Request disclosure of data collected and its use.
Delete: Request deletion of personal information.
Opt-Out: Opt-out of the sale of personal information (we do not sell data).
Non-Discrimination: Not be discriminated against for exercising rights.
8.3 Exercising Your Rights
To exercise your rights, contact us at:
- Email: privacy@autonoma-studio.com
- Subject: “Privacy Rights Request”
We will respond within 30 days (GDPR) or 45 days (CCPA).
8.4 Verification
We may require identity verification before processing requests.
9. INTERNATIONAL DATA TRANSFERS
9.1 Transfer Locations
Your data may be transferred to and processed in:
- United States
- European Union
- Other countries where our service providers operate
9.2 Safeguards
For transfers outside the EEA, we rely on:
- Standard Contractual Clauses (SCCs)
- Adequacy decisions
- Binding Corporate Rules (where applicable)
10. CHILDREN’S PRIVACY
The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we learn we have collected data from a child, we will delete it promptly. Contact us if you believe we have inadvertently collected data from a minor.
11. COOKIES AND TRACKING
11.1 Cookie Usage
Our website uses cookies for:
- Essential functionality (session management)
- Preferences (language, theme)
- Analytics (aggregated usage)
11.2 Cookie Types
| Type | Purpose | Duration |
|---|---|---|
| Essential | Authentication, security | Session |
| Functional | User preferences | 1 year |
| Analytics | Usage statistics | 2 years |
11.3 Cookie Control
You can control cookies through:
- Browser settings
- Our cookie consent banner
- Opt-out links for analytics providers
See our Cookie Policy for detailed information.
12. AI DATA PROCESSING
12.1 AI Feature Data
When using AI features, your prompts and inputs may be:
- Sent to third-party AI providers (OpenAI, Google, etc.)
- Subject to those providers’ privacy policies
- Used by those providers per their terms
12.2 AI Content
AI-generated content is:
- Processed by third-party services
- Not stored by us beyond your account needs
- Your responsibility to review for compliance
12.3 Opt-Out
You may choose not to use AI features. Core functionality remains available without AI.
13. THIRD-PARTY LINKS
The Service may contain links to third-party websites or services. We are not responsible for their privacy practices. Review their policies before providing personal information.
14. DO NOT TRACK
The Service does not respond to “Do Not Track” browser signals. However, you can control tracking through:
- Cookie settings
- Browser privacy features
- Our privacy controls
15. CHANGES TO THIS POLICY
We may update this Privacy Policy periodically. Changes will be:
- Posted on our website
- Notified via email for material changes
- Effective upon posting (or as stated)
Continued use after changes constitutes acceptance.
16. DATA PROTECTION OFFICER
For GDPR-related inquiries, contact our Data Protection Officer:
Email: dpo@autonoma-studio.com
Subject: “DPO Inquiry”
17. CONTACT US
For privacy questions or to exercise your rights:
Autonoma
Email: privacy@autonoma-studio.com
Website: https://autonoma-studio.com/privacy
Support: support@autonoma-studio.com
For EU Representatives:
Email: eu-representative@autonoma-studio.com
18. JURISDICTION-SPECIFIC PROVISIONS
18.1 European Union
If you are in the EU, this policy complies with GDPR. You have rights as described in Section 8.1.
18.2 California
If you are a California resident, this policy complies with CCPA. You have rights as described in Section 8.2. For CCPA-specific requests, contact: ccpa@autonoma-studio.com
18.3 Other Jurisdictions
We comply with applicable privacy laws in jurisdictions where we operate. Contact us for jurisdiction-specific information.
By using Autonoma, you acknowledge that you have read and understood this Privacy Policy.
© 2026 Autonoma. All rights reserved.
Questions about this document? Get in touch.