Privacy Policy

Who we are

Kitovia is operated by an individual sole proprietor trading as Kitovia, based in the People's Republic of China (“we”, “us”). For privacy questions or to exercise your rights, email support@kitovia.com.

What we collect

• Account data: your email address and password (stored only as a salted hash by our authentication provider — we never see your password).
• Credits & billing: your credit balance, every credit transaction (purchases, generations, refunds), and order records (amount, currency, date, payment provider reference). Payment card details are handled by our payment providers and never reach our servers.
• Content: the photo you upload and the 3D assets generated from it.
• Support & operations: emails you send us, and technical logs (for example IP address and timestamps) required to run and secure the service.
• Usage & cookie data (only with your consent): page views, device and browser information, and analytics or advertising identifiers collected through Google Tag Manager, Google Analytics 4 and Google Ads. These optional cookies are off by default and the tags are not loaded until you opt in — see our Cookie Policy.

Background removal, when you use it, runs entirely in your browser — that copy of your photo never leaves your device unless you choose to generate with it.

Why we use it (legal bases)

• To provide the service you paid for — account, credits, generation, download links (performance of a contract).
• To keep accounts secure, prevent fraud and abuse (legitimate interests).
• To comply with tax, accounting and consumer-protection obligations (legal obligation).
• To send you product news — only if you opted in; you can opt out at any time (consent).
• To measure how the site is used and how our advertising performs, through optional analytics and advertising cookies — only if you opted in; you can withdraw that consent at any time (consent). We use Google Consent Mode v2, so these tags are not loaded at all until you agree.

We do not sell your personal data for money, and we never use your uploaded photos, generated models, or account details for advertising or profiling. If you consent to advertising cookies, Google may use those signals for cross-context behavioural advertising, which some privacy laws treat as “sharing” — you can opt out at any time using the settings in our Cookie Policy, or by sending a Global Privacy Control (GPC) signal. We do not perform facial recognition, age estimation, or any other biometric analysis on uploaded photos.

How long we keep it

• Account data: for the life of your account, and up to 30 days after an account is fully deleted (backup rotation).
• Uploaded photos and generated files: deleted immediately when your account is deleted; otherwise up to 12 months after delivery so you can re-download your files.
• Orders, credit ledger and refunds: kept in anonymized form for as long as required by tax and accounting law (typically [RETENTION_YEARS] years). After account deletion these records no longer contain your name or email.
• Content-policy violations: where the law requires it (for example U.S. reporting obligations), records related to reported illegal content are preserved for 1 year and are excluded from routine cleanup.
• Optional analytics / advertising data: retention is set by Google for the identifiers it creates; we do not copy that data into our own database. Your cookie choice stays in your browser until you change or clear it. See the Cookie Policy.

Third parties

We share data only with these processors:

• Supabase — account authentication (email/password) and our application database;
• Tripo (Tripo AI) — receives your uploaded photo to generate the 3D model;
• Vercel — hosting, file storage (Blob), and edge network;
• Creem and Lemon Squeezy — payment processing, each acting as merchant of record;
• Resend — transactional email delivery;
• Google — Google Tag Manager, Google Analytics 4 and Google Ads for optional usage measurement and advertising conversion tracking. These services load only after you consent (see the Cookie Policy) and are governed by Google's own privacy terms;
• Cloudflare — DNS, email routing, and network services.

These providers may process data outside your country. Where required (for example transfers out of the EEA/UK), we rely on the provider’s standard contractual clauses or an equivalent safeguard. Copies of the relevant agreements are available on request.

Your rights (GDPR / CCPA)

Wherever you live, you have the right to access, export, correct, and delete your personal data, and to object to or restrict certain processing. Most of these are self-service:

• Export: sign in and use “Export my data” on the My Account page — you get a machine-readable JSON file with your account, credits, orders, refunds and generations.
• Deletion: use “Delete my account” on the My Account page. Deletion takes effect after a 7-day grace period during which you can cancel it by signing back in. After that your photos, models and account are permanently removed; anonymized financial records are retained as required by law.
• Cookie choices: accept, reject, or change optional analytics and advertising cookies at any time, and withdraw an earlier consent, using the settings on the Cookie Policy page. If you are in California you may also opt out of the sale or sharing of personal information the same way; we honour Global Privacy Control (GPC) signals.

For anything else, email support@kitovia.com from your account email. We respond within 30 days. Under the GDPR you may also lodge a complaint with your local supervisory authority.

Children

Kitovia is not directed at children. You must be at least 18 years old to create an account.

Cookies

We use strictly necessary session cookies to keep you signed in and secure, set by our authentication provider. Optional analytics and advertising cookies (Google Tag Manager, Google Analytics 4, Google Ads) are off by default and load only after you opt in through our cookie banner. We use Google Consent Mode v2, so before consent all optional storage is denied and the GTM container is not loaded at all. You can change or withdraw your choice at any time from the Cookie Policy page or the site footer; withdrawing consent stops optional cookies immediately, and on your next page load the container is no longer loaded. We also honour Global Privacy Control (GPC) signals. Full details, including the “Do Not Sell or Share” notice, are in our Cookie Policy.

Changes

If this policy changes materially, we will notify you by email to your account address before the change takes effect.