Privacy Policy

We may collect the following categories of data:

• Account data — such as your name, email address, profile image, and authentication identifiers, provided when you create an account or sign in (for example, via a third-party identity provider).
• Content and Inputs — the prompts, messages, files, images, and other content you submit to or generate through the Service, together with related metadata (such as timestamps and model settings).
• Usage and technical data — such as IP address, device and browser type, operating system, approximate location derived from IP, pages viewed, features used, and diagnostic and performance data.
• Cookie and similar data — collected through cookies, local storage, and similar technologies to operate and improve the Service.
• Communications — information you provide when you contact us, including support requests and feedback.

We use personal data for the following purposes:

• to provide, operate, maintain, and secure the Service;
• to process your prompts, files, and requests and to generate Outputs;
• to create and manage your account and authenticate your identity;
• to enforce usage limits, quotas, and rate limits and to prevent abuse;
• to communicate with you, including responding to enquiries and sending service-related notices;
• to monitor, analyse, and improve the Service, including debugging and quality assurance;
• to detect, prevent, and address fraud, security incidents, and violations of our Terms;
• to comply with legal obligations and to enforce our rights; and
• to develop new features and functionalities.

Where required by applicable law, we process personal data on the basis of your consent, the performance of a contract with you, our legitimate interests, or compliance with legal obligations.

To generate Outputs, your Inputs may be transmitted to third-party AI-model providers and infrastructure providers that we use to operate the Service. The specific provider depends on the model you select and how the Service is deployed. These providers process your Inputs to return Outputs and may retain them in accordance with their own policies.

If you use your own API keys (“BYOK”) or a self-hosted deployment, your data may be processed directly by the provider or infrastructure you have configured, and your relationship with that provider is governed by their terms.

We do not sell your personal data. We may disclose personal data to: (a) service providers and processors who assist us in operating the Service; (b) AI-model and infrastructure providers as described above; (c) professional advisers; (d) authorities where required by law or to protect rights, safety, and security; and (e) a successor entity in connection with a merger, acquisition, or sale of assets.

We use cookies, local storage, and similar technologies to keep you signed in, remember your preferences (such as theme and layout), maintain session state, and understand how the Service is used. You can control cookies through your browser settings; however, disabling them may affect the functionality of the Service.

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. When data is no longer needed, we will delete or anonymise it. Conversation content may be retained until you delete it or your account, or as otherwise required by law.

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction, including encryption in transit and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

Your personal data may be transferred to, stored, and processed in countries other than your own, including countries where our service providers operate. Where we transfer personal data internationally, we take reasonable steps to ensure it receives an adequate level of protection consistent with applicable law.

Subject to applicable law (including the PDPA), you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data, subject to legal retention requirements;
• withdraw consent, where processing is based on consent;
• object to or restrict certain processing; and
• lodge a complaint with a data-protection authority.

To exercise these rights, contact us at hello@tuvodev.com. We may need to verify your identity before fulfilling a request. Some rights may be limited where we have a lawful basis or overriding obligation to retain or process data.

The Service is not intended for children under the age of eighteen (18), or the age of legal majority in your jurisdiction. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

The Service may contain links to, or integrate with, third-party websites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the “Last updated” date above. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

If you have questions or requests regarding this Privacy Policy or your personal data, please contact us at hello@tuvodev.com.