Privacy policy

This policy covers the Lovino website (lovino.ai) and the Lovino app for iPhone and Android. Below, we group what we handle by type of data: what it is, why we keep it, how long, who processes it, and how you can delete it.

Lovino is for people aged 16 or over. See "Children" below.

What: your email address (required), an optional display name and profile picture, and your sign-in method. You can sign in with email, or with Apple or Google where offered. Your credit balance, plan and settings are also part of your account.

Why: to create and secure your account, and to give you your credits and plan.

Who processes it: Supabase (authentication and database, EU region). If you sign in with Apple or Google, that provider confirms your identity to us.

How long: until you delete your account.

What: the photos, video clips and audio you upload or capture, including selfies and other photos used as the input to a tool (Travel, Duo Travel, GlowUp, TimeTravel, Portrait HD, face swap, video and restyle tools, and similar). In the app, Lovino asks for camera, microphone and photo access only so you can choose or capture something. Only what you choose is uploaded.

Why: to make the result you asked for, and to run automated safety checks: that a photo is not sexual or explicit, and that it does not show only children. Facial images are not used for recognition, identification or surveillance.

Who processes it: our AI providers (see "AI processors and other providers"), through temporary, time-limited links. We store uploads in a private Cloudflare R2 bucket.

How long:

• Selfies and the clips, audio and photos you upload as a one-off input to a tool are automatically deleted within 24 hours, and usually sooner, once the result is made. Only the file is deleted. For a selfie, the record is wiped too: the photo link and the face-quality grade are removed, and only an entry with its dates stays until you delete your account.
• Reference and style photos you add in Create, the cartoon filter and restyle photo, product photos you add for ads, and photos you attach in Iris do not expire on their own. They stay until you delete them or your account. Each one is listed in My uploads, where you can delete it.
• Files you save to your Library or Assets, and training photos for a character or Lens, stay until you delete them or your account.

Delete: you can see and delete your uploads, including reference, style and Iris photos, under My uploads: in the app, and on the web under Settings, then Data and privacy. You can also delete files in your Library or Assets. If something is missing from the list, email [email protected] and we will remove it.

What: the text prompts you write, the images, videos and audio we generate for you, their settings and metadata, and your favourites and collections.

Why: to make your results, show them in your Library, and improve and protect the Service.

Who processes it: our AI providers receive your prompt and any inputs you attach, to generate the output. Results are stored in Cloudflare R2.

How long: generated images and videos stay while your account is active, unless you delete them first. Automatic caption transcripts are not kept on our servers after the words are returned to you.

Explore: your creations are private by default. A creation appears on Explore only when you tap Share to Explore on that item. You can turn sharing off again at any time. Creations made from a photo can't be shared.

Delete: remove any item from your Library, or delete your account.

What: your conversations with Iris, our assistant, including any photos you attach in a chat.

Why: so you can continue a chat later and see your history.

Who processes it: our AI providers (see below), which receive your messages and attached photos to reply.

How long: Iris chats are kept until you delete that chat or your account. Deleting a single chat removes its messages; photos you attached in it are not removed with the chat. They are listed in My uploads, where you can delete them, and they are deleted with your account.

Delete: you can see and delete your own chats.

What: your plan, credit purchases and payment status. We never store your card details.

Web: payments are processed by Stripe.

App: purchases made in the app are handled by the Apple App Store or Google Play. We use RevenueCat to manage subscription status for the app.

Why: to take payment, give you credits, prevent fraud and meet tax and accounting rules.

How long: payment records that tax and accounting law require us and our payment processors to keep are kept for that legal purpose, even after you delete your account.

Website: we use Google Analytics for usage statistics, only after you accept cookies, with IP addresses anonymised. We also use essential cookies for sign-in, security and your preferences. You can change your choice with our cookie banner or your browser settings. See our Cookie Policy.

App: the app sends simple usage events (for example, app opens and which tools you use) to a separate Google Analytics property through our own server. There is a "Share usage analytics" switch in Settings. Turn it off and the app stops sending these events.

Why: to understand what works and fix what does not.

What we receive:

• Technical information such as IP address, browser or device type, operating system, app version, referring pages, and time and date of visits
• In the app: a random install ID that helps us spot abuse, such as many accounts created from one device
• In the app, if you allow notifications: a push notification token, used only to tell you when a creation has finished
• Error reports: website, server and app errors are logged with Sentry (errors only, no session replay). In the app, Sentry also records crashes, freezes and slow screens, so we can fix them. These reports carry no name, email, prompt, photo or account ID.

Stored on your device: your app settings and a local copy of your Iris chats and Library list for speed. Deleting the app removes them from the device.

Location: we look up your country once from your IP address (through ip-api.com) and keep only the country code, not the IP address. We also keep the timezone your browser or app reports.

Safety and abuse prevention: to stop ban evasion, fraud and misuse, we record your IP address, device or install ID, and any hit on our content rules (a snippet of the prompt, the matched terms, and a blocked image link). We keep these while your account is active. If you delete your account, we keep the IP address, device ID and content-rule records for up to 12 months, only for preventing ban evasion and fraud, then delete them.

Why: to keep the Service secure, prevent fraud, send the one notification you asked for, and fix bugs.

We share only what each provider needs to do its job. We do not sell your personal information and we do not share it with advertisers.

AI processors

• Replicate: runs the image, video, face and audio models that make your results, including models from Google, Black Forest Labs, ByteDance, Kling, MiniMax and others. It receives your prompts and inputs, including selfies through temporary links. For Duo Travel, Google Gemini runs via Replicate.
• OpenAI: prompt enhancement, Iris chat and safety checks on prompts, photos and generated images and videos (including whether a photo shows only children). It receives your prompts, chat messages, the photos you upload or attach, and still frames of generated videos.
• Vercel AI Gateway: may route some Iris and OpenAI requests when switched on.

Other service providers

• Supabase: authentication and database
• Cloudflare: image and video storage (R2), delivery (CDN) and bot protection (Turnstile)
• Stripe, Apple App Store, Google Play and RevenueCat: payments and subscriptions
• Resend: transactional email
• Vercel and Railway: hosting
• Google Analytics and Sentry: analytics and error logging
• Expo push service and Google Firebase App Check: push delivery and app integrity checks in the app
• ip-api.com: country lookup from IP address

We may also disclose information if required by law, in a merger, acquisition or sale of assets, or with your consent.

We do NOT:

• Sell your personal information
• Use your prompts, generated images, or selfies to train AI models without consent
• Use facial images for recognition, identification, or surveillance purposes

• Selfies and one-off tool inputs (clips, audio, photos): files deleted within 24 hours of upload; a deleted selfie's record is wiped (photo link and quality grade removed), leaving only an entry with its dates until you delete your account
• Reference and style photos (Create, cartoon filter, restyle photo, ad product photos) and photos attached in Iris: until you delete them in My uploads, or your account
• Account data: until you delete your account
• Generated images and videos: while your account is active, or until you delete them
• Files in Library and Assets, and character or Lens training photos: until you delete them or your account
• Iris chats: until you delete the chat or your account; photos attached to a chat stay until you delete them in My uploads or delete your account
• Payment records: as long as tax and accounting law requires
• Safety and abuse records (IP address, device ID, content-rule hits): while your account is active, and up to 12 months after you delete it
• Analytics data: as set in our Google Analytics retention settings

Delete your account: in the Lovino app, go to Settings, then Account, then Delete account. On the web, go to Settings, Data and privacy, then Delete Account. Deleting is permanent. Step by step instructions, and what is deleted or kept, are on our account deletion page.

Cannot sign in? Email [email protected] and we will delete your account and data.

Delete one thing: remove a photo or file in My uploads (app, or web under Settings, then Data and privacy), remove an item from your Library or Assets, or delete a chat.

What happens to your data:

• Your account, Library, uploads, Iris chats and preferences are deleted.
• Safety and abuse records (IP address, device ID, content-rule hits) are kept for up to 12 months, only to prevent ban evasion and fraud.
• Your customer record with Stripe is deleted.
• Payment records that the law requires us to keep are kept only for that legal purpose.
• Files you already saved to your own phone or computer stay with you.

You have the following rights regarding your personal data:

• Access: ask for a copy of your personal data, and export your generated images
• Correction: update or correct inaccurate information
• Deletion: delete your account and data, as described above
• Opt out: unsubscribe from marketing emails, switch off app analytics, and disable non-essential cookies

To exercise these rights, contact us at [email protected] or use the settings in the app or your account dashboard.

• Data is sent over TLS/SSL, with one exception: our country lookup sends your IP address to ip-api.com over plain HTTP, because its free plan has no HTTPS
• Account data is stored in encrypted databases (Supabase, EU region); generated files and uploads are in Cloudflare R2
• Uploads use temporary presigned links and are not publicly accessible
• Passwords are hashed
• Access controls and authentication protect our internal systems

Your information may be processed in countries other than your own. Our primary database is hosted in the EU (eu-central-1). Where data leaves the EEA we rely on safeguards such as standard contractual clauses and data processing agreements with our service providers. By using the Service, you consent to these transfers.

Lovino is not intended for anyone under 16 years of age, on the web or in the app. We do not knowingly collect personal information from anyone under 16. If you become aware that a child has provided us with personal data, please contact us at [email protected] and we will promptly delete it. A parent or guardian may include their children in a photo together with themselves, for example a family photo; photos that show only children may be blocked by our safety checks.

If you are in the European Economic Area (EEA), you also have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time.

To exercise these rights, contact us at [email protected].

Selfie data and GDPR We delete selfie files automatically within 24 hours as a privacy-by-design measure. The photo file in cloud storage is permanently removed. The record is wiped too (photo link and quality grade removed); only an entry with its dates stays until you delete your account. You may also request immediate deletion of a selfie at any time.

Supervisory authority Foldox Limited is established in Ireland, so our lead supervisory authority is the Irish Data Protection Commission (dataprotection.ie). You have the right to lodge a complaint with the Data Protection Commission, or with the data protection authority in your own country of residence.

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification for significant changes

The data controller for Lovino is Foldox Limited, a company registered in Ireland.

If you have questions about this Privacy Policy or our data practices:

General inquiries: [email protected] Support & data requests: [email protected] Privacy & data protection: [email protected]