Privacy Policy

This notice, drawn up under EU Regulation 2016/679 (“GDPR”) and Italian data protection law, describes how Bertuprojects (the “Controller”) processes the personal data of users of the ClavSI platform (the “Service”).

1. Data controller

The data controller is Bertuprojects, with registered office in Milan, Italy, VAT no. 14276770964, reachable at [email protected].

2. Types of data processed

• Registration data: email address, name, password (hashed), OAuth provider if used.
• Profile data: avatar, display name, language, interface preferences.
• Usage data: prompts entered, generations run, assets created, technical logs (IP, user agent, timestamp).
• Payment data: processed by Stripe (Stripe Payments Europe, Ltd.), which processes payments as payment service provider. ClavSI neither receives nor stores the full card number or PayPal credentials: it receives the customer ID, the payment and subscription status, the payment method type with the card's last digits and expiry date, and the billing details entered at checkout (name or company name, address, country, VAT number if any). Stripe also processes some data as an independent controller, for example for fraud prevention and anti-money-laundering obligations: see its notice at stripe.com/privacy.
• Brand kit data: brand name, color palette, fonts and other assets uploaded by the user.
• Cookies and similar technologies: see section 8 and our Cookie Policy.
• Face images and voice recordings: photographs, videos and audio recordings you upload to create avatars, voice clones, lip syncs or other content, and the models derived from them (for example the avatar or the cloned voice). They may concern you or other people who have given you their consent.

3. Purposes and legal bases

• Providing the Service: (Art. 6.1.b GDPR — performance of the contract): account creation, authentication, AI content generation, Credit management.
• Payments and billing: (Art. 6.1.b and 6.1.c — performance of the contract and legal obligations).
• Service communications: (Art. 6.1.b): notifications about your account, security and Credits.
• Security and fraud prevention: (Art. 6.1.f — legitimate interest): rate limiting, access logs, audits.
• Marketing: (Art. 6.1.a — consent): newsletters, product updates. Only with explicit consent, which you can withdraw at any time.
• Processing of faces and voices: (Art. 6.1.b GDPR — performance of the contract; Art. 6.1.a and, where the processing amounts to processing of biometric data, Art. 9.2.a — explicit consent of the data subject): we use images and recordings only to produce the content you request. If the person depicted or recorded is not you, obtaining and documenting their consent is your responsibility (see the Terms, section 5). We do not use faces and voices to identify people, nor to train or improve models without specific, separate consent, which you can withdraw at any time.

4. Third-party AI providers

To provide the generation features we rely on providers of artificial intelligence models and infrastructure (computing and storage). When you use a feature, the prompt, the parameters and, where needed, the images or recordings you uploaded are sent to the relevant provider solely to produce the result. These providers act as processors on our behalf or, where their terms provide for it, as independent controllers. The up-to-date list of providers is available on request.

5. Data retention

• Account and generation data: kept for the duration of the contract and for a further 12 months after it ends.
• Technical logs: 90 days.
• Billing data: 10 years, as required by Italian tax law.
• Marketing data: until consent is withdrawn.
• Faces, voices and derived models: until you delete them in the app or close your account. You can ask us to delete them at any time by writing to us: we delete them, together with the derived models, within 30 days of the request.

6. Your rights as a data subject

You have the right to:

• Access your personal data (Art. 15).
• Ask for their rectification (Art. 16) or erasure (Art. 17 — “right to be forgotten”).
• Restrict their processing (Art. 18).
• Object to processing based on legitimate interest or for marketing purposes (Art. 21).
• Receive your data in a structured, portable format (Art. 20).
• Withdraw the consent you gave at any time (Art. 7).
• Lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it).

To exercise these rights, write to [email protected]. We will reply within 30 days.

Anyone who does not have an account but appears in an image, video or recording uploaded by a user can also exercise these rights and ask for the material and the models derived from it to be removed, at the same address or through the reporting procedure described in the Terms of Service.

7. Transfers outside the EU

Some providers we use (e.g. AI or hosting providers) are based outside the EU. In those cases transfers take place on the basis of standard contractual clauses approved by the European Commission or of adequacy decisions. On request we provide the up-to-date list of sub-processors.

8. Cookies

We use essential technical cookies to sign you in and keep your session, and anonymous analytics cookies to monitor use of the Service. For details and to manage your preferences, see the Cookie Policy.

9. Security

We take appropriate technical and organizational measures to protect your data: encryption in transit (TLS 1.2+) and at rest, role-based access controls, audit logs and daily backups. In the event of a personal data breach, we will notify the competent authorities and the data subjects within the time limits set by the GDPR.

10. Changes

This notice may be updated. Previous versions remain available on request. The date of the last update is shown at the top of the document.