Noevvo StudioWho is responsible for your data
Noevvo ("we", "us") runs Noevvo Studio and decides how your personal data is used. Contact us about anything in this policy at [email protected].
What we collect
- Account: your email address and a one-way hash of your password (we never store the password itself), when you signed up, and which version of these documents you accepted.
- Waitlist and sales enquiries: the name, company, company size, industry, use case, and (for agencies) phone and website you give us.
- Your content: briefs, brand details, logos and images, music you upload, the reels the studio writes, your edits, and the videos it renders.
- Usage: your plan, credits and trial usage, and how many AI tokens each project used (to manage costs and limits).
- Security: a log of sign-ins, sign-ups, password changes and similar events. IP addresses are stored only as salted one-way hashes, used for rate limits and to stop abuse.
- Payments (paid plans): handled by Stripe. We receive your customer and subscription ids and payment status, never your full card details.
How we use it
- to run the studio: your account, writing and rendering your reels, share links
- to email you about your account: confirming your address, password resets, your trial invite (we don't send marketing email without asking)
- to keep the service safe: rate limits, abuse and fraud prevention, security logs
- to bill paid plans and keep financial records the law requires
- to keep the service reliable and affordable, using aggregate usage (for example AI costs per project)
We don't sell your data, show ads, or use your content to train AI models.
Legal bases
Where laws like the GDPR apply, we rely on: contract (to provide the studio you signed up for), legitimate interests (security, abuse prevention, keeping the service working), consent (where we ask for it, which you can withdraw), and legal obligation (for example tax records).
AI processing
To write and edit reels, the studio sends your brief, brand details, scene prompts and any reference images you choose to Anthropic's Claude API. Anthropic processes them to return the result. Under its commercial terms it doesn't train its models on this data, and it keeps it only for a limited time for safety and abuse monitoring. When you turn on research, the AI may visit public web pages to find statistics, and the sources it uses are shown in your project.
Who we share it with
Only the service providers that run the studio for us, each bound by a contract to protect the data and use it only for us:
- Supabase: database (Singapore region)
- Oracle Cloud: the server that runs the studio and stores your files (Singapore region)
- Cloudflare: network, HTTPS and security in front of the studio
- Anthropic: the AI that writes and edits reels
- Resend: sending account emails
- Stripe: payments, for paid plans
We may also disclose data if the law requires it, or to protect people's safety. If the business is sold or merged, the data would move with it under this policy, and we'd tell you.
International transfers
Your data is stored in Singapore. Some providers (for example Anthropic, Cloudflare and Stripe) may process it in other countries, including the United States. Where the law requires it, we use recognised safeguards for these transfers, such as standard contractual clauses.
How long we keep it
- Your account and content: while your account exists. When you delete your account, we delete it straight away, apart from backups, which roll off within 14 days.
- Renders: until you re-render that reel, delete it or its project, or delete your account.
- Share links: they stop working when they expire (30 days by default) or when you turn them off.
- Security logs: 12 months. They're detached from your account when you delete it.
- Waitlist and sales enquiries: until we've dealt with them, or sooner if you ask.
- Billing records: as long as tax law requires.
Security
Everything travels over HTTPS. Passwords are hashed with bcrypt. Files sit in private storage under long random names and are served only to their owner or through links that expire. Every request is checked against your account, and there are rate limits and an audit log. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.
Your rights
Depending on where you live, you have the right to access, correct, export or delete your data, and to object to or restrict some uses. In the studio:
- Settings → Download my data gives you everything we hold about your account, as a file.
- Settings → Delete account deletes your account and everything in it.
- For anything else, or to correct something, email [email protected]. We reply within 30 days.
You can also complain to your local data protection authority.
Children
The studio isn't meant for anyone under 18, and we don't knowingly collect children's data. If you think a child has signed up, tell us and we'll delete the account.
Changes to this policy
If we change this policy in a way that matters, we'll email you or tell you in the studio before it applies. The version and date at the top always show which policy is current.