Privacy Policy

1. Who we are

Two companies, with different jobs, and it matters which is which.

• The controller — the company that decides why your data is processed and is answerable for it — is Alvin AI Studio LLC (447 Broadway, 2nd Floor, Suite 3007, New York, NY 10013, United States), the company that sells Evili and takes your payment.
• The processor is NATIVES AI YAZILIM UYGULAMA BİLGİ TEKNOLOJİLERİ REKLAMCILIK DANIŞMANLIK SANAYİ VE TİCARET ANONİM ŞİRKETİ (“Natives AI”), İçerenköy Mah., Topçu İbrahim Sk., Quick Tower No: 8-10D, Ataşehir / İstanbul, Türkiye — a veri işleyen under Turkish law. It develops and operates evili.ai and processes your data on the controller’s instructions. It is also who answers support@evili.ai.

You do not have to work out which is which to exercise a right. Write to support@evili.ai for anything on this page — including a request to see or delete your data — and it reaches the right company.

2. What we collect

2.1. Your account

Your e-mail address, and your name and profile picture if you sign in with Google. Your language preference. A confirmation that you are 18 or over.

2.2. What you upload

The photos you add to a generation. You can also save up to three reference photos so you do not have to re-upload them; those stay until you delete them.

2.3. Face data in your photos

This is the part of the page worth reading slowly, because a photo of a face is treated as sensitive or biometric information in some places — including Illinois, Texas and Washington, and under European law when it is used to identify somebody.

A template puts the person in your photo into a generated scene. To do that, the photo is sent to the AI provider that runs the model, and the model reads the face in it in order to draw it. That is the whole of what happens to it. Specifically:

• We do not run facial recognition. Your face is never used to identify or authenticate you, or to work out who you are.
• We do not create or store a faceprint. No scan of facial geometry, no embedding, no template, no biometric identifier is derived from your photo and kept by us. There is no database of faces here, because the product does not need one to work.
• We do not match you against anything — not other photos, not other users, not any external source.
• We never sell, lease, trade or profit from face data, and we do not disclose it to anyone except the model provider that renders your generation and the storage providers that hold the file (section 4).
• We do not use it for training. Not ours — we have no models of our own — and we choose providers on the basis that API input is not used to train theirs.

Your consent, and how to withdraw it. Nothing is collected from a camera or a public source: you choose a photo and press the button that starts the generation, and that is the consent this processing rests on. You can withdraw it at any time by deleting the saved photo, deleting the generation, or deleting your account — each removes the photo behind it.

Retention and destruction schedule. This paragraph is our published schedule for photographs containing face data, and it is the same one in section 8: the photo behind a generation and the generation itself are permanently deleted 30 days after the generation finishes, from every store that holds them. A saved reference photo is deleted when you delete it, and at the latest when you delete your account. Deleting your account destroys both immediately. We hold no face data for any longer period and for no other purpose.

2.4. What you type

The description on templates that take one. It is screened automatically before it reaches a model.

2.5. What you generate

The resulting video or image, which template made it, and its status while it runs.

2.6. Your coins and payments

Purchases, plan status, and what each generation spent. Card numbers never reach us: the payment page is Stripe’s, and we receive the result, the card brand, the last four digits and expiry, the country of the card, and a customer reference — not the full number and never the security code.

2.7. Technical records

IP address, device and browser, and error logs. Used to keep the service working, to render it correctly, and to stop abuse and fraud.

2.8. What we do not collect

We do not ask for your date of birth, your phone number, your precise location or your contacts. We do not use a device advertising identifier. The analytics and ad-measurement tools we do run, and exactly what they receive, are listed in section 4.5. We do not record your voice or build a voiceprint — no feature on evili.ai takes audio from you.

2.9. Children

Evili is for people aged 18 and over and we do not knowingly collect anything from a child. If you believe a child has an account, write to us and we will remove it. We enforce a zero-tolerance child-safety policy and report apparent child sexual abuse material to the appropriate authorities, including NCMEC.

3. What we use it for

Each purpose below, and the lawful basis we rely on for it if you are in the EEA or the UK. We do not use your data for anything that is not on this list.

4. Who else processes it

Evili is not a model. Making a video means sending your photo to the company that runs the model, so this list is the important part of this page rather than the small print. Each provider gets only what it needs for the job named, and none of them is paid for your data.

4.1. AI model providers

• fal.ai (United States) — runs the generation models. Receives your uploaded photo and your description. We contract on terms that restrict use of your content to serving your request and prohibit its use to train the provider’s own models.
• OpenAI (United States) — screens a typed description before it reaches a model. Receives the text, not your photo.

4.2. Payment

• Stripe — takes card payment on the website and holds the payment record. Receives your name and e-mail, the card details you enter on Stripe’s own page, the amount and currency, your IP address, the card brand, the last four digits and expiry, the card country and a recurring-billing indicator. Stripe is the only payment provider: Evili is sold only on evili.ai, never through an app store.

4.3. Storage and delivery

• Cloudflare — stores and streams your generations (R2 and Stream).
• Amazon Web Services — object storage, the fallback store for the same files.
• Bunny — the CDN that delivers finished media to your device.

4.4. Account messages

• Resend — sends account e-mail: sign-in links, receipts, cancellation confirmations. Receives your e-mail address.
• Google — sign-in, if you use it.

4.5. Analytics and advertising measurement

We do not sell your personal information for money. We do use the tools below to understand how Evili is used and to learn which of our ads bring people who sign up and pay. None of them receives your photos, your prompts, your generations or a share link. There is no session recorder and no data broker.

• Google Analytics 4 shows us how the product is used: which screens are opened, what is made, where sign-in or a purchase fails, and which version of a screen you saw when we test two. Advertising storage, ad personalisation and Google signals are switched off and your IP address is not stored. It sees your account id, so your sessions count as one person.
• AnyTrack is our conversion-measurement provider. Its script records which ad or link brought you to evili.ai (for example a Google or Meta click id and the campaign parameters in the link). When you create an account, add a card or pay, our server tells AnyTrack that it happened, with the amount and currency, your e-mail address, name, IP address, browser, approximate location (city, region, postcode, country) and account id, so it can match the event to the ad you clicked. AnyTrack hashes the e-mail, name and location before passing them on.
• Google Ads and Meta (Facebook, Instagram): AnyTrack loads their measurement tags on evili.ai and reports to them that a visit, sign-up or purchase came from one of their ads. They use this to measure and optimise our campaigns and, under their own terms, may use it to improve their advertising systems.
• GrowthBook decides which version of a screen you see when we test two, using a random identifier kept in one of our own cookies (section 7). It reads results from Google Analytics; it receives nothing about you directly.

With Global Privacy Control on, Google Analytics, AnyTrack and the Google Ads and Meta tags are not loaded, and our server sends no event about you to Google Analytics or AnyTrack, from the first request that carries the signal onward.

4.6. Law, and a sale of the business

We may disclose personal data to law enforcement or another authority where the law, a subpoena or a court order requires it. If the business is merged, acquired or sold, your data may transfer to the acquirer, subject to this policy.

5. Training

We do not use your photos or your generations to train models. We do not have models of our own to train. What the model providers in 4.1 do with data sent to them is governed by their own terms, and we choose providers on the basis that API input is not used for training.

6. International transfers

The providers above are largely in the United States, so if you are in the EEA or the UK your data is transferred outside it. For those transfers we rely on the European Commission’s Standard Contractual Clauses, or the UK International Data Transfer Addendum, or a provider’s certification under the EU–US Data Privacy Framework where it has one. You can ask us which applies to a particular provider.

7. Cookies

This website sets a few strictly necessary cookies: one holds your sign-in session, one lets it be renewed without signing in again, and small flags keep the sign-in and plan screens from sending you round in a loop. Our own measurement cookies remember where you came from (the campaign parameters and ad click id in the link you arrived by, the page you landed on, your language and approximate location: country, region and city) and which version of a screen you were shown, so a test counts you once; they last up to a year. Unless your browser sends a Global Privacy Control signal, the website also sets the cookies of Google Analytics (_ga), AnyTrack, Meta (_fbp, _fbc) and Google Ads, which hold a random identifier and, if you arrived from an ad, that ad's click id (section 4.5). To opt out of measurement, turn on Global Privacy Control in your browser or use a blocker; clearing the sign-in cookies signs you out.

8. How long we keep things

• Generations and the photos behind them — 30 days, then deleted from every store that holds them. Everybody, including subscribers. This is also the destruction schedule for face data in section 2.3.
• Saved reference photos — until you delete them, or until you delete your account.
• Your account — until you delete it.
• Payment records — kept after deletion where accounting and tax law requires it. This is the one thing deleting your account does not erase.
• Technical logs — a short window for diagnosing faults and investigating abuse.

9. Your rights

To exercise any of them, write to support@evili.ai. We answer within 30 days, and sooner in practice. We will not charge you for it or treat you differently for asking.

9.1. Deleting everything

Your account page has a delete button and it does what it says: it cancels any subscription we bill, then removes your generations, your uploaded photos, your saved reference photos, your profile and your coin balance. It is not reversible and there is no waiting period. You do not have to ask us, and you do not have to give a reason.

One thing it cannot do: give back unused coins. They are lost and are not refundable, so if you only want to stop being charged, cancel your plan instead — see Terms sections 8 and 9.

10. Türkiye (KVKK)

Law No. 6698 on the Protection of Personal Data (KVKK) applies to this processing, because Natives AI — the processor named in section 1, and the company that actually holds and handles the data — is established in Türkiye. Under Article 11 you may ask whether your data is processed and for what purpose, ask who it has been transferred to at home or abroad, have it corrected, deleted or destroyed, have those corrections passed on to the recipients above, object to a decision reached solely by automated analysis, and claim compensation for loss caused by unlawful processing. Section 9 is how to exercise any of them — the same address, the same 30 days.

The face data in section 2.3 is özel nitelikli (special-category) personal data under Article 6, and we rely on your explicit consent for it — the generation you started — and on nothing else. Transfers abroad, which is most of section 4, rest on that same explicit consent together with the safeguards in section 6. You may complain to the Kişisel Verileri Koruma Kurulu if you are not satisfied with our answer.

11. If you are in California, or another US state with a privacy law

You have the right to know what we collect and why, to a copy of it, to have it corrected, to have it deleted, and to limit the use of sensitive personal information — and not to be treated worse for exercising any of them. Sections 2 and 4 are the notice at collection: the categories we collect, the purposes, and every recipient.

We do not sell personal information for money. Telling Google and Meta that a visit, sign-up or purchase came from one of their ads (section 4.5) may count as “sharing” for cross-context behavioural advertising under California law, and you can opt out of it: turn on Global Privacy Control, which we treat as an opt-out, or write to support@evili.ai with the subject “Do Not Share”. Face data in a photo you upload is sensitive personal information and is used only to produce the generation you asked for (section 2.3). To exercise a right, write to support@evili.ai; if somebody acts on your behalf we will ask for proof of that.

12. Security

Media is served through signed, expiring links rather than public addresses, sign-in uses short-lived tokens, data is encrypted in transit, and generated files are stored under keys that cannot be guessed from your account. No service is immune, so if a breach ever affects your data we will tell you, and the relevant authority, rather than wait to be asked.

13. Changes

If this policy changes, the date at the top changes with it, and we will e-mail you before a change that materially affects how your data is used takes effect, such as a new category of recipient.

14. Who to contact

Processor, and the address that answers:

• NATIVES AI YAZILIM UYGULAMA BİLGİ TEKNOLOJİLERİ REKLAMCILIK DANIŞMANLIK SANAYİ VE TİCARET ANONİM ŞİRKETİ
• İçerenköy Mah., Topçu İbrahim Sk., Quick Tower No: 8-10D, Ataşehir / İstanbul, Türkiye
• Registered in Türkiye · nativesai.studio
• support@evili.ai

Controller: Alvin AI Studio LLC, 447 Broadway, 2nd Floor, Suite 3007, New York, NY 10013, United States, registered in the United States · alvinai.studio — the seller of every purchase on evili.ai. A request sent to the address above reaches it; you do not need to write separately.

If you are not satisfied with our answer you may complain to your data-protection authority: the Kişisel Verileri Koruma Kurulu in Türkiye, or your local supervisory authority if you are in the EEA or the UK.