Privacy Policy

This Privacy Policy explains how the operator of Supaviral Ads (Supaviral, we, us, or our) collects, uses, stores, and discloses personal information when you visit our website, create an account, use our AI image and video tools, manage projects, purchase a plan, or contact us (the Services).

The operator responsible for personal information described in this policy is:

The operator’s legal name, business address, country, and monitored legal contact email are awaiting confirmation. These documents are drafts until those details are completed.

For account administration, billing, security, and our own service operations, we determine the purposes and means of processing. When we process personal information solely on a business customer’s instructions, that customer may be the controller and we may act as its processor; any applicable data processing agreement governs that processing. This policy is a notice of our practices, not a request for blanket consent. Our Terms of Service govern use of the Services.

• Account and profile information: name, email address, account identifiers, authentication records, profile picture if provided, preferences, and information submitted during onboarding, such as your creative goals and business role. Authentication credentials are handled through our authentication service.
• Creative content: prompts, reference images and other supported uploads, product materials, generated images and videos, project and canvas content, saved assets, generation settings, and associated file and job metadata. Content may contain personal information about you or other people.
• Purchases and usage: selected plan, billing interval, subscription status, customer and transaction identifiers, credit grants and consumption, generation history, downloads, and project activity. Our payment processor collects payment details directly; our application does not receive or store full card numbers or card security codes.
• Communications: feedback, support messages, privacy requests, and information you choose to include in correspondence.
• Technical information: IP address, browser and device information, request timestamps, authentication events, errors, and operational logs generated when requests reach our infrastructure. Where performance reporting is enabled, it reports page performance measurements and navigation type.
• Referral information: referral codes, attribution, and any recipient details you submit through an available referral feature. Only provide another person’s details when you have a lawful basis to do so.

We receive information directly from you, automatically through operation of the Services, and from authentication, billing, and generation providers. If you decline information required for an account, payment, or generation request, we may be unable to provide that feature.

If you choose an available Google sign-in option, Google and our authentication service provide the basic identity information authorized in that flow, such as your Google account identifier, name, email address, and profile picture. We use it to create or link your Supaviral account, authenticate you, and display your profile.

Basic Google sign-in does not give Supaviral your Google password or access to your Gmail messages, Drive files, contacts, or advertising accounts. Any future integration requiring additional access must explain that access and request authorization separately. Account identity information is not sent to a generation model merely because you sign in with Google.

You can review or revoke a Google connection in your Google account settings. Revoking that permission does not itself delete your Supaviral account, cancel a subscription, or remove information we already hold. Contact us separately to request account or data deletion.

We process information to authenticate accounts; save and retrieve projects and assets; run generation and prompt enhancement; deliver outputs; manage subscriptions and credit balances; respond to requests; maintain reliability; prevent fraud, abuse, and unauthorized access; investigate disputes; and meet legal and accounting obligations.

Where UK or European data protection law applies, we rely on:

• Contract: account access, requested generation, workspace storage, billing, and related service support needed to provide what you order.
• Legitimate interests: protecting the Services, preventing misuse, diagnosing problems, understanding service performance, and handling business communications, after considering your rights and reasonable expectations.
• Legal obligations: required accounting records, lawful requests, and other applicable compliance duties.
• Consent: optional activities for which the law requires consent, including non-essential tracking or certain marketing. You may withdraw consent without affecting earlier lawful processing.

Service and security notices are separate from marketing. If we send optional marketing, you can unsubscribe using the message’s instructions or contact us. We do not make decisions with legal or similarly significant effects about you solely by automated means. Automated checks may block requests, enforce credit limits, or flag abuse; you may ask us to review an affected account decision.

To complete a generation or prompt enhancement, we send the relevant prompt, selected settings, and necessary reference content to the provider serving that request. Our current integrations include OpenRouter, its downstream model providers, and fal. A request may involve more than one provider, for example when a prompt is enhanced before an image or video is generated.

Providers may receive uploaded media directly or through a temporary access URL. Their processing, retention, safety review, and any model improvement practices depend on the selected model, provider, configuration, and applicable agreement. We do not promise that every model offers zero retention or excludes training. Review the relevant provider’s terms before submitting confidential, personal, or commercially sensitive material; ask us if you need clarification about a model.

Supaviral does not itself train a general-purpose AI model on your private inputs or outputs. The permission to process content for your requested service is not permission for Supaviral to publish it in marketing or train an independent model. Any new use requiring consent or an updated legal basis will be addressed separately.

Faces, voices, and other depictions can be personal information and may be sensitive under local law. Do not upload another person’s likeness without the necessary authority and permissions, or include sensitive identifiers, financial account details, health records, or biometric identifiers in prompts. We do not offer identity verification or biometric identification as a purpose of the Services.

• Infrastructure providers: Supabase for authentication, databases, and file storage; hosting and delivery infrastructure such as Vercel; and providers supporting necessary service communications and operations.
• AI providers: the generation and routing services described above, receiving content needed to fulfill the requested operation.
• Payment processing: Stripe processes checkout, payment, subscription, invoice, and billing portal information. It may also act independently for fraud prevention and regulatory duties.
• People you authorize: anyone to whom you export, publish, or send content, and workspace participants where sharing is available and authorized. Your own publishing choices are your responsibility.
• Professional and legal recipients: advisers, authorities, or other parties where reasonably necessary to comply with law, protect rights, investigate fraud, or respond to valid legal process.
• Business changes: a prospective or actual successor in a merger, acquisition, financing, or asset transfer, with appropriate confidentiality and legally required notice or choices.

We limit disclosures to their relevant purpose. A provider’s own website and independently controlled services are governed by its privacy notice. We do not sell personal information or share it for cross-context behavioral advertising.

Saving an asset or generating content in your workspace does not by itself publish it in a public gallery. Content is stored in access-controlled workspace storage. Authorized staff and service providers may access information when needed to deliver support, investigate a failure or abuse report, secure the Services, or meet legal duties.

Temporary signed media URLs allow their holders to access a file until the link expires or access is otherwise restricted. Treat these links as confidential. Downloaded files, screenshots, and copies you share outside Supaviral are outside our access controls. Do not use the Services as the only copy of important work.

We use authentication cookies to maintain your session. Browser local storage and IndexedDB can preserve a landing-page prompt and attachments while you navigate into the product, and remember that you have visited before. Billing and sign-in providers may use their own cookies for their flows, security, and fraud prevention.

You can clear or block cookies and site storage using your browser settings. This may sign you out, remove a local draft, or stop a feature from working. Clearing browser storage does not delete server-held account information, files, or subscriptions.

We do not currently use advertising pixels in the application. If non-essential cookies or similar tracking are introduced, we will provide the notices and consent controls required by applicable law before enabling them. Technical performance reporting, where configured, measures loading and responsiveness; it is not a recording of your creative prompts or uploaded files.

We retain account details while needed to maintain your account, and workspace content while needed to provide your saved projects and generation history. We assess retention based on the purpose of the record, whether you still use the feature, security needs, dispute periods, applicable law, and provider or backup lifecycles.

You may ask us to close your account or delete personal information using the contact details below. Archiving an asset or project may hide it without permanently deleting it. Account closure and subscription cancellation are separate actions; manage your subscription in Settings → Billing or ask us for help.

Deletion is subject to identity verification and lawful exceptions. Payment and tax records, fraud prevention records, and records needed for legal claims may need to be retained. Deleted information may remain in restricted backups until those backups are replaced, and provider-held copies follow the applicable provider’s retention and deletion process. We do not promise immediate deletion from all systems. We may retain genuinely de-identified statistics that no longer identify you.

Supaviral and its service providers may process information outside your country, including in the United States and other locations used by infrastructure and model providers. Those countries may have different privacy laws.

Where transfer safeguards are legally required, transfers must be supported by an applicable adequacy decision, approved contractual safeguards such as the EU Standard Contractual Clauses and relevant UK addendum or international data transfer agreement, or another lawful mechanism. Contact us for information about the safeguards relevant to your data. We do not promise that every provider keeps information in a single country.

We use technical and organizational measures designed to protect information, including authenticated access, workspace access controls, restricted storage, and encrypted transport. No online service is completely secure. Protect your login credentials, use a secure device, and report suspected unauthorized access promptly.

We investigate security incidents and provide notifications where required by applicable law. This policy does not represent a security certification or a guarantee against loss or unauthorized access.

Depending on where you live, you may have rights to access or obtain a copy of your information, correct inaccuracies, request deletion, restrict processing, receive portable information, object to processing based on legitimate interests, and withdraw consent. You can update available profile fields in Settings and contact us for other requests.

We may request proportionate information to verify your identity or an authorized agent’s authority. We respond within applicable legal time limits, explain any lawful refusal or extension, and do not discriminate against you for exercising a right. Some requests may affect our ability to provide the Services.

Where applicable, US state privacy laws provide access, correction, deletion, portability, and appeal rights. Because we do not sell personal information or share it for cross-context behavioral advertising, we do not offer an opt-out control for those activities. We honor legally applicable opt-out preference signals where relevant. You may contact us to appeal a privacy request decision.

You may complain to your local data protection or privacy authority. For UK residents, this includes the Information Commissioner’s Office; EEA residents may contact their local supervisory authority. We welcome the opportunity to address your concern first, but doing so is not a condition of making a complaint.

The Services are intended for people aged 18 or over. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us so we can investigate and take appropriate steps, including deletion where required. Do not submit content that exploits or endangers a child.

We update the date above when this policy changes. For material changes, we will provide an appropriate notice, such as an in-product message or email, and obtain consent where required. Changes do not remove rights relating to information already collected.

For privacy questions, access or deletion requests, provider information, or complaints, contact:

The operator’s legal name, business address, country, and monitored legal contact email are awaiting confirmation. These documents are drafts until those details are completed.

Please identify the email associated with your account and the nature of your request. Do not send passwords, full payment details, or unnecessary identity documents.