Privacy Policy

Tova Studio is operated by Avada Tova Services, which is responsible for (the “data controller” of) the personal data described here. We follow the Kenya Data Protection Act, 2019, and the other data protection laws that apply to you.

• Account data: your name, email address and password. Passwords are stored only as a secure hash.
• Sign-in data: session records with your IP address and browser (user agent), used to keep you signed in and to protect your account.
• Your content: prompts, uploads, images, videos, music settings and lyrics, scripts, designs, games, assistant conversations and the project notes the assistant remembers, support tickets, and anything you add to Guilds, the Brief Board or your Passport.
• Usage and billing data: a record of each operation (type, credits, outcome, time), your credit balance, and your purchases (pack, amount, currency, status and the Paystack reference).
• Payment data: payments are handled by Paystack. We receive confirmation of the payment, its amount, currency, channel (e.g. card or M-Pesa) and reference. We never receive or store your full card number, PIN or mobile-money credentials.

• to provide the Service: create your account, run the tools you use, store your projects and deliver your outputs;
• to process payments, add credits, enforce spend limits and keep financial records;
• to send account emails: email verification, password resets and payment receipts;
• to keep the Service secure, prevent abuse and fraud, and fix problems;
• to answer your support requests;
• to meet our legal obligations.

Our legal bases are performing our contract with you, our legitimate interests in running a secure and reliable service, compliance with legal obligations and, where needed, your consent. We don't sell your personal data, and we don't use your content to show you advertising.

When you use an AI feature, the content needed for that request (for example your prompt, images or reference frames) is sent to the AI provider that powers it. Depending on the feature and our configuration, these may include OpenAI (images and text), Google Gemini (images, text and visual checks), Anthropic (text) and Kling AI (video).

These providers process the data to return a result, under their own terms and data processing commitments. Their policies may allow them to keep data for a limited time, for example for abuse monitoring. Don't include sensitive personal data in prompts unless it's necessary.

• Paystack: payment processing (your email address and the purchase amount).
• Resend: delivery of account and receipt emails.
• Cloudflare R2: storage of your files (private; accessed only through short-lived signed links).
• Vercel and Render: hosting of the website, the application server and the database.
• the AI providers listed above.

We may also disclose data when the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.

Your Passport is private until you publish it, and you choose which sections are shown. A public Passport never shows your email address. Games you list on the Game Store, and briefs and proposals on the Brief Board, are visible to others as described in the Service. Workspace members can see the projects in their shared workspace.

We use one essential cookie to keep you signed in. Your browser's local storage keeps unsaved drafts on your device. We don't use advertising or third-party analytics cookies. Paystack may set its own cookies on its checkout pages.

• Account data and content: while your account is open, and until you delete the content.
• Deleted projects and games: 30 days in the Recycle Bin, then permanently erased with their files (sooner if a workspace owner or admin erases them).
• Payment and billing records: as long as tax and accounting laws require, even after an account is closed.
• Sign-in sessions: until they expire or you sign out; password reset and verification links expire after 1 hour.
• Backups and server logs: for a limited period, after which they're overwritten.

We protect data with encrypted connections (HTTPS), hashed passwords, private file storage with expiring links, per-workspace access controls and limited staff access. No system is perfectly secure; if a breach affects your personal data, we'll notify you and the authorities as the law requires.

Our providers may process data outside Kenya, including in the United States and the European Union. When they do, we rely on safeguards the law recognizes, such as contractual protections and the providers' data processing terms.

Subject to the law, you can:

• access the personal data we hold about you and get a copy of it (your Passport also has a JSON download);
• correct inaccurate data;
• ask us to delete your data or close your account;
• object to or restrict some processing, and withdraw consent where we rely on it;
• receive your data in a portable format.

To use these rights, contact us through Support. We may need to verify your identity. If you're not satisfied with our answer, you can complain to the Office of the Data Protection Commissioner (Kenya) or your local data protection authority.

The Service is not for anyone under 18, and we don't knowingly collect their personal data. If you believe a child has given us data, contact us and we'll delete it.

We'll update the date at the top when this policy changes, and tell you in the Service or by email about significant changes.

For privacy questions or requests, contact Avada Tova Services through Support.