Privacy Policy

Introduction

This Privacy Policy explains how Ryvo, established in the country/region where the operator is established ("Ryvo", "we", "us", "our"), collects, uses, shares and protects personal data when you visit https://ryvo.app, create an account, use our AI short-form video generation studio or otherwise interact with us. Ryvo is the data controller for the processing described in this policy. You can contact us at support@ryvo.app.

This policy applies to visitors, registered users, subscribers and anyone who contacts support. It does not apply to third-party websites or services that we do not control, including the platforms and model providers described below.

Effective date: October 23, 2026.

Data We Collect

Account data

Your name, email address, password hash, profile details, and the authentication method you use (email and password, or a third-party sign-in provider where enabled). We do not store plain-text passwords.

Generation inputs

The text prompts you write, the generation settings you choose (mode, duration, quality and aspect ratio), reference video templates selected from our trend library, reference image or video URLs you provide, and any media or voice samples you upload. Uploaded media may contain personal data, including images of people.

Outputs and activity

The videos generated for you, your download history, generation status and credit usage.

Billing and transaction data

Your plan, order and subscription records, credit balance and credit history, invoice references, payment status, billing country and tax information returned to us by our payment provider. We do not receive or store full card numbers, CVV codes or complete payment credentials.

Support data

Messages, email addresses, attachments and other information you provide when you contact support or report content.

Device, usage and log data

IP address, approximate location derived from IP, browser and device type, operating system, timestamps, pages and features used, generation events, error reports and security logs.

Cookies and similar technologies

Strictly necessary cookies that keep you signed in and protect your session, plus preference cookies that remember your language and interface settings. See the cookies section below.

How We Use Your Information

We use personal data to:

• create and manage your account, authenticate you and secure your session;
• provide the Service, including submitting generation tasks to our model provider, displaying results and letting you download videos;
• manage credits, process orders, maintain subscription records and calculate the credit cost of generations;
• take payments and support tax, invoicing and accounting through our merchant of record;
• provide customer support and respond to your requests, reports and complaints;
• detect, prevent and investigate abuse, fraud, security incidents and violations of our terms or policies;
• moderate content and enforce our Acceptable Use Policy;
• monitor performance, debug errors and improve the features and reliability of the Service, using aggregated or de-identified data where practical;
• send essential service, security and billing notices; and
• comply with legal obligations and respond to lawful requests.

We do not sell your personal data, and we do not use advertising trackers.

Legal Bases for Processing

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

• Contract: to provide the Service you have requested, including generation, credits, downloads, billing and support.
• Legal obligation: to keep tax, accounting and transaction records, and to respond to lawful requests.
• Legitimate interests: to secure and improve the Service, prevent fraud and abuse, moderate content and enforce our policies, in each case balanced against your rights and freedoms.
• Consent: where we ask for it, for example before sending marketing communications or using optional analytics. You can withdraw consent at any time.

Where another data protection law applies, we process personal data on the equivalent lawful grounds available under that law.

Cookies and Similar Technologies

We use strictly necessary cookies to keep you signed in, protect against cross-site request forgery and remember security-related preferences. These cookies are required for the Service to function, so blocking them will prevent sign-in and generation.

We may also use preference cookies for language and interface settings. We do not use advertising, profiling or cross-site tracking cookies. If we enable analytics, they will be aggregate and privacy-friendly, used only to understand which features are used and how the Service performs. You can control cookies through your browser settings.

How We Share Information

We share personal data only with providers that help us operate the Service, and only as needed:

• Cloudflare: hosting and infrastructure, including Cloudflare Workers, the D1 database, object storage and network security.
• Waffo Pancake: merchant of record and PCI-DSS compliant payment processor. It handles card data, tax and VAT, invoices and receipts. Ryvo never stores card numbers.
• EvoLink.AI and ByteDance: we send generation inputs, including prompts and reference media URLs, to EvoLink.AI, our third-party API provider, which accesses the ByteDance Seedance 2.5 model to produce your videos. Outputs are returned to us and stored for your account.
• Email delivery providers: to send transactional messages such as receipts, security notices and support responses.
• Professional advisers and service providers: auditors, legal advisers and IT service providers, under confidentiality obligations.
• Legal and safety: to comply with law, respond to lawful requests from competent authorities, protect our rights or the safety of others, and investigate fraud or abuse.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this policy continuing to apply.

We may share aggregated or de-identified information that cannot reasonably identify you. We do not sell personal data.

International Transfers

Our providers process data in multiple countries, including countries that may not offer the same level of data protection as your country. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and supplementary measures. You can contact us at support@ryvo.app for more information about the safeguards we use.

Data Retention and Deletion

We retain personal data only for as long as needed for the purposes described in this policy:

• Account data is kept while your account is active.
• After you cancel or delete your account, account data is retained for up to 90 days for fraud prevention, dispute handling and legal compliance, then deleted or anonymized, unless longer retention is required by law.
• Order, tax and accounting records are retained for the period required by applicable law.
• Generation inputs and outputs are retained while your account is active or until you delete them.
• Server and security logs are retained for up to 30 days.
• Backup copies may persist for up to 90 days before they expire.
• Deletion requests are carried out within 30 days, unless legal retention obligations apply.

Security

We protect personal data with measures that include encryption in transit using TLS, hashing of passwords, least-privilege access controls, secret management and monitoring. We restrict access to personal data to personnel and providers who need it to operate the Service.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected users without undue delay and, where required, within 72 hours of becoming aware of the breach. No method of transmission or storage is completely secure, so please use a strong, unique password and contact us immediately if you suspect unauthorized access.

Your Privacy Rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data, subject to legal retention obligations;
• restrict or object to certain processing;
• receive your data in a structured, machine-readable format (portability);
• withdraw consent where processing is based on consent; and
• lodge a complaint with your local data protection authority.

To exercise these rights, email support@ryvo.app. We may need to verify your identity before acting on a request. We respond within 30 days, or within any longer period permitted by law, and we will explain if we cannot comply with a request and why.

You can update account details in your account settings and, where available, delete individual videos or reference materials from the studio. Closing your account is described in the Terms of Service (https://ryvo.app/terms-of-service).

Marketing Communications

We currently send only essential service, security and billing notices, such as receipts, payment failures, security alerts and material changes to our policies. We do not send marketing communications without your consent. You can opt out of marketing at any time using the unsubscribe link in any marketing email or by emailing support@ryvo.app. Opting out of marketing does not stop essential service notices.

Children

The Service is not intended for anyone under 18 years old. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, contact us at support@ryvo.app and we will delete it. Where local law sets a higher minimum age for digital services, that age applies.

Third-Party Links and Services

The Service may contain links to third-party websites, and generation depends on third-party model providers. Those third parties have their own privacy policies, and we are not responsible for their processing. We encourage you to review their policies before using their services.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Service, our providers or the law. We will post the new version on this page and update the effective date. For material changes, we will provide at least 15 days prior notice by email or through the Service, unless a change is required urgently by law. If you do not agree with a change, you may stop using the Service and close your account before it takes effect.

Contact Us

For privacy questions or requests, contact our data controller:

Ryvo Country: the country/region where the operator is established Email: support@ryvo.app Business hours: Monday to Friday, 09:00 to 18:00 UTC+8.

You also have the right to complain to your local data protection authority. Please contact us first so we can try to resolve your concern.