Privacy Policy

This Privacy Policy describes how Stivio (“Stivio”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you visit stivio.aior use our AI-powered image-to-video generation service (the “Service”). This Policy forms part of our Terms of Service. By using the Service, you acknowledge that you have read and understood this Policy.

1. Who we are

Stivio is operated as an independent sole proprietorship (the “Operator”). For all data-protection matters, including requests to exercise your rights, the controller of your personal data is the Operator. You can reach the Operator at hello@stivio.ai.

If you are located in the European Economic Area, the United Kingdom, or Switzerland and require a local point of contact, please use the same email address; we will route your request appropriately. If we appoint an EU/UK representative under Article 27 GDPR in the future, their details will be published on this page.

2. Definitions

• Personal Data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.
• Controller — the entity that determines the purposes and means of Processing (Stivio, for the data covered by this Policy).
• Processor / Sub-processor— a third party that processes Personal Data on the Controller's behalf.
• Service — the website at stivio.ai and the related AI image-to-video generation features.
• You — a visitor, signed-in user, or paying customer of the Service.

3. Information we collect

3.1 Information you provide directly

• Account information. When you sign in with Google we receive your name, email address, profile picture, and Google account ID.
• Generation inputs.The photo you upload (the video's first frame, plus an optional end frame), the motion prompt you write, and the settings you pick — video model, clip length, resolution, aspect ratio, and sound.
• Generation outputs. The video clips (MP4) we generate for you, linked to your account history.
• Communications. When you email us, we keep the message, your email address, and any attachments you send.
• Optional profile info. Anything else you choose to add to your account.

3.2 Information collected automatically

• Device & log data. IP address, user agent, browser language, request timestamps, referring URL, the pages and API endpoints you access.
• Usage data. Number of generations, credits charged, plan tier, success / failure of jobs, error codes.
• Cookies and similar technologies. See §10.

3.3 Information from third parties

• Google OAuth. We receive the Google profile fields listed in §3.1 when you authorize sign-in.
• Stripe. When you purchase, Stripe sends us the billing event (success / failure), invoice ID, customer ID, plan purchased, and country / postal code for tax. We never receive your full card number, CVC, or full bank details.
• Browser fingerprint. When you first visit we ask your browser to compute a fingerprint (via the open-source FingerprintJS library, executed in your browser) and we store only a salted SHA-256 hash of that fingerprint plus a random visitor UUID. The raw fingerprint is never transmitted to or stored by us.

3.4 Sensitive data

We do not knowingly collect special-category personal data (racial / ethnic origin, political opinions, religion, health data, biometric or genetic data). Please do not submit such data in prompts or reference images.

4. Legal bases for processing (EEA / UK only)

If you are in the EEA, the United Kingdom, or Switzerland, our legal bases under the GDPR / UK GDPR are:

Where we rely on legitimate interests, you have the right to object — see §13.

5. How we use information

We use the information described in §3 to:

• Authenticate you and maintain your sign-in session.
• Send your prompts and uploaded photos to our AI sub-processors and return the generated videos to you.
• Track credit balances and deduct or refund credits per ledger rules.
• Process payments via Stripe and grant or revoke plan benefits.
• Detect and prevent abuse of free signup credits, account take-overs, payment fraud, and brute-force attempts. Specifically, we compare your hashed visitor ID and IP address against prior signups to decide whether to grant the free signup credits.
• Operate, monitor, debug, and improve the Service, including running aggregated analytics (e.g. “average generation time”).
• Respond to your support requests and account inquiries.
• Comply with applicable law, respond to lawful requests from authorities, and enforce our Terms.
• Notify you of material changes, billing issues, or security incidents (transactional email — you cannot opt out of these as long as you have an account).

6. Sharing & disclosure

We do not sell your personal data. We do not share personal data with third parties for cross-context behavioral advertising. We share personal data only as described below:

• Sub-processors. Vendors that process data on our behalf to operate the Service — see §7.
• Legal authorities. When required by valid legal process (subpoena, court order, government request) or to protect rights, property, or safety. We will challenge overbroad requests and notify you when permitted by law.
• Corporate transactions. If we are acquired, merged, or sell substantially all assets, your data may transfer to the acquirer subject to this Policy. We will notify you in advance and give you the chance to delete your account.
• With your consent. Any other sharing requires your explicit consent.

7. Sub-processors

We rely on the following sub-processors. Each has signed a Data Processing Agreement (DPA) or equivalent contractual safeguards committing them to confidentiality, security, and (where applicable) Standard Contractual Clauses for international transfers.

We may add or replace sub-processors. Material additions will be announced on this page at least 14 days before they take effect.

8. International data transfers

Our infrastructure and most of our sub-processors are based in the United States. If you are located outside the United States, your data will be transferred to and processed in the United States.

For transfers from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (Module 2 or Module 3 as appropriate) and, where required, supplementary technical and organizational measures, including encryption in transit and at rest. Copies of the SCCs we have in place with sub-processors are available on request.

9. Data retention

We retain personal data only for as long as needed:

After the retention period, we delete or irreversibly anonymize the data. Deletion of an account triggers immediate deletion of profile and credit data; generations and logs already past their retention window are unrecoverable.

10. Cookies & similar technologies

Every cookie we set is strictly necessary to deliver the Service (sign-in, abuse prevention, payment fraud detection). Our traffic analytics (Vercel Web Analytics) is cookieless: it counts page views in aggregate without setting any cookie, without fingerprinting for tracking purposes, and without following you across sites or devices. We do not use advertising or cross-site tracking cookies.

We do not show a cookie consent banner because none is required: under the EU ePrivacy rules, strictly necessary cookies are exempt from prior consent, and we set no other cookies. If we ever introduce a non-essential cookie, we will add a consent-first banner before it loads and update this section.

11. Security

• HTTPS / TLS 1.2+ everywhere; HSTS enforced.
• Database encryption at rest, managed by Neon.
• OAuth-only authentication — we never store passwords.
• Browser fingerprints are hashed with a server-side secret salt before storage.
• Card data is handled exclusively by Stripe (PCI DSS Level 1) and never touches our servers.
• API keys for AI providers are stored as environment variables, not in source control.
• Webhook calls from Stripe are verified with a signing secret to prevent replay or spoofing.

No system is 100% secure. If we discover a breach affecting your personal data we will notify you and (where applicable) the relevant supervisory authority within 72 hours of becoming aware, in line with Article 33 / 34 GDPR.

12. Your rights — general

Regardless of where you live, you can ask us to:

• Confirm whether we hold data about you and access a copy of it.
• Correct inaccurate data.
• Delete your data (subject to legal retention).
• Export your data in a portable, machine-readable format.
• Restrict or object to certain processing.
• Withdraw consent where processing is based on consent.

13. EEA / UK rights (GDPR & UK GDPR)

If you are in the EEA, the UK, or Switzerland, you have these specific rights:

• Right of access — Article 15
• Right to rectification — Article 16
• Right to erasure (“right to be forgotten”) — Article 17
• Right to restriction of processing — Article 18
• Right to data portability — Article 20
• Right to object — Article 21
• Right not to be subject to automated decisions producing legal or similarly significant effects — Article 22 (see §17)
• Right to lodge a complaint with your local data protection supervisory authority. A list is available at edpb.europa.eu. UK residents may complain to the ICO.

14. California rights (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect, sources, and purposes.
• Receive a copy of the specific pieces of personal information we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of your personal information.
• Opt out of the “sale” or “sharing” of personal information.
• Limit our use of sensitive personal information.
• Be free from retaliation for exercising these rights.

We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). We do not have actual knowledge that we sell or share the personal information of consumers under 16.

You may submit requests by emailing hello@stivio.ai from the email address on your account. You may designate an authorized agent to make a request on your behalf; we may require proof of authorization.

15. Other US state privacy laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other US states with comprehensive privacy laws have rights similar to those above (access, deletion, correction, portability, opt-out of targeted advertising, profiling appeal). Use the same email channel; we will honor requests under your applicable state law.

16. Children

The Service is not directed to children under 13 (or under 16 in the EEA where applicable). We do not knowingly collect personal data from such children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly. Paid plans require users to be 18 or older.

17. Automated decision-making & AI

We use AI models to generate the outputs you request: the video model you select (from the Kling, Seedance, Wan, and MiniMax families, accessed via the KIE.ai gateway) turns your uploaded photo and motion prompt into a video clip. This generation is not a decision about you and has no legal or similarly significant effect on you within the meaning of GDPR Article 22.

Our anti-abuse system uses your visitor fingerprint hash and IP address to decide whether to grant the 10-credit signup bonus. If you believe that decision was made in error, you can email hello@stivio.ai to request a manual review by a human.

Submitted prompts are screened for prohibited content before generation, first by a local term list and then by the OpenAI Moderation API. Uploaded photos are screened by the same API before being accepted. A prompt or photo flagged by the moderator is rejected before any credit is charged. We keep an audit record of each screening decision; for rejected prompts this record includes the prompt text, the reason, and the request IP address, retained for abuse-prevention, appeal review, and — where relevant — payment-dispute evidence. For rejected photos we record only a cryptographic hash of the file (never the image itself), the flagged categories, and the request IP. Allowed prompts are recorded in the audit log only as a cryptographic hash. You can appeal a rejection by emailing us; a human will review it.

In addition, the upstream video-model provider applies its own automated content screening to the uploaded image and the generated video. If a generation is rejected upstream, it fails and your credits are refunded automatically.

18. Links to third-party sites

Our Service may contain links to third-party websites (e.g. Stripe Checkout, Google sign-in, AI provider documentation). Those sites operate under their own privacy policies; we are not responsible for their practices.

19. Do Not Track

Because we do not use tracking cookies for advertising, browser-level Do Not Track signals do not apply meaningfully to our Service. We do not respond to DNT signals because there is no consensus standard.

20. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes — for example, adding a new sub-processor, changing legal bases, or expanding the categories of data we collect — will be announced on this page at least 14 days before they take effect, and (if you have an account) we will email you. The date at the top of the page reflects the most recent update.

21. How to exercise your rights

To submit any privacy request:

1. Email hello@stivio.ai from the email address on your account, or include account-verifying information (account ID, last invoice ID).
2. Tell us which right you are exercising and any details that help us locate the data (e.g. approximate sign-up date).
3. We will respond within 30 days. If your request is complex we may extend by a further 60 days and we will tell you why.
4. We may need to verify your identity to protect your data; we will not request more information than necessary.
5. We will not discriminate against you for exercising your rights.

22. Contact

Questions, complaints, or requests regarding privacy:

• Email: hello@stivio.ai
• Subject line: please prefix with [Privacy] so we can route quickly.