Privacy Policy

This policy explains how Hinvel ("we", "us") handles personal data when you use Hinvel at https://hinvel.com. We are the controller of your personal data for the purposes described here. Questions or requests: hello@hinvel.com.

The short version: we collect what we need to run your account, your stories and your conversations with characters; we send text and image prompts to an AI provider to generate content; we don't sell your data or use your chats to train models; analytics only run if you accept them; and you can export or delete your data from Settings.

1. Data we collect

We don't ask for special categories of data (such as health or religion). Please don't include them in prompts or messages; if you do, we process them only to provide the feature you used.

2. Why we use it and our legal bases

We do not sell or rent personal data, and we do not use it for cross-context behavioural advertising. We do not make decisions that produce legal or similarly significant effects about you solely by automated means; automated moderation can hide content pending review, and you can ask for a human review.

3. AI processing

To generate stories, images and character replies we send the relevant prompts — your premise and edits, the story context, and for Talk your message plus the character's memory of you — to our AI inference provider. The provider processes this data on our behalf to return a result. We don't use your messages, memories or Your Content to train AI models, and we only use a published story to improve models if you opt in for that story. More detail in About AI content.

4. Who we share data with

We share personal data only with service providers that process it for us under contract (processors), and only as needed:

Some providers (for example Stripe and Google) also act as independent controllers for their own legal and fraud-prevention purposes, under their own privacy policies. We may also disclose data if required by law, to protect the safety of any person, to investigate abuse, or as part of a merger or acquisition (with notice to you).

5. International transfers

We and our providers may process data in countries other than yours, including the United States. Where data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful transfer mechanism, plus appropriate safeguards. You can ask us for a copy of the relevant safeguards.

6. How long we keep data

• Account data, Your Content, play activity, Talk history and memory: for as long as your account is open. You can delete stories, clear a character's memory or delete your account at any time.
• After you request deletion: your account is scheduled for permanent deletion after a 30-day grace period, during which you can cancel. Deletion then removes your account, content, chats, memory and stored files.
• Retained records: a narrow set of accounting and security records (for example payment receipts and Sparks ledger totals, without message content) is kept for up to 12 months after deletion, or longer if tax or accounting law requires it.
• Data exports are available for a limited time and then deleted.
• Logs and security events are kept for a short period needed for security and troubleshooting.
• Reports and moderation records may be kept longer where needed to prevent repeat abuse or comply with law.

7. Your rights

Depending on where you live (including under the EU/UK GDPR and California's CCPA/CPRA), you may have the right to:

• access your personal data and receive a copy (portability);
• correct inaccurate data;
• delete your data;
• object to or restrict certain processing, including processing based on legitimate interests;
• withdraw consent at any time (this doesn't affect processing before withdrawal);
• opt out of sale or sharing — we don't sell or share personal data for cross-context advertising;
• not be discriminated against for exercising your rights;
• complain to your data-protection authority (for example your EU/EEA supervisory authority or the UK ICO).

8. How to exercise your rights

• Export: Settings → Export my data. We email you when the file is ready; downloading requires you to be signed in.
• Delete: Settings → Delete account (cancellable for 30 days).
• Character memory: Settings → Character memory → Clear.
• AI consent: Settings → turn Talk / free input off.
• Analytics: change your choice on the Cookie Policy page. We also honour Global Privacy Control and Do Not Track signals as a refusal.
• Anything else (access, correction, objection, questions): email hello@hinvel.com from the address on your account. We respond within one month (45 days for CCPA requests), and may need to verify your identity. Authorised agents may contact us with proof of authorisation.

9. Children

Hinvel is only for people aged 18 and over. We don't knowingly collect data from anyone younger. If someone indicates they are under 18 at sign-up, we refuse the account. If we learn that we hold data from a minor, we delete it. If you believe a minor is using Hinvel, tell us at hello@hinvel.com.

10. Security

We use encryption in transit (HTTPS), hashed passwords, access controls and row-level security in our database, least-privilege access for staff, rate limiting and monitoring. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.

11. Changes to this policy

We'll post updates here and change the "Last updated" date. For material changes we'll notify you by email or in the app before they take effect.

12. Contact

Hinvel · Privacy: hello@hinvel.com · Contact page