Privacy Policy

Last updated: 30 September 2026

Aaavatar is a Mac app for consistent team profile photos, published by Square One in the Netherlands. This policy explains which personal data we process when you use the app, your Aaavatar account, and this website, why we do it, and what your rights are. Square One is the controller for this data. Questions? Email info@squareone.nl.

1. The short version

  • Your photo library is stored on your Mac. Background removal runs on your Mac and never costs a credit.

  • An account is optional. If you create one, we store your email address and what you bought.

  • Cloud edits are optional and only work when you choose Local and Cloud in Settings. The photo is then sent to our servers and our AI provider to create the result, and deleted afterwards.

  • The app sends usage statistics to help us improve it. You can switch this off in Settings.

  • We never sell your data and we do not show ads.

2. On your Mac

Your portraits, originals, cutouts, backgrounds, folders, names and roles are stored in the app’s own storage on your Mac. We do not receive a copy. Deleting the app and its data removes them.

Background removal uses Apple’s Vision framework or a higher-quality model that the app downloads once from GitHub. GitHub sees your IP address when the model is downloaded. If you import your library from Aaavatar 1, that happens on your Mac as well.

The Apple Intelligence tile opens Apple’s Image Playground. Apple handles that under its own terms; nothing is sent to us.

3. Your account

You can use Aaavatar without an account. For Pro, credits and cloud edits you need one: you sign in with your email address and a one-time code, or we create the account from the email address you use at checkout. We then store:

  • your email address and account ID, when you signed up and last signed in, and the technical session data our account provider keeps;

  • your plan, subscription status and credit balance, and the edits you paid credits for;

  • a random device ID, which we use to count the free imports and to link a purchase made without an account to your Mac. With Local only, a new device ID is made each time the app starts.

The sign-in code is emailed through our email provider. Your session is stored encrypted on your Mac. We need this data to provide the account and your purchases (performance of a contract). It is kept until you delete your account.

4. Cloud edits

Effects (including your own custom effects), Colorise, Fill in body and online Boost resolution run in the cloud. They are available when you choose Local and Cloud in Settings and they use credits. When you start one:

  • the app uploads that single photo over an encrypted connection to our storage in the EU;

  • our server reads it, deletes the upload, and sends the image to our AI provider Replicate (United States) to run the model. Some models are provided by their developers, such as OpenAI, Black Forest Labs and Topaz Labs, and may be processed on their systems;

  • the result is sent back to the app. Larger results wait in temporary storage and are deleted within 24 hours at the latest.

When you create a custom effect (Pro), we upload its reference image and store it with the description you give it until you delete the effect. We do not use your photos to train AI models. We process your photo because you ask us to create the edit (performance of a contract).

5. Payments and credits

Payments are handled by Stripe. Stripe receives your payment details, email address and billing address; we never see your card details. We store your Stripe customer ID, your subscription status and a record of your credits. Invoices and payment records are kept for seven years, as Dutch tax law requires.

6. Usage statistics

To see which features work and where the app fails, the app sends a small set of events to PostHog (United States): the app opened, portraits imported or exported (a count), a cloud edit started and whether it worked, an upgrade started or completed, and error codes from a fixed list. PostHog also receives the app version, Mac model, macOS version, language, time zone and screen size, and may log your IP address. Events never contain photos, names or text you type.

If you are signed in, the events are linked to your account ID. If not, they use a random ID. The statistics are on by default and you can switch them off at any time in Settings › AI & Models › Share anonymous diagnostics; queued events are then deleted. We process these statistics based on our legitimate interest in improving the app.

7. Feedback and support

When you send feedback from the app, we receive your message, the category, your email address, the app and macOS version, your plan, your account ID and, if you leave it switched on, a diagnostics log. We remove personal details from the log before it leaves your Mac. We receive feedback by email and store it in Notion (United States) so we can follow up.

8. Emails

We send the sign-in codes you request and emails about your purchases. Account holders also receive product news and tips, such as what is new in Aaavatar. Every one of those emails has an unsubscribe link, and you can unsubscribe with one click. We keep your unsubscribe so we don’t email you again. Emails are sent through Resend.

9. Other services the app uses

  • Messages in the app: if you are signed in, we store which messages you have seen or dismissed.

  • Unsplash backgrounds: your search terms go through our server to Unsplash. The photos themselves load directly from Unsplash, which then sees your IP address.

  • Updates: the app checks our server for new versions and downloads them from GitHub.

10. This website

aaavatar.nl is hosted by Framer. To see how visitors use the site, we use PostHog (without cookies), DataFast and Google Analytics. DataFast and Google Analytics place cookies with a random visitor ID. We also record clicks on the download button. We use this to see which pages help people find Aaavatar.

11. Who receives your data

We use these providers to run Aaavatar. They process data on our behalf and only for the purposes above:

  • Supabase (EU): account, database and file storage

  • Vercel: hosting of our server and website functions

  • Replicate (United States) and the model developers above: AI processing for cloud edits

  • Stripe: payments and invoices

  • Resend: sending email

  • PostHog (United States): usage statistics for the app and website

  • Notion (United States): feedback handling

  • Upstash: protecting our server against abuse

  • Unsplash: background photos

  • GitHub: app and model downloads

  • Framer, DataFast and Google: the website and its statistics

Some of these providers are based in the United States. For those transfers we rely on the EU–U.S. Data Privacy Framework or on the European Commission’s standard contractual clauses. We do not sell personal data.

12. How long we keep data

  • Your library: on your Mac, for as long as you keep it.

  • Account data: until you delete your account.

  • Photos for cloud edits: the upload is deleted as soon as our server has read it; results within 24 hours.

  • Custom effects: until you delete the effect.

  • Usage statistics: up to two years.

  • Feedback: as long as we need it to follow up, and no longer than two years.

  • Payment records and invoices: seven years.

  • Unsubscribes: for as long as we send email, so we can respect your choice.

13. Your rights

You have the right to access, correct or delete your personal data, to object to processing based on our legitimate interest, to restrict processing, and to receive your data in a portable format. Email info@squareone.nl and we will respond within one month.

You can delete your account yourself in Settings › Account › Delete account. We then cancel your subscription and delete your account and the account data in our database. Invoices and payment records stay with Stripe and in our accounts for as long as the law requires. Custom effects are removed when you delete them. The library on your Mac is not touched; you delete that yourself.

If you think we handle your data incorrectly, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

14. Security

All connections are encrypted. Photos you upload for cloud edits are stored privately and are only reachable through short-lived links. Your sign-in session is stored encrypted on your Mac, and our admin tools are protected with two-factor authentication.

15. Children

Aaavatar is not intended for children under 16, and we do not knowingly process their data.

16. Changes

If we change how we handle personal data, we update this page and the date at the top. For important changes we also tell account holders by email or in the app.

17. Contact

Aaavatar is a product of Square One, based in the Netherlands. Square One is the controller for the personal data in this policy. For privacy questions, or to use your rights, email info@squareone.nl.