Legal
Privacy Policy
1. Who we are
Orvik ("we", "us") operates the Orvik platform — an AI production service for image, video, audio and voice, lip sync, face swap, try-on, avatars, workflows and agents, and brand conditioning ("Brand Brain"). For the personal data described in this policy, Orvik is the data controller. Contact for anything in this policy: privacy@orvik.ai.
2. What we collect and where it comes from
Data comes from three sources: what you give us, what the service records as you use it, and what our payment processor confirms to us.
- You provide: name, email address and authentication credentials; brand assets, reference images/video, voice samples, prompts and briefs; support and demo-request messages.
- Recorded in use: generation requests and outputs, credit consumption, model selections, session logs, device/browser type, IP address, and referrer — for operation, security, billing, and abuse prevention.
- From our payment processor: payment confirmation, plan, and billing country. We never store full card numbers.
3. How we use your data
- To provide, operate, and improve the Platform — including routing your generations to the right model.
- To send transactional email (generation complete, receipts, password reset, policy notices).
- To respond to demo requests and support inquiries.
- To meter credits, bill subscriptions, and keep tax records.
- To detect abuse, enforce rate limits, and protect the service and other users.
- To measure aggregate product performance (e.g. which model types produce outputs users keep) to improve quality for all users.
4. Lawful bases (EEA/UK)
Where GDPR or UK GDPR applies, we rely on:
- Contract — operating your account, running your generations, billing, support.
- Legitimate interests — service security, abuse prevention, aggregate product analytics; balanced against your rights, and you may object (section 11).
- Consent — marketing email (opt-in only) and analytics cookies where consent is required.
- Legal obligation — tax and accounting records, responses to lawful requests.
5. What we do not do
- We do not sell your data — ever, to anyone, and we do not "share" it for cross-context behavioural advertising as US state laws define that term.
- We do not use your uploads or outputs to train shared or public models. Brand Brain conditioning operates only inside your account's isolated environment.
- We do not send marketing email without consent, and every marketing email carries an unsubscribe link.
7. AI model providers and subprocessors
When your generation runs on a third-party model, the prompt and any assets attached to that generation are transmitted to the model provider to produce the output. Provider categories: AI model providers (image, video, audio, and speech generation), cloud infrastructure, payments, email delivery, and analytics.
Our supplier terms restrict model providers to processing your material to fulfil the request; they are not permitted to use it to train their models. Providers may process data in regions outside your own (section 9). Generation material is retained by us per section 10; provider-side transient processing is governed by our agreements with them.
8. Likeness, voice and biometric-adjacent data
Face swap, lip sync, avatars, try-on, and voice features process images, video, and audio of people. We process this material solely to fulfil the specific generation you request — we do not build face- or voice-recognition databases, and we do not use likeness data for identification.
You must have the consent of any real, identifiable person whose likeness or voice you upload (see the Terms, section 7). If you believe your likeness is being used on the Platform without consent, contact privacy@orvik.ai — reports of non-consensual intimate imagery are expedited.
9. International transfers
Our primary hosting is on Microsoft Azure in the Central India region. Some processors — including AI model providers, payments, email, and analytics — operate in other countries, including the United States. Where data moves across borders from a jurisdiction that restricts transfers, we rely on appropriate safeguards such as standard contractual clauses with the receiving processor.
10. Data retention
Account data is retained while your account is active and for up to 90 days after deletion, to allow for disputes or recovery. Generation logs are retained for up to 12 months for billing and debugging, then deleted. You may request earlier deletion (section 11).
Exceptions: encrypted backups age out on a rotation schedule after deletion from live systems; billing and tax records are kept as long as tax law requires; support correspondence is kept while relevant to the inquiry; and data under a legal hold is kept until the hold ends.
11. Your rights and how to use them
Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on it.
To exercise a right, email privacy@orvik.ai from your account email address — that is how we verify identity; if you cannot use that address we will ask for reasonable additional verification. Authorised agents may submit requests with proof of authorisation. We respond within 30 days. If we decline a request we will say why, and you may appeal by replying to the decision; you also have the right to complain to your supervisory or state authority (section 12).
12. Regional notices (EEA/UK and US states)
EEA/UK. You have the GDPR rights in section 11, including objection to legitimate-interest processing and the right to lodge a complaint with your local supervisory authority (or the UK ICO). Lawful bases are in section 4; transfers in section 9.
US states. Residents of states with comprehensive privacy laws (California and others) have rights of access, correction, deletion, and portability, and the right to opt out of "sale" or "sharing" — we do neither. We do not discriminate against you for exercising rights, and you may appeal a refused request as described in section 11.
13. Minors
The Platform is for users 18 and over (Terms, section 3). We do not knowingly collect personal data from children. If you believe a minor has provided us data, contact privacy@orvik.ai and we will delete it.
14. Automated decision-making
We use automated systems for abuse detection, rate limiting, and content moderation screening. No automated decision producing legal or similarly significant effects is made about you without a path to human review — moderation enforcement can be appealed to a human reviewer (Terms, section 13).
16. Security
All data is transmitted over HTTPS. Brand assets and outputs are stored with account-level access control. Credentials are stored hashed; API keys are treated as secrets. We follow industry-standard practices for securing infrastructure, and we notify affected users and authorities of personal-data breaches where the law requires.
17. Changes to this policy
We may update this policy as the product evolves. For material changes we will notify you by email before the effective date and publish a plain-language summary at /legal/updates. Previous versions remain available at /legal/archive.
18. Contact
Privacy questions and requests: privacy@orvik.ai. Legal: legal@orvik.ai.