Privacy Policy

The controller of your personal data is the private individual who runs Breyvi:

Name

Egor Pavlovschii

Postal address

not yet published

Email

novaworksup@gmail.com

Write to novaworksup@gmail.com about anything in this policy. We have not appointed a data protection officer, because the law does not require one for a service of this size.

• Account data — your first and last name, email address, and a password stored only as a secure hash by our sign-in provider; or, if you sign in with Google or GitHub, the name, email and profile picture address they send us.
• Your content — briefs, project titles and settings, files and photos you upload, and the scripts, voices, pictures, clips and videos made from them.
• Purchases and balance — which pack or plan you bought, when, your token balance and its ledger, and the customer reference Dodo Payments gives us. Dodo Payments also tells us the amount paid, its currency and the tax on it. We never see your card details.
• Generation records — each render's status, cost and progress, and the cost of each call to an AI provider, so that failed renders are refunded and spending stays within limits.
• Safety records — when an uploaded photo is refused by the automatic check: the account, the categories found and their scores. The refused photo itself is deleted.
• Device check — when you ask for your free first video, your browser computes a one-way code from characteristics of your device (how it draws a test image, its graphics card, time zone, languages, platform, number of processor cores, memory class, touch points and pixel ratio) and sends only that code. We key it again with a secret of ours and keep it with your token ledger, so that one device gets at most two free videos. Nothing is stored in your browser for this, and the code cannot be turned back into those characteristics.
• Optional answer — where you heard about Breyvi, if you choose to tell us after signing up.
• Technical data — IP address, date and time, the page or API requested and your browser's user agent, in the ordinary logs of our hosting providers.
• Visit statistics — for each page opened in a browser: which page, the site you came from (its name only), your country as our hosting provider determines it from your IP address, and a code computed from your IP address and browser with a key that changes every day. We do not store the IP address, and once the day's key is deleted at the end of that day, the code can no longer be linked to you or to your other visits.
• Partner links — if you open Breyvi from a partner's link (an address ending in ?ref= and a code), that code is kept with the visit statistics above and, if you sign up during that visit, with your account. Nothing is stored in your browser for this.

• To provide the service — your account, your projects, generating and storing your videos, crediting what you buy, and refunding what fails. Basis: performance of our contract with you (GDPR art. 6(1)(b)).
• To meet legal obligations — keeping purchase records as tax and accounting law requires, and answering lawful requests from authorities. Basis: legal obligation (art. 6(1)(c)).
• To keep the service safe and working — checking uploaded photos for illegal or sexual content, preventing fraud and abuse, enforcing our policies, keeping logs, and capping daily spending on AI providers. Basis: our legitimate interest in a secure, lawful and affordable service (art. 6(1)(f)).
• To understand how people find us — your optional answer about where you heard of Breyvi. Basis: your consent (art. 6(1)(a)), which you can withdraw at any time by writing to us.
• To count visits — how many people open which pages and where they come from, counted on our server without cookies and without storing anything in your browser. Basis: our legitimate interest in knowing how the site is used (art. 6(1)(f)). You can object at any time (art. 21) by writing to us.
• To pay our partners — how many visits, sign-ups and payments came through each partner's link, to work out what we owe them. A partner sees only these totals, never who you are. Basis: our legitimate interest in working with partners (art. 6(1)(f)). You can object at any time (art. 21) by writing to us.

You do not have to give us any personal data, but without an email address we cannot open an account, and without your content we cannot make a video. We do not sell your data, show advertising, or use it for profiling.

Only service providers who process data on our behalf and under our instructions, each for its own part of the service:

• Supabase — the database and sign-in, including the emails that confirm an address.
• Vercel — hosting of this website and its API.
• Railway — hosting of the render service that makes the videos.
• Cloudflare (R2) — private storage of uploads and finished videos.
• Anthropic — writes the script from your brief.
• OpenAI — draws the pictures, and checks uploaded photos for prohibited content.
• ElevenLabs — reads the narration aloud.
• fal.ai, Alibaba Cloud and, where configured, MiniMax — animate pictures and photos into video clips; through fal.ai the clips are made by models from Alibaba and Google.
• Dodo Payments — checkout, payment and tax, as merchant of record.
• Google and GitHub — only if you choose to sign in with them.

We disclose data to anyone else only where the law obliges us to, or to establish or defend legal claims.

Several of these providers are based in, or process data in, the United States or other countries outside the European Economic Area. Where such a country has no adequacy decision from the European Commission, the transfer is protected by the Commission's Standard Contractual Clauses; for US providers certified under the EU–US Data Privacy Framework, that adequacy decision applies. You can ask us for a copy of the safeguards at the address above.

• Account data, projects, uploads and videos: as long as your account exists. Deleting a project removes it from your account, while its uploads and rendered files stay in your private storage until the account is deleted; when you ask us to delete your account, we delete all of it within one month, the deadline the GDPR sets.
• Purchase and ledger records: as long as tax and accounting law requires them to be kept after the purchase.
• Safety records of refused photos: as long as the account exists, so that repeated abuse can be recognised.
• Device check codes: with the token ledger, as long as the account exists, so that the limit of two free videos per device holds.
• Generation and cost records: as long as the account exists, then only in a form that no longer identifies you.
• Server logs: for the short period our hosting providers keep them, after which they are deleted automatically.
• Visit statistics: thirteen months; the daily code can no longer be linked to anyone from the end of its day.

A photo uploaded to Just animate it is checked automatically by OpenAI's moderation service before anything is charged, and a photo it flags is refused. This decision concerns that one upload; it has no legal effect on you and does not affect your account by itself. If you think a photo was refused wrongly, write to us and a person will look at it. We make no other automated decisions about you.

We do not use your briefs, uploads or videos to train AI models, and we have not given any provider permission to do so. Providers receive what they need to make your video, through their business APIs, under data processing terms that bind them to our instructions.

Breyvi uses only the cookies and browser storage it needs to work — to keep you signed in and to remember your settings. There is no advertising and no tracking. Visits are counted on our server, without cookies and without storing anything in your browser. The full list is in the Cookie Policy.

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy (art. 15);
• have it corrected (art. 16) or erased (art. 17);
• restrict its processing (art. 18);
• receive it in a portable format (art. 20) — your projects can be exported at any time in Settings;
• object to processing based on our legitimate interests (art. 21);
• withdraw any consent you have given, at any time, without affecting what was done before (art. 7(3)).

To exercise them, write to novaworksup@gmail.com from the address your account uses. We answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work, or where you think the infringement took place.

Every connection is encrypted. Database rows are protected so that a session can read only its own account's data. Files are kept in a private bucket and reached only through links signed for a few minutes, after the session has been checked. Passwords are never stored in readable form.

Breyvi is not intended for anyone under 16, and we do not knowingly process their data. If you believe a child has created an account, write to us and we will delete it.

When this policy changes, the date at the top of the page changes with it. If a change widens what we collect or who receives it, we will tell you by email or in the studio before it takes effect.