Who controls the data
NOVA VISION TECHNOLOGY CO., LIMITED, registered office RM 5058, 5/F, Yau Lee Centre, 45 Hoi Yuen Road, Kwun Tong, Hong Kong. Requests go to [email protected].
The data itself
Account email, workspace and key metadata, the prompts and any photos or lyrics you upload, generated files, billing events handed to us by the payment provider, and a tokenised fingerprint of each payment instrument attached to the account (never the card number itself). Two optional signals help keep per-person benefits per person: a random device identifier kept in your browser and a coarse hash of basic device attributes (browser family, platform, screen size, timezone, language). Both are created only after you accept the notice or start an account or trial, are never used for advertising or analytics, and are removed when you clear site data or delete the account. We do not store card details.
Why we hold it
To generate and deliver your files, to meter usage against your balance, to honour licences and identification codes, and to answer support requests.
Retention clock
Generated assets and uploads are kept for 30 days (7 days where the subject is a minor). Licence and identification-code records are kept while the code exists, because the code is the proof of the licence.
Lawful bases
Three different bases are in play, and they cover different things. Delivering the service you asked for — generation, delivery, licences, the credit balance — and the account checks that keep per-person benefits per person rest on performing our contract with you. Optional device signals on the public pages rest on your consent, which you can give, refuse or change at any time. Security logging and the keyed network hash rest on our legitimate interest in preventing abuse, balanced against the small amount of data involved and the short retention.
Your choice, and how to change it
The device signals are optional. Declining them never blocks the site, the editor or a purchase — everything keeps working, and only the signals stay switched off. The footer link “Device signals” brings the notice back so you can switch them on later, and clearing site data removes the stored choice along with the identifier.
Network signals
Request logs keep a truncated keyed hash of the connecting IP, never the address itself. The key rotates daily, so hashes from two different days cannot be joined into a long history of one visitor, and the hashes are deleted after 90 days. They are used only to rate-limit abuse and to link a sign-up to a dispute; they are never used for advertising or profiling.
Who processes it
Payments and tax are handled by our payment partner; generation and screening run on third-party processing services; hosting and delivery run on our infrastructure. Each processor sees only what its task requires.
Some of these processors operate outside your country, including in the United States. Where data is transferred across borders we rely on an appropriate transfer mechanism, such as the standard contractual clauses, together with the processor's security commitments.
If you are in Hong Kong
We handle personal data in line with the Personal Data (Privacy) Ordinance (Cap. 486). You may ask for a copy of the data we hold about you and for corrections, and we answer those requests within 40 days as the Ordinance requires. We do not use your data for direct marketing unless you have opted in, and you can withdraw that opt-in at any time without affecting your account. Our Hong Kong contact for personal data requests is the address on the contact page.
Your choices
Ask for a copy, correction or deletion of your account data through the contact page. Deletion removes assets; it does not revoke licences already granted, and it cannot remove an identification-code record that has been issued.