Privacy Policy

1. Who is responsible

[Operator legal name] ([Registered address]) is the data controller for Tanvo. Contact: support@tanvo.ai.

2. What we collect

Account data. Email, name and profile image from your sign-in provider (Google), and your account settings.

Content. Prompts, uploaded photos, audio and video, and the images and videos generated from them, together with the settings used and the credits charged.

Payment data. Plan, orders, amounts and Stripe identifiers. Card numbers go directly to Stripe and never reach us.

Usage and device data. Pages viewed, actions taken (such as starting a generation or a checkout), timestamps, the page you came from, campaign parameters in the URL (such as utm_* and gclid), approximate location derived from your IP address (country, region, city), language, time zone, screen size, device type, operating system and browser. We store a hashed form of your IP address, not the address itself.

Moderation data. The result of automated content checks on prompts and uploads, kept for abuse review.

API data. Hashed API keys, when they were last used, and the runs made with them.

3. Why we use it

• To run the service: generate your content, keep your history, charge credits, deliver downloads (performance of the contract).
• To keep the service safe: moderation, rate limits, fraud and abuse prevention including enforcing free allowances and referral rules (legitimate interest and legal obligation).
• To understand and improve the product and our marketing: which pages and campaigns bring people who sign up and pay (legitimate interest; consent for advertising cookies where required).
• To contact you about your account, receipts, and material changes (contract and legal obligation).

4. Cookies and tracking

We set a few first-party cookies: a session cookie for sign-in, a visitor id that lets us recognise the same browser on later visits, an anonymous allowance id for signed-out use, and a short-lived flag after sign-up. These are necessary for the service and for measuring our own marketing.

If configured for your region, we also load Google Analytics 4 and Google Ads tags, which set their own cookies and receive page views and conversion events (sign-up, purchase, with order value). Where the law requires consent for these, they are loaded only after you agree, and you can withdraw consent at any time from the cookie settings link in the footer. You can also block them with your browser or an extension; the service works without them.

5. Who we share data with

Processors that act on our instructions: model providers (WaveSpeed and the model vendors it hosts) receive your prompts and uploads to generate results; Stripe handles payments; Google provides sign-in and, if enabled, analytics and advertising measurement; Cloudflare stores files and serves the site; our hosting and database providers run the infrastructure. We share only what each needs.

We disclose data when the law requires it, to protect our users or our rights, or in a merger or sale of the business (you would be notified). We do not sell personal data.

6. How long we keep it

• Account and content: until you delete them or your account. Generated files you delete are removed from storage within 30 days.
• Uploads used as references: kept with the generation so you can see what it was made from; deleted with it.
• Orders, invoices and ledger entries: as long as tax and accounting law requires (typically 7 years).
• Usage events and visitor records: 24 months, then deleted or aggregated.
• Moderation logs: 12 months.
• Signed-out allowance records and rate-limit counters: up to 24 hours.

7. Your rights

Depending on where you live you may have the right to access, correct, export or delete your data, to object to or restrict certain processing, and to withdraw consent. Write to support@tanvo.ai from your account email; we answer within 30 days. You can also complain to your local data protection authority.

To delete your account, email us; we remove account data, content and files, and keep only what accounting law requires.

8. International transfers

Our providers run servers in several countries, including the United States. Where data leaves your region we rely on the providers’ standard contractual clauses or equivalent safeguards.

9. Children

Tanvo is not for anyone under 18. We do not knowingly collect data from children; if you believe we have, contact support@tanvo.ai and we will delete it.

10. Changes

We will post changes here and update the effective date; for material changes we also notify account holders by email.