Privacy Policy

Information we process and why

Account information includes your email address, username and information needed for authentication. It is used for registration, identity verification, account administration and service notices.

Creation information includes prompts, reference images, audio and video, scripts, project materials and generated outputs that you submit or create. It is processed to perform the creation, storage, editing, sharing and collaboration functions you request. Only upload materials you are entitled to have processed.

Order and usage information includes top-ups or manual credits, consumption, balances, task identifiers, usage, refunds and activity records, used for billing, reconciliation, support and applicable record-keeping obligations. Service operations may also involve access times, IP addresses, device or browser details and error logs for security and troubleshooting.

Processing grounds and optional information

Depending on applicable law, processing must have an appropriate basis, such as performing the service, complying with legal obligations, protecting service security or your valid consent. Additional local requirements for consent, sensitive information or international processing must be satisfied where applicable.

A function may not work without information necessary to provide it. Optional information should not be required for unrelated functions. Do not include unnecessary sensitive material, identity documents or payment passwords in prompts or uploaded files.

Model providers, storage and collaboration

For generation or analysis, the relevant prompts, necessary reference materials and task parameters are sent to the provider of the model you select. Cloud infrastructure and object-storage providers may process project data and media. Only information needed for the requested function should be included in that processing.

Shared project information can be accessed by the team members authorised under the project's permissions. Public links or media addresses you share may allow the recipient to access that content. Some media addresses may be directly accessible as a matter of implementation; do not upload unauthorised confidential material as shareable assets.

When using a third-party payment channel, that provider handles payment information under its payment interface and privacy notice. Valava uses business records such as order identifiers, amounts, currencies and payment status for reconciliation.

Local storage and cookies

The website uses browser storage and similar technologies for login state, language, theme and some working drafts. If you choose to remember login information, saved login details may remain on that device. Do not enable this on shared devices, and clear the relevant browser data when no longer needed.

You can manage local storage or cookies through browser settings. Clearing them may sign you out and remove local drafts that have not been synchronised; save important work first.

Retention, security and international processing

Information should be retained only as necessary to provide the relevant service, resolve disputes, conduct security audits and satisfy applicable legal obligations. The period depends on the information, account status and legal record-keeping requirements; indefinite retention is not the default commitment. Where transaction or audit records must be retained after a deletion request, the reason and scope should be explained.

Authentication, access controls and other reasonable measures help protect information, but no system can guarantee absolute security. Protect your account and do not share login credentials.

The selected model, cloud-storage or payment service may involve processing outside your country. Where required, information about recipients, purposes, data categories, safeguards and any necessary separate consent must be addressed before that processing. Publishing this policy does not replace those procedures. Contact support for the arrangements relevant to a particular function.

Your rights and how to contact us

Subject to applicable law, you may request access, a copy, correction or deletion of personal information, withdraw consent-based authorisations, restrict or object to certain processing, or request account closure. Where applicable, you may also request portability or complain to the competent authority.

Email [email protected] with the account and request concerned. Reasonable identity verification may be required to prevent impersonation; do not send a full card number, payment password or account password. Requests are handled under applicable law, and necessary transaction retention, dispute handling or security requirements may limit deletion.

Minors and policy changes

People below the age required by applicable law to use the service or enter the relevant contract independently should use it only with legally required guardian permission and supervision. Contact support if you believe a minor's information has been processed without necessary authorisation.

Material changes to the business or processing will be reflected here, with additional notice or valid authorisation where required. A new policy does not retrospectively authorise processing that lacked necessary permission.