Privacy Notice

TVN Global Limited (trading as LUVI Creator), company number 15019980, registered office 82a James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom, is the controller of the personal data described in this notice. ICO registration number: ZC248767.

Questions and requests: privacy@luvicreator.com. You can also write to the address above, marked "Privacy".

This notice covers the website www.luvicreator.com, the LUVI web application, the LUVI connector for AI assistants (the "MCP connector"), LuviBot, our emails and our support channels (together, the "Services"). It applies under the UK General Data Protection Regulation and the Data Protection Act 2018 and, where you are in the European Economic Area, the EU GDPR.

Account data. Name, email address, password (stored only as a hash), profile picture and language preference; if you sign in with Google, the profile details Google shares with us (name, email, avatar, Google account identifier).

Content you submit ("Input"). Prompts, uploaded images, video, audio and other files, reference material, model settings, and messages you send to LuviBot. Input may contain personal data about you or others, including faces and voices. You are responsible for having the right to submit it.

Generated content ("Output"). The images, video, audio, 3D assets and text generated for you, stored in your library until you delete them.

Usage and technical data. Which models and features you use, credit spend, generation records (job identifier, model, timestamps, status, cost), storage use, folder and project structure, team membership, device and browser type, IP address, approximate location derived from IP, referring URL, and diagnostic logs including error reports.

Payment data. Purchase history, credit balance, invoices and plan status. Card details are collected and stored by Stripe, not by us; we receive only a payment token, the last four digits, card brand and billing country.

Communications. Support emails and messages, feedback and survey answers.

Analytics data. Only if you consent in the cookie banner: page views, clicks and product events sent to PostHog (see the Cookie Policy). Session recording is switched off.

We do not knowingly collect data from anyone under 18 and do not intentionally collect special category data. If your Input contains special category data (for example health information or biometric images of yourself), we process it only to provide the Services you requested.

We do not use your Input or Output to train AI models, and we do not sell personal data.

We use these processors and, where stated, independent controllers. Each is bound by a contract that meets UK GDPR Article 28.

Model inference — Atlas Cloud AI Inc. (New York, United States). Your prompts and uploaded media are sent to Atlas, which routes them to the third-party model you selected (providers currently include OpenAI, Google, ByteDance/BytePlus, Alibaba Cloud, xAI, MiniMax, Kuaishou, Black Forest Labs, ElevenLabs, Suno and others; the model page names the provider). Atlas states that it retains submitted content for up to 7 days for service delivery and abuse prevention and does not use it to train models. Each underlying provider applies its own retention and usage terms to content routed to it.

AI assistance — Anthropic (Claude models; LuviBot, prompt rewriting, captions), Google (Gemini models; LuviBot vision) and OpenAI (text embeddings for LuviBot search). Only the content needed for the feature you invoked is sent.

Hosting and database — Vercel (application hosting, Frankfurt region) and Supabase (Postgres database and authentication, Frankfurt, Germany).

Media storage and delivery — Amazon Web Services (S3 storage and CloudFront delivery, United States). Your uploads and Output are stored here, encrypted at rest, and served only to your browser through short-lived signed cookies.

Payments — Stripe (independent controller for payment processing and fraud prevention; see Stripe's privacy policy).

Email — Resend (transactional email delivery).

Analytics — PostHog (EU cloud, Frankfurt), only with your consent.

Sign-in — Google (independent controller if you choose Google sign-in).

AI assistants you connect through the MCP connector (for example Anthropic's Claude or OpenAI's ChatGPT) receive the data you ask them to act on and are controlled by their own providers under their own terms. You decide what to connect and can revoke it at any time.

Team members. If you join a team, the team leader and co-leaders can see the content in the team workspace, your name and email, and the team's credit spend.

Legal and corporate. Authorities where the law requires; professional advisers; a buyer or successor if the business is transferred, who must honour this notice.

Our database and application run in the European Union (Germany). Some processors are in the United States: Atlas Cloud AI and the model providers it routes to, Anthropic, OpenAI, Amazon Web Services (media storage) and Stripe.

For transfers to the United States we rely, in this order:

• on the UK Extension to the EU–US Data Privacy Framework (the "UK–US Data Bridge") where the recipient is certified under it, which the UK Government has recognised as providing adequate protection; and
• otherwise on the recipient's data processing agreement incorporating the EU Standard Contractual Clauses with the UK International Data Transfer Addendum approved by the Information Commissioner, together with our assessment of the transfer.

Where a recipient holds a Data Bridge certification, its agreement with us also contains the Standard Contractual Clauses as a fallback. You can ask privacy@luvicreator.com which mechanism applies to a given recipient and for a copy of the relevant safeguard.

We may keep data longer where needed to establish, exercise or defend legal claims, or where the law requires.

You have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased; restrict or object to processing based on legitimate interests; receive the data you provided in a portable format; withdraw consent at any time where processing is based on consent (this does not affect processing before withdrawal); and not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (we make no such decisions).

To exercise a right, email privacy@luvicreator.com from your account email. We will respond within one month, extendable by two months for complex requests, and may ask you to verify your identity. You can also download your Output from your library at any time, delete content yourself, and delete your whole account from the account page (deactivated at once, permanent after a 14-day grace period, after a double confirmation).

You have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). If you live in the EEA you may complain to your local supervisory authority. We would welcome the chance to address your concern first.

Model providers apply automated safety filters to prompts and generated content. A request that is refused by a filter is not charged. We do not profile you for advertising.

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted to staff who need it, protected by multi-factor authentication and logged. Media is served only through signed, short-lived credentials. We keep encrypted backups in a separate, write-protected store. No system is perfectly secure; if we discover a breach affecting your data we will notify you and the ICO as the law requires.

The Services are for adults. We do not knowingly process data of anyone under 18 and will delete it if we learn we have.

We will post changes here and update the date at the top. For material changes we will email you or show a notice in the Services before they take effect.

TVN Global Limited (trading as LUVI Creator), 82a James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom

privacy@luvicreator.com · Data protection lead: the Data Protection Lead, reachable at the same address. We are not required to appoint a Data Protection Officer and have not appointed one.