Privacy Policy

1. Who is responsible for your data

The controller of your personal data is the seller who runs the site:

• Nikita Sergeevich Ivanov, self-employed individual (OSVČ)
• Business ID (IČO): 14242516
• Registered office: Kozí 857/15, Staré Město, 110 00 Praha 1, Czechia
• Registered in the Trade Licensing Register (živnostenský rejstřík) of the Czech Republic
• Email: info@dariva.ai

We follow the EU General Data Protection Regulation (GDPR) and Czech data protection law.

2. Data we collect

• Account data: your name, email address and, if you sign in with Google or Facebook, your profile picture and the identifier of that login. If you sign up with a password, we store it only in hashed form.
• Photos you upload and the photos and videos generated from them.
• Purchase data: the token packages you bought, amounts, dates and the history of tokens added and spent.
• Payment data: payments are handled by Stripe. We receive the payment status, amount, currency, country and a partial card reference such as brand and last four digits. We never receive or store full card numbers or security codes.
• Technical data: IP address, browser and device type, pages requested and time of the request, kept in server logs.
• Messages you send us by email.

3. Why we use it and on what legal basis

• To create your account, generate results and keep your token balance: performance of the contract with you (Article 6(1)(b) GDPR).
• To take payments, issue refunds and keep accounting records: performance of the contract and our legal obligations (Article 6(1)(b) and (c) GDPR).
• To keep the service secure, prevent fraud and abuse, and defend legal claims: our legitimate interests (Article 6(1)(f) GDPR).
• To answer your requests: performance of the contract or our legitimate interest in helping you.

We do not sell personal data. We do not send marketing emails unless you have agreed to receive them, and you can withdraw that agreement at any time.

4. Your photos

Photos you upload are used for one purpose: to produce the result you asked for. To do that we send the photo and the instructions of the chosen template to the AI model provider that creates the result.

We do not use your photos or results to identify you, we do not build face recognition profiles from them, and we do not use them for advertising or to train our own AI models.

Upload only photos of yourself or of adults who have agreed to it. Do not upload photos of children.

5. Who receives your data

We share data only with providers we need to run the service, and only to the extent they need it:

• AI model providers that generate the results. At present this is fal.ai (United States).
• Stripe Payments Europe, Limited (Ireland) for payments and fraud prevention. Stripe also acts as a controller of payment data under its own policy at stripe.com/privacy.
• Google and Meta, only if you choose to sign in with a Google or Facebook account.
• The hosting provider that runs our servers and the provider that delivers our service emails.
• Accountants, legal advisers and public authorities, where the law requires it or it is needed to protect our rights.

6. Transfers outside the European Economic Area

Some providers are based in the United States or process data there. For such transfers we rely on the EU-US Data Privacy Framework where the provider is certified, or on the Standard Contractual Clauses approved by the European Commission.

7. How long we keep data

• Account data: until your account is deleted.
• Uploaded photos and generated results: until you delete them or your account is deleted.
• Payment and invoice records: up to 10 years, as Czech tax and accounting law requires.
• Server logs: normally no longer than 90 days.
• Emails with you: up to 3 years after the last message.

How to have your account and data removed is described on the Delete Account page.

8. Cookies

We use only cookies that are strictly necessary: they keep you signed in and protect the sign-in process. We do not use advertising or analytics cookies. If that changes, we will ask for your consent first.

When you pay, Stripe may set its own cookies to process the payment and prevent fraud.

9. Security

The site works over an encrypted connection (HTTPS), passwords are stored hashed, and access to personal data is limited to what is needed to run the service. Card payments are processed by Stripe, a PCI DSS certified payment provider, so your card details never reach our servers.

10. Your rights

You have the right to:

• get a copy of your personal data and information about how we use it;
• have inaccurate data corrected;
• have your data deleted;
• have processing restricted;
• receive your data in a portable format;
• object to processing based on our legitimate interests;
• withdraw a consent you have given.

To use any of these rights, write to info@dariva.ai. We reply within one month.

You can also complain to the supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czechia, uoou.gov.cz. If you live in another EU country, you can contact the authority there instead.

11. Age limit

The service is for people aged 18 or older. We do not knowingly collect data from anyone younger. If you believe a minor has created an account, tell us and we will delete it.

12. Automated decisions

We do not make decisions about you that have legal or similarly significant effects by automated means alone.

13. Changes to this policy

If we change this policy, we will publish the new version here and update the date at the top. If a change is significant, we will also tell you by email or on the site before it takes effect.

14. Contact

Questions about this page go to info@dariva.ai. We answer within 3 business days.

• Nikita Sergeevich Ivanov, self-employed individual (OSVČ)
• Business ID (IČO): 14242516
• Registered office: Kozí 857/15, Staré Město, 110 00 Praha 1, Czechia
• Registered in the Trade Licensing Register (živnostenský rejstřík) of the Czech Republic
• Email: info@dariva.ai