Privacy Policy

1. Our approach to privacy

Senova is an AI media studio: you upload product photos and other media, write prompts, and Senova generates production images and short video for you, paid for with prepaid credits. We designed the product to respect your privacy by default. We collect the data we need to run the service reliably and to bill accurately, and not much more.

Product analytics are off by default. We do not load third-party advertising trackers, and we do not sell your personal information or share it for cross-context behavioral advertising. Where we would like to measure how features are used to improve them, we ask for your consent first and give you a clear way to opt out at any time.

This policy explains what we collect, why we collect it, how long we keep it, who we share it with, and the rights you have over your data.

2. Information you provide

You give us information directly when you sign up and use Senova. This includes:

• Account information — your name, email address, and password credentials (stored as a salted hash, never in plain text). If you sign in with a third-party identity provider, we receive a basic profile and a token rather than your password.
• Workspace and team information — the name of your workspace, the members you invite, their roles, and settings you configure.
• Billing information — your plan, billing address, and tax details. Card and payment-instrument data is handled directly by our third-party payment processor; we do not store full card numbers on our systems. We receive limited billing metadata such as the last four digits, card brand, and payment status.
• Content you create — the prompts you write, the images and other media you upload, and the images and video you generate.
• Support and communications — messages you send us, feedback, and survey responses.

3. Information collected automatically

When you use Senova, some information is collected automatically so the service can function, stay secure, and be debugged:

• Log and usage data — request timestamps, pages and features accessed, actions taken, and error and performance diagnostics.
• Device and connection data — IP address, browser type and version, operating system, and general (city/region-level) location inferred from IP.
• Cookies and similar technologies — we use a small set of strictly necessary cookies to keep you signed in and to secure the service, and optional cookies only with your consent. For the full list and your controls, see our Cookie Policy.

4. How we use information

We use the information described above to:

• Provide the service — create and manage your account, process your prompts and uploaded media to generate images and video, and deliver the features you request.
• Secure the service — authenticate you, detect and prevent fraud and abuse, and investigate security incidents.
• Support you — respond to your questions and troubleshoot problems.
• Improve the service — understand which features work well and fix what does not. Where this relies on optional analytics, we do it only with your consent.
• Communicate — send you service, security, and billing notices, and (where permitted) product updates you can opt out of.
• Meet legal obligations — comply with applicable law, enforce our terms, and establish, exercise, or defend legal claims.

5. Legal bases for processing

If you are in the European Economic Area, the United Kingdom, or a similar jurisdiction, we process your personal data under the following legal bases:

• Performance of a contract — to provide the service you have signed up for, including media generation and billing.
• Legitimate interests — to keep the service secure, prevent abuse, maintain and debug our systems, and understand usage in a privacy-respecting way, balanced against your rights.
• Consent — for optional analytics, non-essential cookies, and certain marketing communications. You may withdraw consent at any time without affecting processing already carried out.
• Legal obligation — to comply with tax, accounting, and other legal requirements.

6. AI processing of your content

Senova is an AI media studio, so the prompts and media you provide are processed by AI systems to generate output for you — images and video. To do this we send relevant prompts and uploaded media to our AI provider (fal.ai), acting as our subprocessor.

We do not use your prompts or content to train third-party base models, and we contractually require our AI subprocessors not to use your content to train or improve their general-purpose models, unless you have given us explicit, separate consent. Content is processed to serve your request and to operate features you have enabled.

AI output can be inaccurate or incomplete. You are responsible for reviewing generated output before you rely on or use it. The AI providers we use are listed on our Subprocessors page.

7. Sharing and subprocessors

We do not sell your personal data. We share information only in the limited circumstances below:

• Subprocessors — vendors who process data on our behalf to run the service, such as cloud hosting, AI model providers, our payment processor, and email delivery. They act under contract and only on our instructions. The current list is on our Subprocessors page.
• Within your workspace — content and activity are visible to other members of your workspace according to the roles and permissions you set.
• Legal and safety — when required by law, valid legal process, or to protect the rights, safety, and security of Senova, our users, or the public.
• Business transfers — if Senova is involved in a merger, acquisition, or sale of assets, data may transfer as part of that transaction, subject to this policy.

8. International data transfers

Senova operates and uses subprocessors in multiple countries, so your data may be processed outside the country where you live, including in the United States. Where we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards.

When we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with supplementary measures where needed.

9. Data retention

We keep personal data while your account is active and for a limited window afterward, then delete or anonymize it, unless a longer period is required by law (for example, tax and billing records) or to resolve disputes and enforce agreements.

When you delete content or close your account, we begin removing the associated content from active systems and purge it from backups on our normal backup rotation. The table below summarizes the main data categories, why we hold them, and how long.

The periods above are the defaults that apply while you simply use — or stop using — Senova. If you ask us to erase your data, the shorter deadline in Data deletion below applies instead.

10. Data deletion

You can ask us to erase your personal data at any time: delete your account from your account settings, or email privacy@senova.studio from the address on your account. You do not need to give a reason.

Once we have verified that the request comes from you, we erase your personal data from our active production systems within 30 days — including your account record, your prompts, your uploaded media, and the images and video you generated. Residual copies sitting in encrypted backups cannot be reached individually; they are overwritten on our normal backup rotation and are gone within 35 days of the erasure. We never use a backup to restore an account you asked us to delete.

We keep data past that 30-day deadline only where the law requires or expressly permits it, only for the categories below, and only for as long as that reason actually applies:

• Billing, invoice, and tax records — kept for the period required by tax and accounting law, typically up to 7 years.
• Records needed to establish, exercise, or defend legal claims, or that are subject to a legal hold, subpoena, court order, or regulatory request.
• A minimal safety and fraud-prevention record — for example a hashed identifier of an account terminated for a safety violation — kept so a banned account cannot simply be recreated.
• Aggregated or anonymized data that can no longer be linked back to you, your account, or your device.

Where one of those exceptions stops us deleting something, we will tell you which one applies, and we restrict that data so it is not used for any other purpose. When the retention period ends, it is deleted.

Deleting your account deletes the content in it, and we cannot recover it afterwards — export anything you want to keep first. Your Terms of Service describe the export window we give you if we ever end your account from our side.

11. Security

We take reasonable and appropriate measures to protect your data, including encryption in transit (TLS), encryption of data at rest on our infrastructure, role-based access controls, least-privilege access for staff, audit logging, and routine patching.

To be honest with you: no system is perfectly secure, and we do not claim otherwise. We cannot guarantee absolute security, and you also play a part — use a strong, unique password, protect your credentials, and manage who you invite to your workspace. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

12. Your privacy rights

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix data that is inaccurate or incomplete.
• Deletion — ask us to delete your personal data. We erase it within 30 days of verifying your request, subject only to the legal exceptions in Data deletion.
• Portability / export — receive your data in a portable format, and download your generated media.
• Objection and restriction — object to or restrict certain processing, including processing based on legitimate interests.
• Withdraw consent — withdraw consent for optional analytics, cookies, or marketing at any time.

To exercise any of these rights, email privacy@senova.studio. We will verify your request and respond within the timeframe required by applicable law. Exercising your rights will not lead to discriminatory treatment.

We honor Global Privacy Control (GPC) signals as a valid opt-out for applicable sharing and optional analytics. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

13. Children's privacy

Senova is not directed to children and is not intended for, and may not be used by, anyone under 18. You must be at least 18 years old to create an account or use Senova, consistent with our Terms of Service. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided us with personal data, contact privacy@senova.studio and we will delete it.

14. Changes to this policy

We may update this policy as the product, our subprocessors, or the law changes. When we make material changes, we will update the effective date and version at the top of this page and, where appropriate, notify you in the product or by email. Your continued use of Senova after an update means you accept the revised policy.

15. How to contact us

For any privacy question or to exercise your rights, contact us at privacy@senova.studio. We will route your request to the right team and respond as promptly as we can. The data controller for the personal data described in this policy is Senova Systems LLC, a New Jersey limited liability company.