Privacy Policy
1. Who We Are
Suvio is operated by Digitalstamp Holding LTD, a company registered in Bulgaria. We provide an AI prompt-engineering platform at suvio.io that helps creators craft optimized prompts for AI image and video generation platforms.
Data Controller:
Digitalstamp Holding LTD
Email: [email protected]
2. Information We Collect
Information you provide directly
- Email address — when you sign in via magic link or create an account
- Character lock definitions — names, descriptions, and visual attribute fields you create within the app to maintain character consistency across prompts
- Style preferences — your selections when using style presets or custom styling options
- Scene descriptions — the text you enter to describe scenes for prompt generation
Information collected automatically
- Account metadata — your subscription tier, prompt usage count (reset monthly), and account creation date
- Session data — a session token stored in a secure, HTTP-only cookie to keep you signed in
- Analytics data (with your consent) — if you accept analytics cookies, we collect anonymized usage data through Google Analytics 4, including pages visited, referral source, device type, browser type, and approximate geographic region (country/city level). This data is aggregated and cannot be used to identify you personally.
Information from third parties
- Google account data— if you sign in with Google, we receive your name, email address, and Google account ID from Google's OAuth service. We do not request access to your Google Drive, contacts, calendar, or any other Google service.
Information we do NOT collect
- Passwords — Suvio is entirely passwordless. We never store password hashes.
- Payment card details — all payment processing is handled by Stripe. Card numbers, CVVs, and billing addresses are collected and stored by Stripe, not by Suvio. We only store a Stripe Customer ID to link your account to your subscription.
- Precise location data — we do not collect GPS coordinates. Google Analytics may infer your approximate region from your IP address, but we do not store or process IP addresses ourselves.
- Advertising identifiers — we do not use advertising pixels, retargeting cookies, or advertising SDKs.
3. How We Use Your Information
We use the information we collect to:
- Provide the service — authenticate your account, generate AI prompts based on your input, enforce plan limits, and manage your subscription
- Process payments — communicate with Stripe to manage your subscription, process upgrades/downgrades, and handle billing
- Send transactional emails — deliver magic-link sign-in emails and critical account notifications (e.g., subscription changes). We do not send marketing emails.
- Analyze usage patterns (with your consent) — understand which features are used, how users navigate the site, and where we can improve. Analytics data is aggregated and not linked to your account.
- Maintain and improve the service — monitor system health, fix bugs, and improve prompt quality
We do not use your information for advertising, profiling, or automated decision-making that produces legal or similarly significant effects.
4. Legal Bases for Processing (GDPR Article 6)
| Purpose | Legal basis |
|---|---|
| Account authentication and session management | Performance of contract (Art. 6(1)(b)) |
| Prompt generation and character lock storage | Performance of contract (Art. 6(1)(b)) |
| Subscription management and payment processing | Performance of contract (Art. 6(1)(b)) |
| Transactional emails (magic links, account notifications) | Performance of contract (Art. 6(1)(b)) |
| Analytics (Google Analytics 4) | Consent (Art. 6(1)(a)) — only active if you accept analytics cookies |
| System monitoring and bug fixes | Legitimate interest (Art. 6(1)(f)) |
5. Third-Party Services
We share data with these third-party processors, only to the extent necessary to provide the service:
| Service | Purpose | Data shared | Location |
|---|---|---|---|
| Stripe | Payment processing | Email, Stripe Customer ID, subscription events | US (EU-US Data Privacy Framework) |
| OAuth authentication | Email, name, Google account ID (received from Google) | US (EU-US Data Privacy Framework) | |
| Google Analytics 4 | Website analytics (consent required) | Anonymized pageview data, device/browser info, approximate location | US (EU-US Data Privacy Framework) |
| Postmark (ActiveCampaign) | Transactional email | Email address, magic-link tokens | US |
| Hetzner | Server hosting | All service data (encrypted at rest and in transit) | Germany (EU) |
We do not sell, rent, or trade your personal data to any third party.
6. International Data Transfers
Our servers are hosted in the EU (Hetzner, Germany). Some third-party processors (Stripe, Google, Postmark) operate in the United States. These transfers are protected by:
- The EU-US Data Privacy Framework (for Stripe, Google, and Google Analytics — all certified participants)
- Standard Contractual Clauses (SCCs) where the Data Privacy Framework does not apply
7. Data Retention
- Account data (email, name, tier) — retained for as long as your account is active. Deleted within 30 days of account deletion.
- Prompt usage counts — reset monthly. Historical counts are not retained after the billing period.
- Character lock definitions — retained for as long as your account is active.
- Session tokens — expire automatically. Stale sessions are periodically purged.
- Stripe Customer ID — retained for as long as your subscription is active or as required for tax/legal records.
- Analytics data — Google Analytics retains data according to its own retention policies (default: 14 months). We do not store analytics data on our servers.
If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law (e.g., financial records for tax purposes).
8. Your Rights
Under the General Data Protection Regulation (GDPR), you have the following rights:
- Access — request a copy of the personal data we hold about you
- Rectification — request correction of inaccurate data
- Erasure— request deletion of your personal data ("right to be forgotten")
- Restriction — request that we limit how we process your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent— where processing is based on consent (e.g., analytics cookies), withdraw it at any time by clicking "Cookie Settings" in the site footer
To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with your national data protection authority. In Bulgaria, this is the Commission for Personal Data Protection (CPDP) at cpdp.bg.
9. Cookies
Suvio uses the following cookies:
Strictly necessary cookies (no consent required)
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie (NextAuth) | Maintains your authenticated session | Session / configured lifetime |
suvio_cookie_consent | Remembers your cookie preference | Persistent (localStorage) |
Analytics cookies (consent required)
| Cookie | Purpose | Duration | Set by |
|---|---|---|---|
_ga | Distinguishes unique visitors | 2 years | Google Analytics |
_ga_* | Maintains session state | 2 years | Google Analytics |
Analytics cookies are only set if you click "Accept" on the cookie consent banner. If you decline, Google Analytics operates in cookieless mode (limited, aggregated data only — no identifying cookies are placed on your device).
You can change your cookie preferences at any time by clicking "Cookie Settings" in the site footer.
10. Children's Privacy
Suvio is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it.
11. Security
We protect your data using:
- HTTPS/TLS encryption for all data in transit
- Encrypted database connections
- Passwordless authentication (no password hashes to breach)
- Database-backed sessions (not client-side tokens)
- Stripe-handled payment data (PCI DSS compliant — card data never touches our servers)
No system is perfectly secure. If we discover a data breach that affects your rights, we will notify you and the relevant supervisory authority as required by GDPR Article 33/34.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify you via email. Continued use of the service after changes constitutes acceptance of the updated policy.
13. Contact Us
For questions about this Privacy Policy or to exercise your data protection rights:
Email: [email protected]
Company: Digitalstamp Holding LTD
Country: Bulgaria, EU