Privacy Policy

1. Who is responsible

The controller for the processing of your personal data on Kisvia is [company name and legal form], [registered address], email [contact email]. We have not appointed a data protection officer because the law does not require it; for any privacy question write to [contact email].

2. Summary

• We process only what we need to run your account, create your content, take payments and keep the Service safe.
• Your prompts and files go to the AI models you choose, only to create your results. We don’t use them to train AI and don’t sell your data.
• Website analytics run only if you agree to them in the cookie banner.
• Library files are deleted after about 30 days; you can ask for your data or its deletion at any time.

3. Your account

What: email address, optional name, password (stored only as a secure hash), language, referral code and who invited you, and the date and version of the Terms you accepted. If you sign in with Google: your Google account email, name, profile picture and account ID.

Why and legal basis: to create and run your account and the contract with you (GDPR art. 6(1)(b)).

How long: until your account is deleted.

4. Your content and generations

What: the prompts you write, files you upload (images, videos, audio), your canvases, the results created, and a record of each run (model, cost in credits, status).

Why and legal basis: to create your content and show it to you (art. 6(1)(b)); the run records also prove what was charged and refunded (art. 6(1)(b) and (f)).

How long: library files are deleted automatically about 30 days after creation; canvases and run records until you delete them or your account.

Please only upload pictures, voices or other data of other people if you are allowed to (for example with their consent).

5. AI processing

When you run a model, your prompt and the input files of that run are sent to our AI infrastructure provider, Replicate, Inc. (USA), which runs the model. Some models are operated by their developers through Replicate, for example Google, ElevenLabs, MiniMax, ByteDance, Kuaishou, Black Forest Labs, xAI or Stability AI; for these, the prompt and files of that run are passed on to the developer only to produce your result. The canvas assistant uses an open model (DeepSeek V3.1) hosted by Replicate; your request does not go to the company DeepSeek.

Legal basis: performing the contract, because you choose the model and ask for the result (art. 6(1)(b)). Results are created automatically; no decisions with legal or similarly significant effects are made about you (art. 22).

6. Payments

What: your plan, prices, order numbers, payment status and dates, and a label of the payment card (brand and last four digits) received from our payment provider. Card numbers are entered on the payment provider’s page and are never stored by us.

Why and legal basis: to take payments, renew plans and handle refunds (art. 6(1)(b)), and to keep accounting records (art. 6(1)(c)). The payment provider (a bank) processes card data as an independent controller under banking law.

How long: invoices and payment records as long as tax and accounting law requires (usually 5 to 10 years); otherwise until your account is deleted.

7. Login sessions and security

What: for each login session the IP address, the browser (user agent), and a session token stored only as a hash; hashed one-time links for password reset and email confirmation; counters of attempts per IP address to stop password guessing.

Why and legal basis: to keep your account and the Service secure and prevent abuse; our legitimate interest is security (art. 6(1)(f)).

How long: session records 30 days after the session ended; one-time links 30 days after they expired; attempt counters at most 15 minutes, in memory only.

8. Contact and support

What: messages you send us with the contact form or by email, your category and email address, our notes; answers you give when cancelling a plan; withdrawal statements.

Why and legal basis: to answer you and handle your requests (art. 6(1)(b) and (c)); cancellation answers help us improve the Service (art. 6(1)(f)).

How long: 3 years after the message, then deleted automatically.

9. Activity in your account

Our server records important actions in your account, such as sign-up and login, starting or stopping a generation, uploads, purchases, renewals, cancellations and messages, with their date and technical details (for example the model or plan). Nothing is stored in your browser for this.

Why and legal basis: to run and secure the Service, to handle support and billing questions, and to understand in aggregate how the Service is used so we can improve it; our legitimate interests (art. 6(1)(f)). You can object at any time (section 16).

How long: 13 months, then deleted automatically.

10. Website analytics (only with your consent)

If you click “Accept analytics” in the cookie banner, we store a random visitor ID and where you came from (referring website and campaign parameters) in your browser, and record which pages you view and what you click on our website and in the app (for example opening the pricing, choosing a plan, playing a sample, exporting a video). At sign-up, this is linked to your account so we can see which pages help people get started. When the site is hosted on Vercel, we also use Vercel Web Analytics, which counts page views without cookies.

Legal basis: your consent (art. 6(1)(a) GDPR and the ePrivacy rules on storing information in your browser). You can withdraw it at any time with “Cookie settings” in the website footer or the app menu; this does not affect processing before the withdrawal.

How long: 13 months, then deleted automatically. Without consent nothing is stored or recorded for analytics.

11. Server logs

When you visit the website, our hosting provider automatically processes technical data (IP address, time, requested page, browser) to deliver the website and defend it against attacks (art. 6(1)(f)). These logs are kept for at most 30 days, unless needed to investigate an attack.

12. Emails

We send emails needed for your account and contract, such as email confirmation, password reset, payment and withdrawal confirmations and important notices about the Service (art. 6(1)(b)). We send marketing emails only if you have agreed to them, and every such email lets you unsubscribe.

13. Who receives your data

We use the following service providers, bound by data processing agreements and our instructions:

• [hosting provider and region]: hosting of the website, the app and the database;
• Replicate, Inc. (USA) and the model developers named in section 5: running the AI models;
• Cloudflare, Inc.: file storage and content delivery, when enabled;
• an email delivery provider, for the emails in section 12, when enabled;
• Vercel Inc. (USA): web analytics, only with your consent and only when the site is hosted on Vercel;
• Google Ireland Ltd. / Google LLC: only if you use “Sign in with Google”. When the login page shows the Google button, your browser loads it from Google, which receives your IP address.

Our payment provider processes payments as an independent controller. We disclose data to authorities only when the law obliges us to. We do not sell personal data or share it for advertising.

14. Transfers outside the EU

Some providers process data outside the European Economic Area, mainly in the USA, and some model developers in other countries, including China. For the USA we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses (art. 46(2)(c)), with additional safeguards where needed. Where neither applies to a model developer, the transfer of the prompt and files of a run is necessary to provide the result you requested (art. 49(1)(b)). You can ask us for a copy of the safeguards at [contact email].

15. How long we keep data — overview

• Account data: until your account is deleted.
• Library files: about 30 days. Canvases and run records: until you delete them or your account.
• Payment records: as long as tax and accounting law requires.
• Login sessions: 30 days after they ended. One-time links: 30 days after they expired.
• Messages, cancellation answers and withdrawal statements: 3 years.
• Activity records: 13 months. Analytics (with consent): 13 months. Server logs: at most 30 days.

When you delete your account in Settings, your content, files and personal data are deleted at once; payment records and withdrawal statements are kept, without your name or email address, as long as the law requires.

16. Your rights

You have the right to access your data (art. 15), to have it corrected (art. 16) or deleted (art. 17), to restrict processing (art. 18), to receive it in a portable format (art. 20), and to withdraw a consent at any time with effect for the future (art. 7(3)).

You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (art. 21); you can always object to direct marketing.

You can delete your account yourself at any time in Settings. To use your other rights, write to [contact email] or use the contact form; we answer within one month and may ask you to confirm your identity. You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live or work, or with the authority responsible for us: [data protection authority].

17. Do you have to give us your data?

To create an account and use the Service we need your email address and a password (or a Google account); without them we cannot conclude the contract. Everything else, such as your name, is optional.

18. Children

The Service is not intended for people under 18. We do not knowingly collect data of children; if we learn that a child has created an account, we delete it.

19. Cookies and storage in your browser

Necessary (no consent needed, because you asked for the Service and it cannot work without them):

• the cookie kisvia_rt keeps you securely logged in (HttpOnly, 30 days);
• storage in your browser for your login, language, theme, canvas drafts, onboarding hints, your billing period choice and your cookie choice.

Optional (only with your consent): the analytics visitor ID and first-visit source described in section 10, and Vercel Web Analytics.

We use no advertising or social media cookies. You can change your choice at any time with “Cookie settings” in the website footer or the app menu.

20. How we protect your data

Passwords are stored only as Argon2id hashes, sessions use short-lived tokens, all connections are encrypted (HTTPS), access to the database is restricted, and we keep our software up to date.

21. Changes to this policy

We update this policy when our processing changes. The current version is always on this page, with its effective date; we will tell you about important changes in the Service.