Privacy Policy for Noovatar AI

1. Introduction

Welcome to Noovatar AI ("we", "us", "our"), operated by CASA DE PAPEL SARL, with registered address 16 Eugène Rupert, 2453 Luxembourg, Luxembourg. This Privacy Policy governs your use of our application, website, and related services (collectively, the "Service"). Your privacy is important to us. By accessing or using the Service, you agree to this policy.

This policy works in conjunction with our Terms & Conditions, and together they form our agreement with you.

2. Definitions

3. Information We Collect

3.1 Personal Data

When you use our Service, we may collect:

• Registration details (e.g., name, email)
• User-generated content (e.g., text, voice, uploads)
• Optional profile info (e.g., demographics)

3.2 Usage Data

We collect usage metrics, device data, IP addresses, logs, and behavioral analytics.

3.3 Cookies & Tracking Technologies

We employ:

• Session Cookies: for functionality
• Preference Cookies: to store your settings
• Security Cookies: to protect the Service
• Analytics Cookies: to better understand use patterns

3.4 Third-Party Integrations

If you connect external accounts (e.g., OAuth), we may access permitted profile and contact info only with consent.

4. How We Use Personal Data

We use your data to:

• Operate, monitor, and support the Service
• Improve features and personalize your experience
• Communicate updates, service adjustments, or support information
• Conduct technical diagnostics and usage analysis
• Manage legal obligations and security

We will never sell your personal data.

5. Legal Basis for Processing

Under GDPR:

• Consent — for optional data usage (e.g., media improvement)
• Contractual Necessity — to deliver core Service features
• Legitimate Interests — for analytics, security, and service enhancement, balancing your rights

6. Data Sharing & International Transfers

6.1 Service Providers

We may share data with trusted processors—such as hosting, analytics, and support platforms—under GDPR-compliant agreements.

6.2 Legal Obligations

We may disclose your data if required by law or to protect rights or safety.

6.3 Cross-border Transfers

If transferring data beyond the EU, we ensure safeguards like Standard Contractual Clauses.

7. Data Retention & Deletion

We retain data only as needed for the purposes outlined, including legal obligations. You can request deletion or correction anytime via our contact info. Deletion requests will be processed promptly, subject to backup and legal constraints.

8. Your Rights under GDPR

You have the right to:

• Access your personal data
• Rectify inaccuracies
• Erase or restrict processing
• Withdraw consent
• Obtain data portability
• Object to certain processing
• Lodge a complaint with the CNPD (Luxembourg Data Protection Authority)

9. Security Measures

We use industry-standard security (e.g., encryption in transit and at rest, access controls). However, absolute security cannot be guaranteed.

10. Breach Notification

We will notify both the CNPD and affected users within 72 hours of detecting any breach that may result in risk to your rights.

11. Children's Privacy

Our Service is not intended for children under 16. We do not knowingly collect data from minors. If detected, we will delete such data promptly.

12. Updates to This Policy

We may update this Privacy Policy. Material changes will be notified via email or in-app notice, and prior to taking effect. The updated version will always include a revised date.

13. Contact Us

For inquiries or to exercise your rights, contact: