Privacy Policy

1. Who we are

Novaali is the controller of your personal data. Contact us about privacy at privacy@novaali.shop.

2. Data we collect

• Account data: email address, name (optional) and login details.
• Photos you upload and the images we generate from them.
• Purchase data: plan, amount, date and billing country. Card and PayPal details are collected directly by Stripe or PayPal; we only receive a token and the last four digits.
• Support data: messages you send us.
• Technical data: IP address, device and browser type, and logs needed to run and secure the Service.
• Cookies: see our Cookie Policy.

3. Photos and face data

Your uploaded photo is sent to our AI image processing provider only to create the images you request. We do not use facial recognition to identify you, and we do not create or keep face templates, faceprints or other biometric identifiers. Your photos and results are never sold, shared for advertising or used to train AI models.

• Original uploads are automatically and permanently deleted within 24 hours.
• Generated images are stored for 30 days so you can download them, then permanently deleted. You can delete them sooner at any time.
• Before uploading you confirm that you are 18+ and that you are the person pictured or have their permission.

If you live in Illinois, Texas, Washington or another place with biometric privacy laws: we do not collect biometric identifiers or biometric information as defined by those laws. If this ever changes, we will ask for your written consent first and publish a retention and destruction schedule.

4. How we use data and legal bases

• To provide the Service and your purchases (performance of a contract).
• To process photos you upload (your consent, given at upload, and performance of a contract).
• To handle payments, prevent fraud and meet tax and accounting duties (legal obligation and legitimate interests).
• To answer support requests and send service emails such as receipts and renewal reminders (contract).
• To improve the website with analytics, only if you accept analytics cookies (consent).
• To enforce our Terms and Acceptable Use Policy and keep the Service safe (legitimate interests).

We do not send marketing emails unless you opt in, and you can unsubscribe at any time.

5. Who we share data with

We share personal data only with service providers who process it on our behalf under contract:

• Hosting and infrastructure providers (for example, Vercel).
• AI image processing providers, which receive only the photo and style instructions needed for a generation.
• Payment processors: Stripe and PayPal.
• Email and customer support tools.
• Analytics providers, only with your consent.

We may also disclose data if required by law or to protect rights and safety. We do not sell or share personal information for cross-context behavioral advertising, as those terms are defined under California law.

6. International transfers

Our providers may process data in the United States and other countries. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

7. Retention

• Uploads: up to 24 hours. Generated images: 30 days or until you delete them.
• Account data: while your account is open, and deleted within 30 days after you close it.
• Purchase records: as long as required by tax and accounting law (typically up to 7 years).
• Records of your consent to subscription renewal terms: at least 3 years, as required by law.

8. Your rights

Depending on where you live (including under the GDPR, UK GDPR and California CCPA/CPRA), you may have the right to access, correct, delete or port your data, to object to or restrict processing, to withdraw consent at any time and to not be discriminated against for exercising your rights. To make a request, email privacy@novaali.shop. We respond within 30 days and may need to verify your identity. You can also complain to your local data protection authority.

9. Children

The Service is only for people aged 18 and over and is not directed to children under 13. We do not knowingly collect data from children. If we learn that we have, or that a photo of a minor was uploaded, we delete it promptly. Contact us if you believe this has happened.

10. Security

We use encryption in transit (HTTPS), access controls, and automatic deletion to protect your data. No system is perfectly secure, but we work to protect your information and will notify you of a breach where required by law.

11. Changes

We will post any changes here and update the date above. Material changes will be notified by email or on the website.