Privacy Notice

TVN Global Limited (trading as LUVI Creator), company number 15019980, registered office 82a James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom, is the controller of the personal data described in this notice. ICO registration number: ZC248767.

Questions and requests: privacy@luvicreator.com. You can also write to the address above, marked "Privacy".

This notice covers the website www.luvicreator.com, the LUVI web application, the LUVI connector for AI assistants (the "MCP connector"), LuviBot, our emails and our support channels (together, the "Services"). It applies under the UK General Data Protection Regulation and the Data Protection Act 2018 and, where you are in the European Economic Area, the EU GDPR.

Account data. Name, email address, password (stored only as a hash), profile picture and language preference; if you sign in with Google, the profile details Google shares with us (name, email, avatar, Google account identifier).

Content you submit ("Input"). Prompts, uploaded images, video, audio and other files, reference material, model settings, messages and files you send to LuviBot, and the rules and settings you save for LuviBot (for example preferred resolution, models you do not want suggested, and your automatic approval and upper limits). Input may contain personal data about you or others, including faces and voices. You are responsible for having the right to submit it.

Generated content ("Output"). The images, video, audio, 3D assets and text generated for you, stored in your library until you delete them.

Usage and technical data. Which models and features you use, credit spend, generation records (job identifier, model, timestamps, status, cost), storage use, folder and project structure, team membership, device and browser type, IP address, approximate location derived from IP, referring URL, and diagnostic logs including error reports.

Payment data. Purchase history, credit balance, invoices and plan status. Card details are collected and stored by Stripe, not by us; we receive only a payment token, the last four digits, card brand and billing country.

Communications. Support emails and messages, feedback and survey answers.

Analytics data. Only if you consent in the cookie banner: page views, clicks and product events sent to PostHog (see the Cookie Policy), including a few events our servers record, such as a completed payment. If you are signed in, your banner choice is also kept with your account so that these server events follow it. Session recording is switched off.

We do not knowingly collect data from anyone under 18 and do not intentionally collect special category data. If your Input contains special category data (for example health information), we process it only to provide the Services you requested. Faces and voices in your Input are used only to generate the Output you asked for: we do not use them to identify, verify or authenticate anyone, and we do not store any faceprint or voiceprint derived from them.

We do not use your Input or Output to train AI models, and we do not sell personal data.

We use these processors and, where stated, independent controllers. Each is bound by a contract that meets UK GDPR Article 28.

Model inference — Atlas Cloud AI Inc. (New York, United States). Your prompts and uploaded media are sent to Atlas, which routes them to the third-party model you selected (providers currently include OpenAI, Google, ByteDance/BytePlus, Alibaba Cloud, xAI, MiniMax, Kuaishou, Black Forest Labs, ElevenLabs, Suno and others; the model page names the provider). Atlas states that it retains submitted content for up to 7 days for service delivery and abuse prevention and does not use it to train models. Each underlying provider applies its own retention and usage terms to content routed to it.

LuviBot — Atlas Cloud AI (see Model inference above). Your LuviBot messages, the files you attach to them and the relevant parts of your account (for example your projects, library items you refer to and your credit balance) are sent through Atlas to the language models that run LuviBot (currently MiniMax M3, developed by MiniMax, and DeepSeek V4.1 Flash, developed by DeepSeek). Atlas may run these models itself in the United States or forward your content to the model's developer, which may process it in other countries, including China, under its own terms. If you do not want your content processed this way, do not use LuviBot; the rest of the Services does not depend on it.

Policy check — TypeSafe AI, Inc. (San Francisco, United States), reached through Vercel AI Gateway. Before LuviBot prepares a paid generation, the prompt and a short description of the attached references are checked against our Terms by an automated classifier. TypeSafe does not train on this content and keeps it only as long as needed to return the result.

Other AI assistance — Anthropic (Claude models; prompt rewriting, automatic tags on your uploads, and captions in workflows). Only the content needed for the feature you invoked is sent.

Hosting and database — Vercel (application hosting, Frankfurt region) and Supabase (Postgres database and authentication, Frankfurt, Germany).

Media storage and delivery — Amazon Web Services (S3 storage and CloudFront delivery, United States). Your uploads and Output are stored here, encrypted at rest, and served only to your browser through short-lived signed cookies.

Payments — Stripe (independent controller for payment processing and fraud prevention; see Stripe's privacy policy).

Email — Resend (transactional email delivery).

Analytics — PostHog (EU cloud, Frankfurt), only with your consent.

Sign-in — Google (independent controller if you choose Google sign-in).

AI assistants you connect through the MCP connector (for example Anthropic's Claude or OpenAI's ChatGPT) receive the data you ask them to act on and are controlled by their own providers under their own terms. You decide what to connect and can revoke it at any time.

Team members. If you join a team, the team leader and co-leaders can see the content in the team workspace, your name and email, and the team's credit spend.

Legal and corporate. Authorities where the law requires; professional advisers; a buyer or successor if the business is transferred, who must honour this notice. If an authority or a court asks us for your data, we will tell you before we disclose it, unless the law prohibits it or telling you would put someone at risk or prejudice an investigation.

Our database and application run in the European Union (Germany). Some processors are in the United States: Atlas Cloud AI and the model providers it routes to, Anthropic, TypeSafe AI, Amazon Web Services (media storage) and Stripe. Content you send to LuviBot may also be processed by the developer of the language model in its own country, which may include China (see section 4).

For transfers to the United States we rely, in this order:

• on the UK Extension to the EU–US Data Privacy Framework (the "UK–US Data Bridge") where the recipient is certified under it, which the UK Government has recognised as providing adequate protection; and
• otherwise on the recipient's data processing agreement incorporating the EU Standard Contractual Clauses with the UK International Data Transfer Addendum approved by the Information Commissioner, together with our assessment of the transfer.

Where a recipient holds a Data Bridge certification, its agreement with us also contains the Standard Contractual Clauses as a fallback. You can ask privacy@luvicreator.com which mechanism applies to a given recipient and for a copy of the relevant safeguard.

We may keep data longer where needed to establish, exercise or defend legal claims, or where the law requires.

You have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased; restrict or object to processing based on legitimate interests; receive the data you provided in a portable format; withdraw consent at any time where processing is based on consent (this does not affect processing before withdrawal); and not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (we make no such decisions).

To exercise a right, email privacy@luvicreator.com from your account email. We will respond within one month, extendable by two months for complex requests, and may ask you to verify your identity. You can also download your Output from your library at any time, delete content yourself, and delete your whole account from the account page (deactivated at once, permanent after a 14-day grace period, after a double confirmation).

You have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). If you live in the EEA you may complain to your local supervisory authority. We would welcome the chance to address your concern first.

Model providers apply automated safety filters to prompts and generated content. We also run our own automated policy check (see section 4) before LuviBot prepares a paid generation; if it finds that a request is likely to break our Terms, LuviBot does not prepare it and tells you why. A request refused by either check is not charged. If you think a request was blocked by mistake, contact support@luvicreator.com and a person will review it. These checks do not produce legal or similarly significant effects on you, and we do not profile you for advertising.

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted to staff who need it, protected by multi-factor authentication and logged. LUVI staff with administrator access can open your LuviBot conversations only to respond to a legal request, to investigate misuse or to handle a support case; each access requires a recorded reason and is logged. Media is served only through signed, short-lived credentials. We keep encrypted backups in a separate, write-protected store. No system is perfectly secure; if we discover a breach affecting your data we will notify you and the ICO as the law requires.

The Services are for adults. We do not knowingly process data of anyone under 18 and will delete it if we learn we have.

We will post changes here and update the date at the top. For material changes we will email you or show a notice in the Services before they take effect.

TVN Global Limited (trading as LUVI Creator), 82a James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom

privacy@luvicreator.com · Data protection lead: the Data Protection Lead, reachable at the same address. We are not required to appoint a Data Protection Officer and have not appointed one.