Privacy Policy

The legal operator must be inserted before public launch.

Contact: support@gevvorg.ai

We process account identifiers, authentication/session information, credit balances, generation records and information required to provide and secure the service. The purposes include account administration, performance of the service, fraud prevention, support and compliance with legal obligations.

Your chosen display name, username, profile photo, biography, location and website are stored with your account when you save them. The current profile page is an account view, not a public community profile. Uploaded profile photos use the media-upload infrastructure, currently Higgsfield, as do other reference uploads. Choosing a language stores a first-party gevvorg_language preference cookie for up to 365 days; you can change the preference or remove the cookie in your browser. This does not enable advertising tracking.

Prompts and uploaded images, video or audio are processed to perform the generation you request. Depending on the selected model, these inputs are transmitted to the relevant AI infrastructure provider, currently including Higgsfield. Do not upload material you are not entitled to process or share. AI generation may involve upstream model providers as well as Higgsfield. Higgsfield provides a workspace opt-out from model training; the provider states that processing an opt-out may take up to ten business days. We do not promise immediate exclusion or zero retention. Do not submit confidential or sensitive personal data unless the required rights, lawful basis and provider arrangements have been established.

We process account, purchase and generation data to take steps at your request and perform our contract (Article 6(1)(b) GDPR). Necessary fraud prevention, service security and troubleshooting rely on our legitimate interests in operating a secure service (Article 6(1)(f)); legal and accounting obligations rely on Article 6(1)(c). Consent, where required for a particular optional processing activity, is requested separately and can be withdrawn for the future. Reading this notice is not consent to marketing or model training.

Payments and subscriptions are processed by Stripe. GEVVORG does not store full payment-card details. Stripe receives the information necessary to process the transaction and prevent fraud. Your account may display invoice information and masked payment-method details such as card brand, last four digits and expiry date obtained from Stripe; full card numbers and security codes are not displayed or stored by GEVVORG.

GEVVORG uses Supabase for authentication and application data. Supabase processes information necessary to authenticate users and operate account and credit functionality. If you choose Google sign-in, Google and Supabase exchange the identifiers, email and basic profile information needed for that sign-in; a supplied profile image may be loaded from its provider. Google sign-in does not grant GEVVORG access to your mailbox. Email sign-in remains a separate option.

Cloudflare hosts the application and processes IP addresses, request metadata, security information and technical logs needed to deliver and protect the website. Cloudflare operates a global network; this does not mean that all processing takes place in the EU. Supabase application data is hosted in the selected Ireland region (eu-west-1). Support messages sent to support@gevvorg.ai are received through Apple iCloud Mail. Authentication emails and enabled transactional confirmations are sent through Resend using the verified mail.gevvorg.ai sending domain in its Ireland region. Resend processes recipient addresses, message contents and delivery metadata needed to send those emails. No separate tracking subdomain has been enabled for these system messages.

Project organization, parts of generation history, model selections and reference media information may be stored in this browser using local storage and IndexedDB. Saved Explore references are also stored locally in this browser and do not create public likes or a shared account collection. These browser-local items are not a guaranteed cross-device backup. Download generated files you wish to keep; provider-hosted media can expire. Clearing browser data can remove local projects and history without deleting accounting records held on the server.

Some service providers may process data outside the EEA. Where required, transfers must rely on an applicable GDPR transfer mechanism such as an adequacy decision or appropriate safeguards. Provider-specific transfer details must be verified against the production contracts before launch.

Account and profile data are used while the account is active. On a verified deletion request we assess and remove or anonymise data no longer needed, while separating records that must be retained for accounting, fraud prevention or legal claims. Austrian accounting records are generally kept for seven years from the end of the relevant calendar year; OSS records, if that scheme applies, can require ten years. A legal hold can extend retention for the affected records. These periods do not justify retaining unrelated uploads or entire profiles for the same length of time.

Browser-local projects and saved references remain until you delete them or clear the browser storage. Provider-hosted input and output files, logs and backups follow the applicable provider arrangements and may expire independently. We do not promise immediate deletion from every provider backup or a permanent archive of generated media. Ask support for account deletion; cancellation of renewal alone is not a deletion request.

During the purchase review for credits or subscriptions, we ask you to confirm that you are at least 18 and of legal age in your jurisdiction and accept the service rules. We store your account identifier, the terms and declaration versions, chosen language and server timestamp. This is a self-declaration, not verified identity or permission from any person depicted in an upload. We do not collect your birth date or identity document in this step. These records support account administration, enforcement of the service rules and contractual evidence, subject to applicable retention and erasure requirements.

When you contact support or submit the withdrawal form, we process the name, account/contact email, contract reference and message you provide. Withdrawal declarations are recorded with a timestamp and reference; a confirmation is stored, and delivery information is processed when email sending is enabled. These records support handling the contract and legal obligations. Avoid including payment-card numbers, passwords or API keys.

Subject to applicable law, you may have rights of access, rectification, erasure, restriction, portability and objection, as well as the right to lodge a complaint with the competent data-protection authority. Contact us using the address above to exercise a right.

Send access, correction, deletion or portability requests to support@gevvorg.ai. We may request proportionate identity verification before disclosing or deleting account data. We respond to rights requests without undue delay, normally within one month; where a lawful extension is necessary, we notify you within that first month and explain why. Do not send identity documents unless an appropriate, necessary verification method has been agreed. Closing or cancelling a subscription does not itself delete all account, transaction or legally retained records. You may complain to a competent supervisory authority, including the Austrian Data Protection Authority at dsb.gv.at, or the authority responsible where you live or work.

Further information is available from Cloudflare, Supabase, Stripe, Higgsfield Resend and Apple. Provider notices supplement this notice and do not replace our responsibilities as controller.

GEVVORG uses technically necessary session mechanisms and browser storage required for authentication and product functionality. Optional analytics or advertising technologies must not be enabled without updating this notice and, where legally required, obtaining consent.

Uploading content for a private generation does not authorise its publication in Explore or advertising. We require separate evidence of rights for public examples, including music, likeness and voice permissions where necessary. Unverified third-party TikTok examples are withheld from publication. To report a suspected infringement, contact support@gevvorg.ai with the page or asset address and a description of your rights; do not include unnecessary sensitive data.

23 October 2026. Controller details and production provider contractual safeguards still require verification before public sale. This notice does not assert that pending contracts or registrations have been completed.