Privacy Policy

1. Information We Collect

a. Account Information

When you create an account we collect your name, email address, and encrypted password (bcrypt, never stored in plain text). If you sign in via Google or GitHub OAuth we receive only the profile data you choose to share with us.

b. Payment Information

Payments are processed by Stripe. We never receive or store your full card number, CVC, or bank details — Stripe handles all sensitive payment data in accordance with PCI-DSS Level 1 standards. We store only a Stripe customer ID and subscription status.

c. Usage Data

We collect prompts, generation parameters, credit consumption, job status, and timestamps to provide the Service and detect abuse. Generated assets (images, videos, audio) are stored in encrypted S3-compatible object storage.

d. Voice Data

If you use the Voice Clone feature, you upload audio samples that are transmitted to ElevenLabs to create a custom voice model. We do not store raw voice samples on our servers beyond the time needed to upload them to ElevenLabs. You may delete your cloned voice at any time, which also deletes it from ElevenLabs.

e. Technical Data

We automatically collect IP address (truncated after use for geo-restriction checks), browser type, operating system, pages visited, and session duration for security and analytics purposes.

2. How We Use Your Information

• To provide, operate, and improve the Service
• To process payments, manage subscriptions, and allocate credits
• To send transactional emails (account confirmation, receipts, password reset)
• To detect and prevent fraud, abuse, and prohibited content
• To comply with legal obligations (tax, AML, court orders)
• To analyse aggregate usage patterns and improve model routing
• To send product updates (opt-out available in account settings)

We do not sell your personal data to third parties. We do not use your prompts or generated content to train AI models without your explicit opt-in consent.

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA) or UK, we process your data under the following legal bases:

• Contract performance — processing necessary to deliver the Service you subscribed to
• Legitimate interests — security monitoring, fraud prevention, product improvement
• Legal obligation — tax records, AML compliance
• Consent — marketing emails, optional analytics (you may withdraw at any time)

4. Third-Party Service Providers

We share minimal data with the following sub-processors to operate the Service:

International transfers to the USA are covered by Standard Contractual Clauses (SCCs) where applicable.

5. Data Storage and Security

• All data is transmitted over TLS 1.2+
• Generated assets are stored in encrypted S3-compatible storage (AES-256)
• Passwords are hashed with bcrypt (cost factor 12)
• Database backups are encrypted at rest
• Access to production systems is restricted to authorised personnel with MFA
• We conduct regular security reviews and dependency audits

6. Your Privacy Rights

Depending on your location, you may have the following rights:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and associated data
• Portability — receive your data in a machine-readable format
• Objection / Restriction — object to or restrict certain processing
• Withdraw consent — withdraw consent for marketing at any time
• Opt out of sale (CCPA) — we do not sell personal data; this right is satisfied by default

To exercise any right, email privacy@olova.ai with your request. We respond within 30 days (GDPR) or 45 days (CCPA).

7. Children's Privacy (COPPA)

Olova AI is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children under 13. If we discover we have collected such data, we will delete it promptly. If you believe a child has provided us personal information, contact privacy@olova.ai.

8. Cookies & Tracking

We use:

• Essential cookies — authentication session (required, cannot be opted out)
• Analytics cookies — PostHog (optional, can be disabled in browser settings or account preferences)

We do not use third-party advertising cookies or cross-site tracking.

9. AI-Generated Content & EU AI Act

In accordance with the EU AI Act and applicable regulations, we:

• Do not use AI to make automated decisions with significant legal or similar effects on individuals without human oversight
• Disclose to users that content is AI-generated
• Apply content moderation to prevent generation of CSAM, NCII, or other prohibited content
• Log generation requests for safety audit purposes (retained 90 days)

10. Data Retention

We retain your data for as long as your account is active. After account deletion:

• Personal data is deleted within 30 days
• Generated assets are deleted within 90 days
• Payment records are retained 7 years for tax compliance
• Safety/abuse logs are retained 12 months

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email and a banner on the Service at least 14 days before taking effect. Continued use after the effective date constitutes acceptance.

12. Contact & Data Controller

Data Controller: Olova AI Ltd.
Privacy enquiries: privacy@olova.ai
General support: support@olova.ai

EU residents may also lodge a complaint with your local Data Protection Authority (DPA).