1. Introduction

Gameverse, LLC ("we," "us," or "our"), which operates genvi, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use genvi ("the Service"), a node-based AI creative studio platform, on the web at genvi.co and in the genvi apps for iPhone, iPad and Android.

By using genvi, you consent to the practices described in this Privacy Policy. If you have questions, contact us at support@genvi.co.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

Email address
Full name (optional, when provided)
Profile avatar (optional)
Account creation date
Authentication method (email and password, Google sign-in, or Sign in with Apple in the iPhone and iPad app)

2.2 API Keys

As a BYOK (Bring Your Own Key) platform, you may provide API keys for third-party AI providers (Google AI, xAI, etc.). These keys are:

Encrypted with authenticated AES-256-GCM
Used only to execute the requests you run against the AI providers you choose
Never sold, and never logged or stored in plaintext
Removed when you revoke them or delete your account

2.3 Content and Files

We store the following content you create or upload:

Project files (workflow definitions, node configurations, connections)
Uploaded media (images, videos, audio files)
AI-generated outputs (images, videos, text, audio)
Folder structures and organizational metadata
Text prompts and input parameters

2.4 Usage and Security Logs

We collect limited operational data to run and secure the Service:

Server logs (IP address, access times) and file-access logs
Security and audit events (sign-in, administrative actions, data export, account deletion)
Storage utilization metrics
Product-usage events — pages opened, features used, and whether a generation succeeded, failed or was kept — recorded against your account while you are signed in

Product-usage data is first-party only: we process it ourselves and store it in our own database. We do not use third-party analytics, advertising, or behavioral-tracking services, and we never share this data with one. Our lawful basis is legitimate interest — understanding which parts of the Service work — and you may object to it at any time by enabling Do Not Track or Global Privacy Control in your browser, or by contacting us.

Visitors who are not signed in are counted without any identifier being stored on their device: we derive a value from the IP address and browser type, salted and rotated daily, which cannot be reversed to identify anyone or linked across days.

2.5 Payment Information

For plans and credits bought on genvi.co, we use Stripe as our payment processor. We do not store full credit card numbers. We retain billing address, transaction history, and subscription status.

Plans and credits bought in the genvi app are billed by Apple (App Store) or Google (Google Play), never by us, and we never see your card. See section 2.6.

2.6 The genvi Apps for iPhone, iPad and Android

The apps use the same account and the same Service as the website, so everything above applies to them. In addition:

Signing in. If you choose Sign in with Apple (iPhone and iPad) or Google sign-in, Apple or Google tells us your email address (with Apple, possibly a private relay address that forwards to you) and, if you allow it, your name. We do not receive your Apple or Google password.
In-app purchases. Purchases in the apps are made through the App Store or Google Play and processed for us by RevenueCat. RevenueCat receives an app user id (your genvi account number), the products you bought, and the purchase and renewal records the store sends. Apple or Google hold your payment details; we and RevenueCat never do.
Push notifications. If you allow notifications, the app gives us a device push token, which we store with your account to tell you when something you started is ready. We send notifications through Expo's push service, which passes them to Apple Push Notification service or Firebase Cloud Messaging (Google). You can turn notifications off at any time in your device's settings.
Device permissions. The app asks only when you use the feature that needs it:
- Camera: to take a photo to use as a reference for what you make.
- Photos: to open the photos and videos you pick, and to save the results you choose to your library.
- Microphone: to record voice-overs for your videos and to hear what you dictate to the agent, only while you are recording. Dictation is sent to our server and turned into text by one of the AI providers in section 5.1.
On-device subject selection. When you select a subject or remove a background in the image editor, the app finds the subject on your device: with Apple's Vision framework on iPhone and iPad, and with Google ML Kit on Android. The image is not uploaded for this. On Android, Google Play services may send Google basic information about how the feature performs, under Google's privacy policy.
App analytics. The app records how it is used (screens opened, features used, the app version and platform) and sends this to genvi's own server, the same first-party analytics as the website described in section 2.4. The app contains no advertising or third-party analytics software, does not use the advertising identifier (IDFA on iOS, the advertising ID on Android), and does not track you across other companies' apps or websites. If you have chosen to share diagnostics with Apple or Google, they may give us crash reports that do not identify you.

3. How We Use Your Information

We use your information to:

Provide, maintain, and improve the Service
Process and execute your workflow requests
Store and retrieve your projects and files
Authenticate your identity and secure your account
Communicate with you about service updates, security alerts, and support
Monitor usage patterns and detect abuse or security threats
Process payments and manage subscriptions
Comply with legal obligations

4. How We Protect Your Information

4.1 Encryption

All data transmitted between your browser and our servers uses TLS 1.3 encryption
API keys are encrypted with authenticated AES-256-GCM
Database connections are encrypted and authenticated
Stored files are encrypted in cloud storage (Supabase Storage)

4.2 Access Controls

Row-level security (RLS) policies enforce that users can only access their own data
Multi-factor authentication available for account security
Staff access to production data is limited and logged

4.3 Data Residency

Data is stored in Supabase, which uses AWS infrastructure. By default, data is stored in the region configured for your Supabase project (typically US-East).

5. Information Sharing

We do not sell your personal information. We share data only in the following circumstances:

5.1 Third-Party AI Providers

To make a result, on the web or in the apps, we send your prompt and any images, video, audio or 3D models you give as input to the AI provider that runs the model you chose. These providers are Google (Gemini, Veo and Imagen), OpenAI, xAI (Grok), fal.ai (which also runs models from other labs), Replicate, DeepSeek and Tripo3D. Prompts and images may also be checked by OpenAI's moderation service against our content rules. This transmission:

Is necessary for the Service to function
Uses your own API key for that provider if you have saved one, and ours otherwise
Is subject to the AI provider's privacy policies

5.2 Service Providers

We use trusted third parties for:

Cloud database and storage (Supabase, on AWS infrastructure)
Application hosting (Vercel)
Payment processing on genvi.co (Stripe)
In-app purchases (Apple App Store and Google Play, through RevenueCat)
Push notifications (Expo, Apple Push Notification service and Firebase Cloud Messaging)
Authentication (Google sign-in and Sign in with Apple)
AI generation providers you invoke (see our full Subprocessors list)

5.3 Legal Requirements

We may disclose information if required by law, court order, or to protect our rights, property, or safety, or that of our users or the public.

6. Your Rights and Choices

6.1 Access and Export

You can access and export your data at any time:

Download a full, machine-readable export of your account data from Account settings ("Download my data")
Download individual files from the File Repository
Export workflows as JSON files

6.2 Correction and Deletion

You can:

Update account information in Settings
Delete files, projects, or folders at any time
Delete your entire account, in the app or on the web: it is locked at once and permanently deleted after 30 days, or immediately if you choose. See how to delete your account, which also explains what we keep afterwards
Revoke or rotate API keys in Settings

6.3 Marketing Communications

You can opt out of marketing emails at any time by clicking the unsubscribe link or contacting us. We may still send service-related communications.

7. Data Retention

We retain your data as follows:

Active Accounts: Data is retained indefinitely while your account is active
Deleted Content: When you delete files or projects, they are permanently removed immediately
Account Deletion: When you delete your account it is locked at once and its personal data is permanently deleted 30 days later, or immediately if you choose. Records of payments are kept as long as tax and accounting law requires, and security records for up to 12 months; the full list is on our account deletion page
Backups: Backup data may be retained for up to 90 days for disaster recovery
Logs: System logs are retained for 90 days, then anonymized or deleted
Security records: Audit records of security events, such as sign-ins and account deletion, are retained for up to 12 months

8. Cookies and Tracking

We use only strictly necessary cookies and local browser storage:

Authentication and session management (essential)
UI preferences such as theme (stored locally in your browser)
A random per-visit session identifier, held in session storage and discarded when you close the tab, so the pages of one visit can be counted as one visit

We do not use advertising or third-party tracking cookies, and our product analytics set no tracking cookie at all. Because we rely only on strictly necessary cookies, no consent banner is required. We honour Do Not Track and Global Privacy Control. See our Cookie Policy for details.

9. Children's Privacy

genvi is only for adults: you must be 18 or older to use it, on the web or in the apps. We do not knowingly collect personal information from anyone under 18, and we delete an account we learn belongs to someone under 18. If you believe a child has provided us with personal information, contact us immediately at support@genvi.co.

10. International Transfers

If you are accessing genvi from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We comply with applicable data protection laws including GDPR for EU users.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email or through the Service. The "Last updated" date at the top indicates when the policy was last revised.

12. Contact Us

For privacy-related questions, requests, or concerns:

Email: support@genvi.co
Data Protection Officer: support@genvi.co
Response time: Within 30 days

13. California Privacy Rights (CCPA)

California residents have the following rights under the CCPA:

Right to know what personal information is collected
Right to know whether personal information is sold or shared (we do not sell personal information)
Right to request deletion of personal information
Right to non-discrimination for exercising privacy rights

To exercise these rights, contact us at support@genvi.co.

14. GDPR Compliance (EU Users)

For users in the European Economic Area (EEA), we comply with GDPR requirements:

Legal Basis: We process data based on contract performance (providing the Service) and consent
Data Subject Rights: You have rights to access, rectify, erase, restrict processing, and data portability
Withdrawal of Consent: You may withdraw consent at any time (may affect Service functionality)
Complaints: You may lodge complaints with your local data protection authority

Our representative for EU data protection matters can be contacted at support@genvi.co.

Privacy Policy