Privacy Policy

EVEXCA Studio is operated by [Legal entity name — owner to provide], [Registered / postal address — owner to provide] (“EVEXCA”, “we”). This policy explains what personal information we collect through the Service, how we use and share it, and your choices. For privacy questions or requests: [Privacy / data-request email — owner to provide].

Account data. Your email address and name as provided by Google when you sign in, and Google's unique identifier for your account. We never see or store your Google password, and we do not keep Google access tokens. We also record when you accepted our Terms and which version.

Uploaded media. Images and MP4 videos you upload. For uploaded videos we read technical details such as length and dimensions so we can calculate cost and check eligibility.

Prompts and settings. The text you write and the options you choose for each generation, which are stored as part of your generation history.

Generated media. The images and videos produced for you.

Credit and usage records. Each generation (model, settings, status, credits, timestamps) and every credit movement (added, reserved, used, returned).

Payment data. Subscription payments are handled by Stripe. We do not receive or store full card numbers; we receive payment status and billing details from Stripe.

Technical data. Our hosting infrastructure may record technical information such as IP address, browser type, requests and errors for security and troubleshooting. [OWNER DECISION: confirm what the chosen hosting provider logs and for how long]

We use a single session cookie to keep you signed in. It is strictly necessary for the Service, is not readable by page scripts, and lasts up to 30 days or until you sign out. We do not use advertising cookies or third-party analytics on EVEXCA Studio at the time of writing. If that changes we will update this policy and, where required, ask for your consent.

• To provide the Service: sign you in, run your generations, calculate and record credits, show your creations.
• To process payments and manage your subscription.
• To keep the Service safe: detect fraud and abuse, enforce our Terms and investigate problems.
• To communicate with you about your account, security and important changes.
• To meet legal, tax and accounting obligations.

[OWNER DECISION: legal bases for processing, if the GDPR or UK GDPR applies to you]

We do not sell your personal information and we do not share it for cross-context behavioural advertising. We share information only with service providers needed to run EVEXCA Studio, and only what each needs:

• AI generation provider: Higgsfield. To produce a generation we send the inputs you provide (your uploaded files, prompt and settings) to Higgsfield, which runs the model and returns the result, and we may send your uploaded files to its temporary media storage first. Higgsfield handles that data under its own terms and privacy practices, which we do not control. [OWNER DECISION: obtain Higgsfield's written position on retention of API inputs and outputs, any use for model training and any opt-out, and describe it here]
• Hosting. The Service is hosted on Vercel.
• File storage. Uploaded and generated files are stored in private Cloudflare R2 buckets and made available to you only through short-lived links.
• Database. Account and billing records are stored in a managed database. [OWNER DECISION: name the database host and region once chosen]
• Sign-in. Google, which authenticates you and tells us your verified email address and name.
• Payments. Stripe, for subscription billing.
• Legal and safety. Authorities, advisers or successors where required by law, to protect rights and safety, or in a business transfer.

• Files: storage buckets are private (no public access). Files are served only to the signed-in owner through short-lived links, and uploads go directly to storage using time-limited, single-file links.
• Retention: uploaded and generated files are automatically deleted 30 days after they are created. Expired files are no longer accessible and cannot be recovered.
• Security measures: sign-in is handled by Google (we never receive your password); sessions use a secure, HTTP-only cookie; access to media is limited to the account that owns it; credit changes are recorded in an append-only history. No system is perfectly secure, and we cannot guarantee absolute security.

• Generation history and credit history are kept after files are deleted because we need them for billing, accounting and dispute handling. The history includes the prompt and settings you used. [OWNER DECISION: retention period for billing and ledger records, and whether prompt text should also be purged on a schedule]
• Account information is kept while your account is open and for a limited period afterwards where needed for legal, tax or fraud-prevention reasons.

You can download your files any time before they expire. You can delete your account yourself in Account → Settings. Deletion cancels any subscription immediately, removes your sign-in and stored files, and anonymises your account. To ask us to do it for you, contact [Privacy / data-request email — owner to provide]. We will delete or anonymise your account data and remove stored files, except records we must or are permitted to keep (for example billing and ledger records, and information needed to prevent fraud or handle disputes). Data held by providers is deleted under their own processes.

United States. Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas and other states with consumer privacy laws), you may have the right to: know and access the personal information we hold about you; correct inaccurate information; delete personal information; obtain a portable copy; opt out of the sale or sharing of personal information or of targeted advertising (we do none of these); and not be discriminated against for exercising your rights.

To make a request, contact [Privacy / data-request email — owner to provide]. We may need to verify your identity before acting, and we will respond within the period required by applicable law. You may use an authorised agent where the law allows it. If you disagree with our decision you may be able to appeal or contact your state attorney general.

[OWNER DECISION: which privacy regimes apply to your customers (GDPR / UK GDPR, CCPA / CPRA and others) and any required representative or data-protection contact]

Our providers may process data in countries other than your own. [OWNER DECISION: transfer mechanisms (for example standard contractual clauses) once providers and hosting regions are final]

EVEXCA Studio is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has used the Service, contact [Privacy / data-request email — owner to provide] and we will delete the account and related data.

We will update this policy as the Service changes and show the effective date at the top. For material changes we will give notice in the Service or by email.

Privacy questions and requests: [Privacy / data-request email — owner to provide]. Postal address: [Registered / postal address — owner to provide].