CivonPrivacy Policy

Civon Privacy Policy

Effective date: 2026-10-18

This Policy explains how Civon handles personal data when you use civon.ai and related services.

1. Data we collect

  • Account data, when you use an account: Google subject identifier, email address, display name, avatar, and authentication timestamps.
  • Creative content: uploaded images, prompts, generation settings, generated images and videos, generated audio where supported, thumbnails, and technical task events.
  • Payment data: Stripe customer, subscription, checkout, invoice, payment, refund, and dispute identifiers. We do not store complete card numbers.
  • Credit and usage data: grants, purchases, spends, refunds, balances, model choices, task status, and creation-retention tier.
  • Device and security data: a pseudonymous browser identifier, security cookies, hashed or HMAC-protected network identifiers, coarse request metadata, risk events, and audit records. We avoid storing raw IP addresses in application audit records.
  • Support data: messages and information you provide when requesting assistance.
  • Usage and analytics data: pages viewed, referral and campaign information, browser and device characteristics, approximate location, and selected product interactions measured through Google Analytics when it is enabled. We do not enable PostHog analytics.

2. Why we process data

We process data only for the purposes needed to provide and protect the Service:

  • Create images and videos: use uploaded reference images, prompts, and selected settings to submit and complete image-editing and image-to-video tasks and return the requested outputs, including generated audio where supported.
  • Store and deliver results: keep source and generated media privately for the applicable retention period, create thumbnails, show your history, and provide authorized previews or downloads.
  • Security and abuse prevention: validate uploads, enforce credit and rate limits, detect fraud or misuse, protect accounts and infrastructure, investigate incidents, and keep security and audit records.
  • Support and necessary service operations: respond to support requests, process payments and account changes, troubleshoot failures, monitor reliability, improve the user-visible Service, and comply with legal obligations.

We do not use your uploaded images or prompts for advertising or to build a personal advertising profile. We do not sell creative content.

Our legal bases, where applicable, include performing our contract with you, legitimate interests in security, service operation, and product measurement, legal obligations, and other lawful bases available under applicable law.

3. Service providers and AI processing

We disclose only the data needed for a provider's role. Provider categories include Google for authentication and traffic and product analytics, Kie for configured image-editing and video-generation requests, SeeAPI for configured content moderation of prompts and necessary image or video review frames, Cloudflare for Pages hosting, network protection, and private object storage, Stripe for billing, Resend for transactional email, and Sentry for redacted error monitoring. Providers may process data in other countries under their own contractual and legal safeguards.

For image-to-video tasks, the configured AI processing service receives the source image, prompt, and settings needed to generate the clip, including audio where supported. Generated video and related media are processed to provide private playback, thumbnails, and downloads. Data handling for each model is subject to the selected provider's applicable terms.

For image editing, the configured AI processing service receives the reference images, prompt, and settings required to perform the requested task. The selected provider's terms govern its processing, retention, and any use of data for model improvement. Review those terms before submitting confidential content. Provider-side handling is separate from Civon's retention periods below.

Do not upload sensitive personal data or content you are not authorized to process. Your use of generated results may also be subject to applicable law, third-party rights, and the terms that apply to the selected model.

4. Retention

  • Guest tasks and results, and account tasks created with auto-save off, are retained for up to 24 hours from task creation.
  • Your browser keeps up to eight recent tasks per tool for 24 hours from task creation. These local records contain task metadata and result-access details, not copies of the video files. Browser records and server-stored media have separate retention clocks.
  • Free accounts retain up to 60 saved creations for 7 days.
  • Buying a Credit Pack does not change the account plan, creation limit, or retention period.
  • Pro subscribers retain up to 600 creations for 30 days.
  • Ultra subscribers retain up to 1,000 creations for 90 days.
  • Daily check-in Free Credits expire at the next UTC 00:00. Referral Free Credits expire one year after grant. Subscription credit lots expire at the monthly refresh. Credit Pack and administrator-granted Premium credit lots expire one year after grant.
  • Transaction, ledger, security, fraud, and immutable operator-audit records may be retained longer when needed for tax, accounting, disputes, security, or legal obligations.

When you manually delete a creation, it immediately enters an asynchronous physical-deletion queue. Signed download URLs are short-lived.

Unexpired guest tasks and results linked to an account keep their original expiry and are not added to My Creations. Linking does not extend their retention period. New account tasks follow the auto-save setting; the account limits above apply to saved creations. Files already downloaded to your device are not removed by our retention process.

Our retention periods describe media stored by Civon. Provider-side retention follows the selected provider's policy and may differ from Civon's storage-retention schedule.

5. Account deletion

You can request deletion on the Account page after recent Google verification. Access and new generation are disabled immediately; active subscription renewal is canceled; media is queued for deletion; and profile data is scheduled for anonymization after 30 days. Login identities and credentials are removed during anonymization. Payment and audit records may remain with personal profile fields detached when retention is legally or operationally required.

6. Cookies and analytics

Strictly necessary cookies keep sessions secure, prevent cross-site request forgery, and enforce guest-credit limits. Browser storage also keeps recent task metadata and result-access details on your device for the limited period described above. Google Analytics may use first-party cookies or similar browser storage to measure site visits and product interactions. We do not send uploaded images, generated media, prompts, email addresses, or private media URLs to Google Analytics. Browser privacy settings or content blockers may limit analytics collection.

7. Security

We use encrypted transport, private object storage, short-lived signed URLs, restricted operator access, append-only mutation audits, secrets management, rate limits, and redaction of prompts, tokens, cookies, raw network identifiers, and credentials from routine logs and error reports. No system is completely secure.

8. Your rights

Depending on where you live, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. You may also complain to your local data-protection authority. Email [email protected]; if you use an account, write from its email address when possible. Guests can include a task ID and approximate time without sharing private media links or result-access tokens. We may need to verify your identity. Some records cannot be deleted immediately where law or fraud-prevention needs require retention.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. Contact us if you believe a minor has used the Service.

10. Changes and contact

We may update this Policy and will post the revised effective date. Privacy questions and requests: [email protected].