Privacy Policy – AIvana
1. Introduction
AIvana (“we,” “our,” or “us”) is a mobile application that leverages artificial intelligence (“AI”) technologies to generate and modify images and videos. We are firmly committed to safeguarding the privacy of our users and ensuring compliance with the European Union General Data Protection Regulation (“GDPR”) and other applicable data protection laws.
This Privacy Policy describes the categories of data we collect, the purposes for which such data is processed, our retention practices, and your rights under applicable law.
2. Information We Collect
We collect only the data that is strictly necessary to operate and maintain the functionality of our services:
- Device Identifier (Device ID) – for users accessing the application as guests.
- Apple User ID – for users authenticating via Apple Sign-In.
- Analytics Data – anonymized usage metrics collected through analytics tools, including, but not limited to, device type, general interaction patterns, and aggregated usage statistics.
- User-Generated Content – images and videos you create or upload through the application.
- Uploaded Source Media – the photos, videos and audio files you deliberately select for a generation, together with the text prompts you write. Photos or videos you select for features such as Face Swap, AI Avatar, Character Swap, AI Dance or photo templates may contain a human face; see Section 6 (Face Data).
- Purchase & Account Data – product identifiers, subscription status and tier (weekly/monthly/yearly), credit balance, timestamps for purchases/renewals, and transaction state received from platform billing providers, solely to administer credits and subscriptions.
We do not collect names, email addresses, or any other direct personal identifiers, except for the Apple User ID when you choose to authenticate via Apple Sign-In.
3. Purposes of Processing
- To provide, operate, and maintain the services.
- To store, process, and deliver user-generated content.
- To facilitate authentication, account management, and recovery.
- To administer credits (deductions for image/video generation or editing) and subscriptions (credit top-ups at the start of each billing period and ad-free experience).
- To monitor application performance and optimize functionality.
- To comply with legal obligations (including tax and accounting) and enforce our Terms of Use.
4. Data Storage and Retention
- Active Subscribers: Content generated by users with an active subscription is retained for the duration of the subscription, unless deleted by the user.
- Non-Subscribers: Content generated by users without an active subscription is retained for a maximum of seven (7) days following its creation and is then permanently deleted.
- Post-Subscription: Any content created after a subscription has expired is subject to the same seven (7) day retention period.
- Uploaded Source Files: The photos, videos and audio files you upload for a generation (including photos containing faces) are deleted automatically from our storage by an automated daily job within three (3) days of upload.
- User-Initiated Deletion: All users, regardless of subscription status, may delete any of their generated content at any time via the in-app deletion tools.
- Account Deletion: Users who have authenticated via Apple Sign-In may permanently delete their account and all associated data from within the in-app settings. We do not process account or data deletion requests via email or other channels.
- Finality of Deletion: Deleted content and accounts are irreversibly removed from our systems, and no backups are retained.
- Purchase Records: Limited purchase metadata (e.g., product IDs, timestamps) may be retained as necessary to satisfy legal, tax, and accounting obligations.
5. Third-Party Services
We engage third-party service providers to perform certain operational functions on our behalf, including but not limited to:
- Authentication and Cloud Storage – Google Firebase (Google LLC), which authenticates users and stores uploaded and generated content.
- Analytics
- AI Processing – the third-party AI provider named in Section 5.1 below.
- Billing & Subscription Management
- Advertising for Non-Subscribers (subscribers receive an ad-free experience)
These service providers may be located outside the European Economic Area (“EEA”), including in the United States. Some may temporarily store or process user content solely to fulfill the requested services. Advertising providers display ads in accordance with their own privacy policies and applicable platform settings.
5.1 Third-Party AI Providers
To generate content, the application transmits the photos, videos, audio files and text prompts you submit to the third-party AI provider named below. This is the only third party that receives your creative content. The same information is displayed inside the application, on the “Your Data & AI Services” screen, before any data is transmitted.
- fal.ai – Features and Labels, Inc. (United States) – runs the image and video generation models behind every creative feature, including image generation and editing, text-to-video, image-to-video, video editing, templates, face swap and avatar features. Receives the images, videos and audio files you upload and the text prompts you write. fal.ai/privacy
This is the only third-party AI provider we use. Individual models offered through it may originate from other model developers (for example Google Veo, OpenAI, Kling or Seedream models). Where that is the case, the model is executed on fal.ai's infrastructure; we do not transmit your content directly to the model developer.
- Data transmission: Content is transmitted over TLS-encrypted connections, and only after you have agreed to the in-app AI data disclosure.
- Purpose limitation: fal.ai receives your content solely to perform the generation you requested. We do not authorise it to use your content for its own model training, for advertising or for profiling, and we require protections at least equivalent to those described in this Privacy Policy.
- Consent: Before any photo, video, audio file or prompt leaves your device, the application displays a disclosure naming this provider, describing what is sent and how long it is kept, and requires your explicit agreement. Nothing is transmitted until you agree.
- Withdrawing consent: You may review the disclosure or withdraw your consent at any time under Settings → AI Data & Providers. After withdrawal, no further content is transmitted until you agree again.
6. Face Data
Some features — Face Swap, AI Avatar, Character Swap, AI Dance and templates where you add your own photo — work on photos or videos that contain a human face. Where you use those features, the face contained in the file you choose is part of the content we process. This is the only face data the application handles, and it is handled as described below.
- What we collect: Only the photo or video file you deliberately select for a generation, which may contain your face or the face of a person whose permission you have. We do not collect or create faceprints, face templates, face geometry, facial landmark maps, biometric identifiers or any other mathematical representation of a face, and we do not derive one from your file.
- On-device face check: Before a photo is uploaded, the application may use Apple’s on-device Vision framework to check whether a face is present in the frame, so we can warn you if the photo is unsuitable for the selected effect. This check runs entirely on your device, returns only a yes/no result, and nothing from it is transmitted, stored or logged.
- How it is used: The file is transmitted to the third-party AI provider named in Section 5.1 for the sole purpose of generating the image or video you requested. Faces are never used for identification, verification, recognition, matching, surveillance, profiling, advertising, or for training our own or any third party’s models.
- Who it is shared with: Only with fal.ai, the AI provider that runs the model behind the feature you selected (Section 5.1), and with our cloud infrastructure provider, Google Firebase, which stores the file while the generation runs. Face data is never sold, never shared with data brokers, and never shared for advertising purposes.
- Where it is stored: Google Firebase Storage and Google Cloud infrastructure (United States), encrypted in transit (TLS) and at rest. fal.ai processes the file on its own infrastructure for the duration of the generation request.
- How long it is kept: Uploaded source files are deleted automatically from our storage within three (3) days by an automated daily job. Generated results are deleted seven (7) days after creation for users without an active subscription, and seven (7) days after a subscription ends for former subscribers. You can delete any individual item at any time, and deleting your account removes all of your content and account data.
- Your consent: Before any file containing a face is transmitted, the application displays the disclosure described in Section 5.1 and requires your explicit agreement. Consent can be withdrawn at any time under Settings → AI Data & Providers.
- Age: The application is intended for individuals aged 17 and older, and we do not knowingly process face data belonging to children.
7. Ownership of Content
All rights, title, and interest in and to the content you create remain vested in you. We acquire no rights other than those strictly necessary to store, process, and deliver your content as part of the services.
8. Copyright and Infringement
You are solely responsible for ensuring that your content does not infringe upon the rights of third parties. In the event of a substantiated infringement claim, we reserve the right to remove the allegedly infringing content without prior notice.
9. Data Security
We implement commercially reasonable technical and organizational measures to protect your data from unauthorized access, disclosure, alteration, or destruction. However, no method of electronic transmission or storage is entirely secure, and we cannot guarantee absolute security.
10. Your Rights under GDPR
Pursuant to the GDPR, you may have the right to access, rectify, erase, restrict, object to, or port your personal data. Our analytics data is aggregated and non-identifiable and is therefore not subject to these rights. Apple Sign-In users may exercise their rights—including account and data deletion—via the in-app settings. Guest users may delete their generated content manually from within the app.
11. Age Restrictions & Children’s Privacy
Our services are intended for individuals aged 17 and older. We do not knowingly collect personal data from individuals under 17. If we become aware that we have inadvertently collected such information, we will delete it promptly. If you are under 17, you must not use the services.
12. Contact
For questions, concerns, or requests regarding this Privacy Policy, contact: aivana2025@outlook.com.