Privacy Policy

1. Controller

Controller: Mustafa Yesilyayla, c/o flexdienst – #20381, Kurt-Schumacher-Straße 74, 67663 Kaiserslautern, Deutschland

Contact: service@suvory.com

2. Scope & Minimum Age

Our service is intended exclusively for persons aged 18 and over. If you are under 18, please do not use the app.

3. Data we process

• Account data: Email, login provider, technical IDs.
• Usage data: Page views/events (only with consent for Analytics).
• Device & log data: IP address, user agent, timestamps, error logs, and basic diagnostics.
• Content data: Chat inputs, prompts, uploaded files/images.
• Payment/Subscription data: Processing via Stripe (e.g. subscription status).
• Deletion recovery data: After an account deletion we retain only the email address or email addresses linked to the account and the quota/usage state needed to restore already consumed AI budget if the same email returns within 1 year.

Please do not send any special categories of personal data (e.g. health data) via the app.

Important: To provide AI functions, content (prompts, attachments/extracts) may be transferred to AI service providers, depending on the selected model, e.g. via a router (OpenRouter) or directly to OpenAI.

4. Purposes & Legal Bases

• Account & authentication: Art. 6 para. 1 lit. b GDPR (contract performance).
• Billing & subscription management: Art. 6 para. 1 lit. b GDPR; retention obligations: Art. 6 para. 1 lit. c GDPR.
• AI processing & file handling: Art. 6 para. 1 lit. b GDPR.
• Security, abuse prevention, logs: Art. 6 para. 1 lit. f GDPR.
• Post-deletion quota preservation: Art. 6 para. 1 lit. f GDPR (legitimate interest in preventing quota resets through repeated deletion/re-registration, including via previously linked email addresses, and restoring the previously consumed usage state when the same user returns).
• Analytics (Product improvement): Art. 6 para. 1 lit. a GDPR (Consent).

5. Cookies & Analytics

We use necessary storage technologies. Analytics (Firebase Analytics) is only active if you have consented. You can change your selection at any time at /cookies.

6. Email Communications

We may send service-related emails (e.g. account, security, billing). If we send marketing emails, you can opt out at any time via the unsubscribe link.

7. AI Model Processing

To provide AI functions, inputs may be transmitted to third-party AI providers. Where available, we enable data protection settings such as no-training or limited retention. Provider-specific terms apply and may describe their processing in more detail.

8. Recipients / Processors

We use the following service providers (depending on usage):

• Google/Firebase – Auth, database/storage, optional Analytics. Processing location depends on the configured Firebase project.
• Stripe – Payment processing and subscriptions (billing data, invoices). Processing may occur outside the EU.
• OpenRouter – LLM routing and provider access; inputs are forwarded to model providers depending on selection.
• OpenAI – LLM processing of inputs for selected models.
• Runware – Image generation and image editing.

We enter Data Processing Agreements (DPA) with processors. Where required, we use Standard Contractual Clauses (SCCs).

9. Third Country Transfer (per provider)

Depending on provider and server location, transfers to third countries (e.g. USA) may take place, in particular for Stripe, OpenAI, OpenRouter and Runware. We rely on SCCs or adequacy decisions where applicable.

10. Storage Duration & Erasure

• Account & content data: Deleted immediately once you delete your account.
• Usage records: Deleted together with the account, unless statutory retention duties apply.
• Deletion recovery data: After account deletion we retain only your email address or previously linked confirmed email addresses and quota/usage state for up to 1 year. If you register again with one of those email addresses during that period, this state is restored and the recovery record is then removed. If you do not register again, the recovery record is deleted automatically after 1 year.
• Analytics: Stored according to Firebase Analytics settings, only with consent.
• Billing records: Stored as required by statutory retention obligations (e.g. 10 years under § 147 AO).

11. Your Rights & Contact

• Access, rectification, erasure, restriction of processing
• Data portability
• Objection (given legitimate interest)
• Withdrawal of consent with effect for the future
• Complaint to a supervisory authority

You can exercise your rights by email to service@suvory.com. We respond within 30 days.

12. External Links & Affiliate Links

Our website may contain links to third-party sites. We are not responsible for their content or privacy practices. If we use affiliate links, this will not affect your price.

13. Security

We take appropriate technical and organizational measures to protect your data, including encryption of data transmission (SSL/TLS), access controls, and regular backups.

14. Changes

We may update this privacy policy. Status: April 2026