Last updated: July 2026
UOVA, Inc. and its affiliated companies (together: "UOVA", "us", or "we") are dedicated to providing users with the highest level of transparency and control over the use of their information. In order for us to provide you with our Services, we are required to collect and process certain personal information about you and your activity. By entrusting us with your information, we would like to assure you of our commitment to keep such information private. We have taken measurable steps to protect the confidentiality, security, and integrity of this information.
When you use our Services, you consent to the collection, storage, use, disclosure, and other uses of your Personal Data as described in this Privacy Policy. We urge you to read this Privacy Policy carefully and make sure that you fully understand and agree to it. If you do not agree to this Privacy Policy, please discontinue and avoid using our Services.
This Privacy Policy does not apply to the practices of third parties that UOVA does not own or control, or to individuals that UOVA does not employ or manage.
You are not legally required to provide us with your "Personal Data" (meaning any information which may potentially allow your identification with reasonable means), but without it we might not be able to provide you with the full range of, or the best experience while using our website(s), mobile application(s), or any other affiliated service (together, the "Services").
Processing of Personal Data is necessary for the performance of our contractual obligations towards you, for provision and operation of our Services, to protect our legitimate interests, and for compliance with legal and regulatory obligations to which we are subject.
In the course of using the Service, we may ask you to provide us with certain Personal Data to provide and improve the Service, to contact or identify you, to enable you to access certain parts of the Service, and as otherwise indicated in this Policy. We collect the following Personal Data about you:
Registration Information — When you sign up to use our Services, we will collect your name, your email address, and other information you provide during the registration process, including information about your company and your position.
Payment Information — We process your payment details via our payment processing provider, Stripe. We do not retain your payment information but only a pseudonymized "token" thereof, or a reduced amount of such payment details which is received from our payment processors.
Account Information — Information you voluntarily provide via contact forms, support channels, surveys, or other forms of communication with us.
Usage Data — Information about how you interact with our Service, including pages visited, features used, actions taken, time spent on pages, AI prompts submitted, projects created, and other behavioral data.
Device and Technical Data — Internet Protocol (IP) address, browser type and version, operating system, device type, screen resolution, unique device identifiers, referring URL, and access times.
Content Data — The content you create, upload, generate, or publish through the Service, including website designs, AI prompts, AI-generated images and videos, text content, and media assets.
Communication Data — Records of communications between you and UOVA, including support tickets, emails, chat messages through our in-app chat (powered by Crisp), and feedback you provide.
Third-Party Sign-In Data — If you sign in using a third-party provider (e.g., Google, GitHub), we receive certain information from that provider, such as your name, email address, and profile picture, as authorized by your privacy settings with the third-party provider.
When you visit or access our Services or interact with our electronic communications (such as emails or newsletters), we use (and authorize 3rd parties to use) pixels, cookies, events, unique tracking links, and other technologies (collectively, "Tracking Technologies"). Those allow us to automatically collect information about you, your device, and your online behavior, in order to enhance your navigation in our Services, improve our Services' performance, perform analytics, and customize your experience.
On our own marketing and application surfaces, non-essential analytics and advertising technologies load only after you accept them through our cookie consent banner. If you reject or do not accept, these technologies are not loaded. Essential cookies (needed for the Service to function) are always active.
Analytics — We use Google Analytics and Vercel Analytics to understand how visitors use our Service, such as how often users visit, which pages they view, and how they navigate the site. We use this information to improve our Services.
Advertising / Meta Pixel — Subject to your consent, we use the Meta (Facebook) Pixel to measure the effectiveness of our advertising and to understand actions visitors take on our site (for example, completing registration or a purchase). This involves sharing certain event and identifier information with Meta, which may use it for cross-context behavioral advertising and to build audiences. You can control this through our consent banner and your privacy choices (see the California section and "Your Privacy Choices" below).
Error and Performance Monitoring — We use Sentry to detect and diagnose errors and to monitor performance. We configure Sentry to scrub personal data such as IP addresses and email addresses from error reports.
On websites and stores that our users publish, tracking behavior is controlled by the site owner, who is the data controller for their visitors; UOVA does not place its own analytics on published customer sites.
For more detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.
We use your Personal Data for the following purposes:
Provision of service — We will use your Personal Data for the provision of our Services, including for support and to respond to your queries.
Improvement of our services — We are constantly looking for ways to improve our Services and we may analyze information on user profiles and insights of how users interact with our Services, e.g., the type of social media channels and the type of business they are active in, how our Assets are used, and how they are perceived when published in content on social media platforms or other media channels.
Service announcements — We will use your Personal Data to communicate with you and to keep you informed of our latest updates to our Services and offer you service offers.
Service customization — We will use your Personal Data in order to customize the Services, including the content offered through them, to your needs and preferences, so that the Services and your experience of using them will be optimal.
Marketing purposes — We may use your Personal Data (such as your email address or phone number) for marketing purposes. This may include using tracking technologies within our emails to monitor your engagement. For example, our users will receive promotional materials concerning our Services or our partners' services, including tips and announcements straight to their email account.
Analytics and research — We use aggregated and anonymized data to conduct research and analytics about usage patterns, platform performance, and to develop new features and services.
Legal and compliance — We may use your Personal Data to comply with applicable laws and regulations, to respond to legal process, to enforce our Terms of Service, and to protect the rights, property, and safety of UOVA, our users, and the public.
Opt-out of receiving marketing materials: You may choose not to receive our promotional or marketing emails (all or any part thereof) by clicking on the "unsubscribe" link in the emails you receive from us. Please note that even if you unsubscribe from our promotional or marketing emails, we may continue to send you service-related communications.
Under the General Data Protection Regulation (GDPR) and similar laws, we are required to identify the legal basis for processing your Personal Data. Below is a summary of the purposes for which we process your data and the corresponding legal basis:
| Purpose/Activity | Type of Data | Lawful Basis for Processing |
|---|---|---|
| Registration and Account Setup | Registration information (name, email address, company information, job position) Payment details (pseudonymized token received from payment processors) | Performance of a contract Necessary to create and maintain your account and process payments |
| Customer Communication and Support | Information provided voluntarily (via contact forms, e-mail, support channels) Survey responses and additional profile information | Performance of a contract We may contact you when responding to inquiries, providing support, to facilitate your use of the services |
| Purchase Facilitation | Transaction information Account details | Performance of a contract Necessary to facilitate your purchases and provide you the purchased content |
| Newsletter and Marketing Communications | Email address URLs of media created by you | Legitimate interest Used for sending newsletters or marketing emails to promote our Services |
| Website Usage Analytics | Usage data Device and technical data Cookies and tracking technologies | Legitimate interest To improve our Services and understand how users interact with our platform |
| AI Content Generation | AI prompts Generated content metadata | Performance of a contract Necessary to provide AI Studio features as part of the Service |
| Legal Compliance | Any relevant personal data | Legal obligation Necessary to comply with applicable laws and regulations |
We share your Personal Data with third parties (or otherwise allow them access to it) only in the following circumstances:
Service Providers — We engage selected third-party companies and individuals to perform services complementary to our own. These service providers have access to your Personal Data only to perform these tasks on our behalf and are contractually obligated not to disclose or use it for any other purpose.
Our key service providers include:
| Provider | Service | Data Processed |
|---|---|---|
| Supabase | Authentication, database, and storage | Account data, user content, project data |
| Stripe (incl. Stripe Connect) | Payment processing and merchant payouts | Payment information (tokenized), transaction records, merchant onboarding data |
| Vercel (incl. Vercel AI Gateway) | Hosting, CDN, analytics, and AI model routing | Published website content, analytics data, AI prompts |
| Anthropic | AI text and site generation, image analysis | AI prompts, uploaded images, generated content metadata |
| OpenAI | AI text generation (fallback) | AI prompts, generation metadata |
| AI image generation (Imagen) and website analytics | AI prompts, usage data, device data | |
| fal.ai (and its model providers, e.g. Google Veo, Kling, MiniMax) | AI image and video generation | AI prompts, uploaded images, generation metadata |
| Replicate | AI image and video generation (fallback) | AI prompts, generation metadata |
| Higgsfield | AI image and video generation | AI prompts, uploaded images, generation metadata |
| Meta Platforms | Advertising measurement (Meta Pixel) — with consent | Event data and identifiers for advertising |
| Crisp | In-app customer support chat | Chat messages, email address, name |
| Sentry | Error tracking and performance monitoring | Technical error data (PII scrubbed) |
| Cloudflare (incl. Turnstile) | CDN, DNS, DDoS protection, and bot/abuse prevention | IP addresses, request metadata |
| Upstash | Rate limiting and abuse prevention | IP-derived identifiers (transient) |
| Resend | Transactional and marketing email delivery | Email addresses, email content, engagement events |
| OpenSRS / Tucows | Domain registration and transfer | Domain registrant contact data (name, address, email, phone) |
Business Transfers — In the event of a merger, acquisition, bankruptcy, or sale of all or a portion of our assets, your Personal Data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Service of any change in ownership or uses of your Personal Data.
Law Enforcement — We may disclose your Personal Data to law enforcement agencies, government authorities, or other third parties if we believe in good faith that such disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or governmental request; (b) enforce our Terms of Service; (c) protect the rights, property, or safety of UOVA, our users, or the public; or (d) detect, prevent, or address fraud, security, or technical issues.
With Your Consent — We may share your Personal Data with third parties when you have given us explicit consent to do so.
We do not sell your Personal Data for money. However, our use of advertising technologies such as the Meta Pixel (which you control through our consent banner) may be considered "selling" or "sharing" of Personal Information for cross-context behavioral advertising under certain U.S. state privacy laws. See the California section and "Your Privacy Choices" below for how to opt out, and note that we honor the Global Privacy Control (GPC) signal.
UOVA is based in the United States. If you are accessing the Service from outside the United States, please be aware that your Personal Data may be transferred to, stored, and processed in the United States and other countries where our service providers operate.
For transfers of Personal Data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States or other countries that are not recognized as providing an adequate level of data protection, we rely on the following transfer mechanisms:
You have the right to request a copy of the safeguards used for international data transfers by contacting us at privacy@uova.io.
We implement appropriate technical and organizational security measures to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include, as applicable, measures such as:
While we take reasonable measures to protect your Personal Data, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.
We retain your Personal Data for as long as your account is active or as needed to provide you with the Service. We may also retain and use your data as necessary to comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements.
Specific retention periods:
Upon account deletion, we will delete or anonymize your Personal Data within 30 days, except where retention is required by law or for legitimate business purposes as described above. Backup copies may persist for up to 90 days before being purged.
If you are a resident of the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):
Right of Access — You have the right to request a copy of the Personal Data we hold about you.
Right to Rectification — You have the right to request that we correct any inaccurate or incomplete Personal Data.
Right to Erasure — You have the right to request that we delete your Personal Data, subject to certain exceptions (e.g., legal obligations, ongoing disputes).
Right to Restrict Processing — You have the right to request that we restrict the processing of your Personal Data in certain circumstances.
Right to Data Portability — You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
Right to Object — You have the right to object to the processing of your Personal Data for direct marketing purposes or where processing is based on our legitimate interests.
Right to Withdraw Consent — Where processing is based on your consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Right to Lodge a Complaint — You have the right to lodge a complaint with a supervisory authority in your country of residence if you believe that our processing of your Personal Data violates applicable data protection laws.
To exercise any of these rights, please contact us at privacy@uova.io. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.
UOVA, Inc. is established in the United States. Where we are required to designate a representative in the European Union under Article 27 of the GDPR, or in the United Kingdom under the UK GDPR, our appointed representative acts as a point of contact for data-protection authorities and data subjects on matters relating to our processing of EEA/UK personal data.
To reach our EU or UK representative, or if you cannot locate their current details, contact us at dpo@uova.io and we will provide the representative's name and address. You also have the right to lodge a complaint with your local data-protection supervisory authority.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
Right to Know — You have the right to request that we disclose what Personal Information we collect, use, disclose, and sell about you.
Right to Delete — You have the right to request that we delete your Personal Information, subject to certain exceptions.
Right to Correct — You have the right to request that we correct inaccurate Personal Information about you.
Right to Opt-Out of Sale/Sharing — We do not sell your Personal Information for money. However, when you consent to advertising technologies such as the Meta Pixel, the associated sharing of event data and identifiers with advertising partners may constitute "selling" or "sharing" for cross-context behavioral advertising under the CPRA and similar laws. You have the right to opt out. To opt out, do not accept (or withdraw acceptance in) our cookie consent banner, use the "Your Privacy Choices" mechanism described below, or email privacy@uova.io.
Global Privacy Control (GPC) — We honor the Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale or sharing of your Personal Information where required by applicable law, including in California, Colorado, and Connecticut.
Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA/CPRA rights.
Right to Limit Sensitive Personal Information — You have the right to limit the use and disclosure of your sensitive personal information.
Categories of Personal Information collected in the preceding 12 months:
Your Privacy Choices — To opt out of the sale or sharing of your Personal Information for cross-context behavioral advertising, you may (a) decline or withdraw consent in our cookie banner, (b) enable the Global Privacy Control (GPC) in a supported browser, or (c) email privacy@uova.io with the subject "Do Not Sell or Share." To access, delete, or export your account data, use the Export data and Delete account controls in your account settings, or contact privacy@uova.io.
To exercise your rights, contact us at privacy@uova.io or use the privacy controls in your account settings. We will verify your identity before processing requests. Authorized agents may submit requests on your behalf with proper documentation.
If you are a resident of a U.S. state with a comprehensive consumer privacy law — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and a growing number of other states — you may have rights similar to those described in the California section above, which may include the rights to: confirm whether we process your personal data and to access it; correct inaccuracies; delete personal data; obtain a portable copy; and opt out of (a) targeted advertising, (b) the sale of personal data, and (c) certain profiling in furtherance of decisions that produce legal or similarly significant effects.
To exercise these rights, contact us at privacy@uova.io or use the mechanisms described in "Your Privacy Choices" above, including our cookie banner and the Global Privacy Control (GPC) signal, which we honor as an opt-out of targeted advertising and the sale/sharing of personal data where required by law. We will respond within the timeframe required by applicable law. If we deny your request, you may appeal by replying to our response or emailing privacy@uova.io with the subject "Privacy Appeal"; where available, you may also contact your state Attorney General.
If you are in Canada, we handle your personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25.
Your Rights — You may request access to and correction of your personal information, withdraw consent (subject to legal or contractual restrictions), and, where applicable under Quebec Law 25, request that your personal information be de-indexed or provided to you in a structured, commonly used technological format (data portability). To exercise these rights, contact us at privacy@uova.io.
Consent — We collect, use, and disclose personal information with your consent (express or implied, as appropriate to the sensitivity of the information) or as otherwise permitted or required by law. You may withdraw consent at any time, subject to legal and contractual limits, on reasonable notice.
Privacy Officer — We have designated a person responsible for the protection of personal information (privacy officer). You may contact them at privacy@uova.io or dpo@uova.io. If you have a concern we cannot resolve, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
Cross-Border Transfers — Your personal information may be stored and processed in the United States and other countries by us and our service providers, where it may be accessible to courts, law-enforcement, and authorities under those countries' laws. We use contractual and other safeguards for such transfers. By using the Service, you acknowledge this transfer and processing outside Canada.
Breach Reporting — Where a breach of security safeguards creates a real risk of significant harm, we will report to and record the breach as required by PIPEDA and applicable provincial law, and notify affected individuals.
Electronic Messages (CASL) — Commercial electronic messages we send to Canadian recipients comply with Canada's Anti-Spam Legislation (CASL): we send them with the required consent (express or implied), identify ourselves, and include a working unsubscribe mechanism that we honor promptly.
Some laws treat certain categories of data as sensitive (for example, precise geolocation, government identifiers, account credentials, and biometric data). We do not seek to collect sensitive personal information except as necessary to provide a feature you request. Where we process biometric or face/voice data for optional AI features, we do so as described in the "Biometric and Face/Voice Data" section, and only with your consent. We do not use or disclose sensitive personal information for purposes other than those permitted under applicable law, and, where required, we offer you the right to limit its use.
We do not use your personal data to make decisions that produce legal or similarly significant effects about you solely by automated means without human involvement. We use automated processing for functions such as fraud and abuse prevention, rate limiting, spam filtering, security, and to generate content or recommendations at your request. Where automated processing would be subject to specific rights under applicable law, we will honor those rights; you may contact us at privacy@uova.io with questions or to object where you have the right to do so.
You can control the marketing communications you receive from us:
Email — Every marketing or promotional email includes an unsubscribe link and one-click list-unsubscribe. Clicking it stops future marketing emails. You will still receive essential service and transactional messages (such as receipts, security notices, and legal notices).
Text / SMS — Where we send text messages with your consent, you can opt out by replying STOP (or as described in the message). Message and data rates may apply. We handle telephone contact consistent with the Telephone Consumer Protection Act (TCPA) and applicable law.
Cookies and Advertising — Use our cookie banner, your browser's Global Privacy Control (GPC) signal, or the "Your Privacy Choices" mechanism to decline analytics and advertising technologies such as the Meta Pixel.
We may create de-identified or aggregated data that cannot reasonably be used to identify you (for example, statistical or usage insights) and may use and disclose such data for any lawful purpose, including to operate, analyze, and improve the Service. Where we maintain de-identified data, we commit to maintaining and using it in de-identified form and not to attempt to re-identify it, except as permitted by law to test our de-identification.
The Service may contain links to third-party websites and services, and hosts websites and stores created by our users. This Privacy Policy does not apply to third-party sites or to the sites and stores that our users publish. When you visit a website or store built by a UOVA user, that user (the site owner) is the controller responsible for how your data is handled on their site, and their own privacy notice applies. We encourage you to review the privacy policies of any third-party site or user-published site you visit.
The Service is not directed to children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect Personal Data from children under these age thresholds.
If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us at privacy@uova.io. If we become aware that we have collected Personal Data from children without verification of parental consent, we will take steps to remove that information from our servers within a reasonable time.
When you use our AI Studio features, the following data practices apply:
AI Prompts and Inputs — Your text prompts, and any images or media you provide to AI features, are sent to third-party AI model providers for processing. These providers currently include Anthropic (via the Vercel AI Gateway), OpenAI, Google, fal.ai (and its downstream model providers such as Google Veo, Kling, and MiniMax), Replicate, and Higgsfield. Our current AI sub-processor list is maintained in the "With Whom Do We Share Your Personal Data?" section above and in our Data Processing Agreement, and may change over time.
Generated Content — AI-generated images and videos are stored on our servers and associated with your account. They are not shared publicly unless you choose to publish them.
Prompt History — We retain your prompt history for 90 days to enable features like regeneration and history browsing. After 90 days, prompts are permanently deleted.
No Training — We do not use your prompts, generated content, or other User Content to train, fine-tune, or improve our own AI models, and we configure our AI providers not to train on your inputs where such controls are offered. Third-party providers may retain inputs temporarily for abuse monitoring in accordance with their own policies.
We recommend that you do not include Personal Data (such as real names, addresses, or other identifying information) in your AI prompts. We are not responsible for any Personal Data included in AI prompts or outputs.
Some optional AI features — such as face animation or voice cloning — process content you provide that contains faces or voices. Depending on how these features work, this processing may involve biometric identifiers or biometric information (such as a facial geometry scan or a voiceprint), which are treated as sensitive/special-category data under laws including the Illinois Biometric Information Privacy Act (BIPA) and Article 9 of the GDPR.
Consent — We process face or voice data derived from your uploads only where you have enabled the relevant feature and provided the required consent. You should only upload content containing faces or voices for which you have the necessary rights and consents from the individuals depicted.
Purpose — We use this data solely to provide the feature you requested (for example, generating an animation or synthetic voice from your input). We do not use it to identify individuals, and we do not sell biometric data or disclose it except to the AI sub-processors listed in this Policy strictly to provide the feature, or as required by law.
Retention — Biometric identifiers and biometric information are retained only as long as needed to provide the requested feature and are deleted when the underlying content or your account is deleted, and in any event within the timeframe required by applicable law (and, for BIPA, no later than three years after your last interaction with us).
Your Choices — You can decline these features and can request deletion of associated content at any time by contacting privacy@uova.io. Where required, we obtain separate, explicit consent before any such processing.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you by email or through a prominent notice on the Service at least thirty (30) days before the changes take effect.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
We will respond to all inquiries within 30 days.