The short version: we collect only what we need to run Hynivo, we don't sell your personal data, we never use your content to train AI models without your separate opt-in consent, and you can access, correct, export or delete your data at any time by emailing [email protected].
1. Who we are
Hynivo Ltd ("Hynivo", "we", "us") is the controller of personal data processed through https://hynivo.sbs and our Services, except where we process data on behalf of business customers as a processor (see section 12).
Privacy contact: [email protected] (subject "Privacy request").
This Policy is designed to meet the requirements of the UK GDPR, the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended (CCPA/CPRA) and other applicable data protection laws.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity & contact | Name, email address, company, job title | You |
| Account data | Login credentials (hashed), preferences, settings, consent records | You |
| Billing data | Billing address, transaction history. Card details are handled by our payment processor; we do not store full card numbers. | You / payment processor |
| AI Inputs & Outputs | Prompts, uploaded files, images, audio, and generated content | You / generated by Services |
| Communications | Messages you send us, support tickets, feedback, survey responses | You |
| Technical & usage data | IP address, device and browser type, pages viewed, timestamps, error logs, feature usage | Automatically |
| Cookie data | Identifiers stored on your device, subject to your consent | Automatically |
Special category data: we do not intentionally collect sensitive data (such as health, biometric, racial or ethnic origin, political opinions, religious beliefs, sexual orientation). Please do not include it in your Inputs unless necessary. If you do, you explicitly consent to its processing solely to deliver the Output you request.
3. How and why we use personal data
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Create and manage your account; provide the Services you request, including processing AI Inputs to generate Outputs | Performance of a contract |
| Process payments, invoicing and tax records | Contract; legal obligation |
| Respond to enquiries and provide support | Legitimate interests; contract |
| Security, fraud prevention, abuse detection and enforcing our policies (including automated safety classifiers) | Legitimate interests; legal obligation |
| Service analytics and improvement using aggregated data | Consent (for non-essential cookies); legitimate interests |
| Training and improving AI models using your Inputs/Outputs | Consent only — separate, opt-in, withdrawable |
| Personalisation | Consent |
| Marketing emails | Consent (or soft opt-in for existing customers where permitted), always with unsubscribe |
| Comply with law, respond to lawful requests, establish or defend legal claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of this assessment.
4. AI processing and your data
- Service delivery: your Inputs are sent to AI models — operated by us or by carefully selected third-party AI providers acting as our processors under written contracts — solely to produce your Output.
- No training without consent: we and our providers do not use your Inputs or Outputs to train or fine-tune models unless you opt in via Consent Preferences or account settings. If you opt in, we de-identify samples where feasible, and you may withdraw at any time; withdrawal stops future use.
- Safety review: Inputs and Outputs may be automatically screened, and in limited cases reviewed by authorised personnel under confidentiality obligations, to detect abuse, investigate reports, or comply with law.
- Automated decision-making: we do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Where automated tools are used (for example, to flag policy violations), you may request human review, express your view and contest the decision by emailing us with the subject "AI appeal".
- Accuracy: AI Output may contain inaccurate personal data. If Output contains incorrect information about you, you may ask us to correct or suppress it.
5. Sharing personal data
We do not sell personal data, and we do not "share" it for cross-context behavioural advertising. We disclose personal data only to:
- Service providers (processors): cloud hosting (e.g. Google Cloud / Firebase), AI model providers, payment processors, email delivery, customer support and analytics tools — bound by contract to use data only on our instructions.
- Professional advisers: lawyers, accountants, auditors and insurers under confidentiality duties.
- Authorities: where required by law, court order, or to protect the rights, property or safety of Hynivo, our users or the public.
- Corporate transactions: a buyer or successor in a merger, acquisition or sale of assets, subject to this Policy.
- Others with your consent or at your direction (e.g. integrations you enable).
6. International transfers
Our providers may process data outside your country, including in the United States. Where personal data is transferred from the UK, EEA or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the UK International Data Transfer Agreement/Addendum, EU Standard Contractual Clauses, or recognised data privacy frameworks, together with supplementary measures where needed. Contact us for a copy of the relevant safeguards.
7. Data retention
| Data | Retention |
|---|---|
| Account data | For the life of your account, then up to 30 days after closure |
| AI Inputs & Outputs | As long as you keep them in your account; deleted items are removed within 30 days. Safety logs up to 90 days unless needed for an investigation |
| Billing records | Up to 7 years, as required by tax and accounting law |
| Support communications | Up to 3 years after the last interaction |
| Consent records | For as long as consent is active, plus up to 6 years as proof of consent |
| Marketing data | Until you unsubscribe or withdraw consent |
| Technical logs | Up to 12 months |
8. Security
We use appropriate technical and organisational measures including encryption in transit (TLS) and at rest, access controls on a least-privilege basis, multi-factor authentication for staff, logging and monitoring, vendor due diligence and staff confidentiality obligations. No method of transmission or storage is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify you and the relevant regulator as required by law.
9. Your rights
Depending on where you live, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten");
- Restrict or object to processing, including profiling and direct marketing;
- Data portability — receive your data in a structured, machine-readable format;
- Withdraw consent at any time, without affecting processing already carried out;
- Not be subject to decisions based solely on automated processing with legal or similarly significant effects;
- California residents: know, delete, correct, opt out of sale/sharing (we do neither), limit use of sensitive personal information, and non-discrimination for exercising rights. You may use an authorised agent.
To exercise your rights, email [email protected]. We may need to verify your identity. We respond within one month (extendable by two further months for complex requests, in which case we'll tell you) or within the period required by your local law. Requests are free unless manifestly unfounded or excessive.
You also have the right to complain to a data protection authority — for example the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority. We'd appreciate the chance to address your concerns first.
10. Cookies and similar technologies
We use strictly necessary storage and, only with your consent, analytics and personalisation technologies. See our Cookie Policy and manage choices on Consent Preferences. We honour Global Privacy Control signals where required by law.
11. Children
Our Services are not intended for anyone under 18, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Business customers (processor role)
When a business customer uses Hynivo to process personal data of its own users, that customer is the controller and we act as processor under a data processing agreement. Individuals should direct requests to that customer; we will assist them as required.
13. Third-party links
Our websites may contain links to third-party sites. We are not responsible for their privacy practices; please read their policies.
14. Changes to this Policy
We may update this Policy from time to time. We will post the new version here with an updated date and, for material changes, notify you by email or in the Services. Where changes require new consent, we will ask for it.
15. Contact us
Hynivo Ltd — [email protected] — or use our contact form.