Privacy Policy

This policy explains what personal data Holovey.ai collects, why, and what rights you have. The data controller is Ramon Meyer, Holovey.ai (sole proprietorship), Buechstrasse, 5436 Würenlos, Switzerland, UID CHE-376.031.017, email support@holovey.ai. We follow the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). We do not sell your personal data.

1. Data we collect

• Account data: your email address, name and profile picture as provided by Google when you sign in with Google, or your email address when you sign in by email link.
• Content you create: product photos and reference images you upload, scripts and prompts you write, ads you upload for analysis, the avatars, voices, images and videos generated for you, and the settings used (including your brand name, website and defaults).
• Usage and billing data: your credit balance and history, generations started, plan, and payment status. Card details are handled by Stripe and never stored by us.
• Technical data: server logs with IP address, browser type and timestamps, kept for security and troubleshooting.
• Messages: what you write to us by email.

2. Why we use it, and the legal basis

• To provide the Service: creating your account, generating content, storing your library, charging credits (contract performance).
• To bill you and comply with accounting and tax obligations (legal obligation).
• To keep the Service secure, prevent abuse and enforce our terms, including checks of prompts and uploads for prohibited content (legitimate interest).
• To send service emails such as sign-in links and important account notices (contract performance). Marketing emails are sent only with your consent, and you can opt out at any time.
• To process the face or voice of a real person that you upload for an avatar (consent, which you confirm when you upload; see section 4).

3. Who processes your data

We use the following service providers (processors). Each receives only what is needed for its task:

• Supabase (database, file storage and sign-in), servers in the EU (Ireland).
• Google (Sign in with Google; Gemini models for image generation, for analysing an uploaded ad and for writing scripts).
• fal.ai, ByteDance / BytePlus and ElevenLabs (AI image, video and voice generation). They receive your prompts, uploaded images and scripts for the generation you request.
• Stripe (payments).
• Vercel (hosting of the website).

We use their programming interfaces (APIs) and not their consumer apps. The terms and privacy policies of each provider apply to what they do with the data you send. Some of these providers are located in the United States. Transfers are covered by standard contractual clauses or an adequacy decision (Swiss-US Data Privacy Framework where applicable). We share data with authorities only where the law requires it.

4. AI avatars, faces and voices

If you upload a photo or create a voice for an avatar, that image or voice can identify a person and is treated as sensitive. We store it only to generate the content you request and keep the avatar's appearance and voice consistent. You must have the explicit consent of any real person shown or heard, and you confirm this when you upload. A person who is shown can ask us to remove their likeness at any time (see the Copyright and Takedown Policy). We never use your uploads to train AI models, and we do not use faces to identify people.

5. Ads you upload for analysis

When you upload an ad in Clone an Ad, the video is sent to Google Gemini to describe its structure and is not stored by us. We keep the written description (hook, steps, pace) in your session and the new script you create.

6. How long we keep data

• Account and content: as long as your account exists. When you delete a creation, its files are removed; a record of the generation is kept for billing accuracy.
• After account deletion: content and files are deleted within 30 days. Billing records are kept for 10 years as required by Swiss accounting law.
• Inactive accounts: if an account is not used for a long time, we warn you by email before we close it and delete its content.
• Server logs: up to 90 days.

7. Cookies

We use only strictly necessary cookies: the sign-in session cookie set by Supabase Auth. We do not use advertising or tracking cookies, so there is no cookie banner. If we add analytics later, this policy and the website will say so first.

8. Security

Data is encrypted in transit. Files are kept in private storage and are shown through short-lived links. Our server checks on every request that you can only reach your own data. No system is perfectly secure; we tell affected users and the authorities about a breach as the law requires.

9. Your rights

You can ask for access to your data, correction, deletion, a copy in a portable format, restriction, or object to processing based on legitimate interest. You can withdraw a consent at any time. In your account settings you can ask for a copy of your data or for deletion of your account; you can also write to support@holovey.ai. We answer within 30 days. If you are in the EU, you may also complain to your local data protection authority; in Switzerland, to the Federal Data Protection and Information Commissioner (FDPIC).

10. Businesses that upload data about other people

If you upload personal data of other people (for example customers or models), you decide why and how it is used, and we process it for you. Our provider list above is the list of sub-processors. If you need a data processing agreement, write to support@holovey.ai.

11. Children

The Service is for adults only. We do not knowingly collect data from anyone under 18 and delete such data when we find it.

12. Changes

We may update this policy. The date at the top shows the current version. For significant changes we will inform you by email or in the app.