Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

2. General information on data processing

We process personal data only to the extent necessary to provide Caruva (the “Service”) or where another legal basis applies. The legal bases are, in particular, the performance of a contract or pre-contractual measures (Art. 6 (1)(b) GDPR), compliance with legal obligations (Art. 6 (1)(c) GDPR) and our legitimate interests (Art. 6 (1)(f) GDPR).

3. Hosting and provision of the website

The Service is hosted by Vercel Inc. (USA). When the site is accessed, technically necessary access data (server log files) is processed, in particular IP address, date and time, page accessed, volume of data transferred, referrer and browser and operating-system type. This processing is based on our legitimate interest in stable, secure operation (Art. 6 (1)(f) GDPR). Privacy notice: vercel.com/legal/privacy-policy.

4. Account, authentication and stored data

To use the Service you create an account. Sign-in is via an e-mail one-time code or, optionally, “Sign in with Google”. We store your e-mail address, a pseudonymous user identifier, your selected plan, usage counters and the content you create (inputs/prompts, generated text and images, and any photos you upload). The legal basis is performance of the contract (Art. 6 (1)(b) GDPR).

Database, authentication and file storage are operated via Supabase, Inc. in a data-centre region within the EU (Frankfurt am Main) on our behalf (processor). supabase.com/privacy. If you use Google sign-in, Google’s privacy notice additionally applies: policies.google.com/privacy.

5. Creating content with AI

To generate text and images, your inputs (prompts) and any uploaded photos are transmitted to and processed by the following providers:

• Anthropic PBC (USA)– text generation (“Claude”). anthropic.com/legal/privacy
• Google (Gemini API) – image generation. policies.google.com/privacy

This transfer is carried out to perform the contract (Art. 6 (1)(b) GDPR). According to the respective providers’ terms, content submitted via the API is not used to train their models. Please do not enter special categories of personal data or confidential third-party content.

6. Payment processing

Paid plans are processed via Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA). You enter your payment details (e.g. card data) directly with Stripe; we neither receive nor store full payment data, only the status and a customer identifier used to manage your subscription. The legal basis is performance of the contract (Art. 6 (1)(b) GDPR). stripe.com/privacy.

7. E-mail delivery

We send transactional e-mails (e.g. sign-in codes) via Resend (USA). resend.com/legal/privacy-policy. The legal basis is performance of the contract (Art. 6 (1)(b) GDPR).

8. Reach measurement (analytics)

To improve the Service we use PostHog (EU Cloud, data processed within the EU). We run PostHog without cookies and without persistent storage: no cookies and no persistent identifiers (in particular no localStorage) are placed on your device. Only for the duration of your visit is a temporary session identifier held in your browser’s session storage (sessionStorage), which is automatically deleted when the browser tab is closed. No cross-session or cross-device recognition takes place; session recording and automatic interaction capture are disabled. We process aggregated usage events (e.g. page views) and technical data such as the IP address for rough reach measurement. The legal basis is our legitimate interest in a needs-based design of the Service (Art. 6 (1)(f) GDPR). You may object to this processing at any time (see section 13). posthog.com/privacy.

9. Error and stability monitoring

To detect and fix errors we use Sentry (EU region). In the event of an error, technical data (e.g. error message, affected function, browser and device data, IP address) is processed. No session recording takes place. The legal basis is our legitimate interest in secure, stable operation (Art. 6 (1)(f) GDPR). sentry.io/privacy.

10. Cookies and local storage

For operation we use only technically necessary means: a session token for sign-in and, where applicable, brief local storage to resume a checkout you have started (§ 25 (2) TDDDG). For reach measurement – as described in section 8 – only a temporary session storage that is deleted when the browser tab is closed is used; no cookies are involved.

11. Transfers to third countries

Where data is transferred to providers established in a third country (in particular the USA), this is done on the basis of appropriate safeguards, in particular the EU Commission’s Standard Contractual Clauses (Art. 46 GDPR) and – where the respective provider is certified – on the basis of the EU-US Data Privacy Framework (adequacy decision).

12. Storage period and deletion

We store personal data only for as long as necessary for the stated purposes or as required by statutory retention periods. Non-exported (discarded) generations and their images are automatically deleted after 30 days. You can delete your account at any time, which removes your content and profile.

13. Your rights

You have the following rights vis-à-vis the controller:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests, including reach measurement (Art. 21 GDPR)

To exercise your rights, a message to info@caruva.app is sufficient.

14. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data-protection supervisory authority. The authority competent for us is:

15. Updates and changes

We update this privacy policy whenever changes to our processing activities make it necessary. The version published on this page applies.