Privacy Policy

The controller responsible for your personal data is Lucas Duarte, an individual (pessoa física) based in Brazil, who operates the Plovana service. The sole channel to reach us on any privacy matter is by email at plovana.contact@gmail.com.

Account data: your name, email address, password (stored hashed) and authentication metadata, managed through our authentication and database provider (Supabase).

Billing data: your plan, subscription status, credit balance and transaction history. All payments are processed directly by our payment provider (Stripe) in your local currency — Brazilian reais (BRL) in Brazil and United States dollars (USD) elsewhere; we do not store or have access to your full card number.

Content data: the prompts, scripts, media and settings you submit, and the videos, voice-overs, subtitles and thumbnails generated for you, stored as files in Cloudflare R2.

Publishing data: the social accounts you connect and the tokens or identifiers needed to publish on your behalf via our publishing provider (Post For Me).

Usage and technical data: log data, device and browser information, IP address, and interactions with the service, used for security, diagnostics and product improvement.

We use your data to provide and operate the service (generate videos, manage credits, publish content); to process payments and manage subscriptions; to secure the platform and prevent fraud and abuse; to provide support; to comply with legal obligations; and to improve the product.

We do not sell your personal data. We do not use the private content you generate to train third-party foundation models beyond what is necessary to deliver the outputs you request.

Where the LGPD or GDPR applies, we rely on the following legal bases: performance of our contract with you (to provide the service); compliance with legal obligations; our legitimate interests (security, fraud prevention, product improvement), balanced against your rights; and your consent, where required (for example, for certain cookies or communications).

You may withdraw consent at any time where processing is based on consent; this does not affect processing carried out before withdrawal.

We share personal data with carefully selected service providers who process it on our behalf under contractual data-protection obligations. Our current sub-processors are:

Supabase — authentication and database (account, credit and application data).

Stripe — payment processing in your local currency (Brazilian reais in Brazil, United States dollars elsewhere), subscriptions and credit-pack purchases; your card data is handled directly by Stripe.

Cloudflare (R2) — storage and delivery of your generated video files and related media.

Vercel — hosting and delivery of our web frontend, including request and log data.

Fly.io — hosting of the backend application that runs the generation pipeline.

Upstash (Redis) — the task queue that coordinates video-generation jobs.

Post For Me — publishing your videos to your connected social platforms on your behalf.

ElevenLabs — AI voice generation for premium and cloned voices, from the text you submit.

Microsoft (Azure / Edge TTS) — free AI voice generation from the text you submit.

Our large-language-model providers — generating scripts from the prompts you submit.

Pexels — stock video footage used to compose your videos.

We may also disclose data where required by law, to enforce our terms, or in connection with a business transfer, subject to appropriate safeguards.

When you connect a social account, we process the identifiers and tokens needed to publish on your behalf and send your selected videos and metadata to the relevant platform through our publishing provider.

Once content is published on a third-party platform, that platform processes it under its own privacy policy and terms, which are outside our control. You can disconnect a social account at any time to stop future publishing.

We use strictly necessary cookies and local storage to keep you signed in, remember your language and theme preferences, and secure the service. We may use limited analytics to understand and improve usage.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the service from working.

We retain account and billing data for as long as your account is active and as needed to comply with legal, tax and accounting obligations.

Generated video files are retained according to your plan tier: Free — 7 days; Creator — 30 days; Pro and Studio — 90 days. After the retention period, files are automatically deleted from storage, while minimal metadata may be kept. Download the videos you want to keep before they expire.

When you delete your account, we delete or anonymize your personal data within a reasonable period, except where retention is required by law.

Because we and our sub-processors operate globally, your personal data may be processed in countries other than your own. Where such transfers occur, we rely on appropriate safeguards, such as standard contractual clauses and the international-transfer mechanisms recognized under the LGPD and GDPR.

Under the LGPD, the GDPR and similar laws, you may have the right to: confirm whether we process your data and access it; request correction of inaccurate data; request anonymization, blocking or deletion of unnecessary or unlawfully processed data; request portability; obtain information about the entities we share data with; withdraw consent; and object to certain processing.

To exercise these rights, contact us at plovana.contact@gmail.com. We will respond within the timeframes required by applicable law. You also have the right to lodge a complaint with a supervisory authority — in Brazil, the ANPD (Autoridade Nacional de Proteção de Dados).

We apply technical and organizational measures to protect your data, including encryption in transit, access controls and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

The service is not intended for children. We do not knowingly collect personal data from anyone under the age required to use the service in their jurisdiction. If you believe a minor has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will provide reasonable notice. The effective date at the top reflects the latest version.

Plovana is operated by an individual and has not appointed a formal Data Protection Officer. For any privacy question or to exercise your rights, contact us by email at plovana.contact@gmail.com — our sole contact channel.

You also have the right to lodge a complaint with a supervisory authority; in Brazil, this is the ANPD (Autoridade Nacional de Proteção de Dados).