Privacy policy
This policy explains what personal data Tovano collects when you visit tovano.ai or use the Service, and what we do with it. The controller is Tovano, a company registered in Hong Kong, see the imprint. We follow the Hong Kong Personal Data (Privacy) Ordinance and, for users in the EU and UK, the GDPR.
What we collect
| Data | Why | Kept for |
|---|---|---|
| Name and email address | Your account and sign-in links | While the account exists |
| Sign-in method (email, Google, GitHub) | To let you sign in | While the account exists |
| Billing details, last four card digits | Invoices and receipts | 10 years (tax law) |
| IP address and browser of each sign-in | Security and the activity log | 12 months |
| API requests: model, units, charge, customer tag | Billing and usage reports | 24 months |
| Inputs and outputs of tasks | To run the task and return the result | 30 days |
We never store full card numbers. Payments are handled by our payment provider.
Legal basis
We process this data to perform our contract with you, to meet legal duties (tax and accounting), and for our legitimate interest in keeping the Service secure.
Who receives data
Only the subprocessors we need to run the Service: hosting, email, payments and the model providers that run your tasks. Model providers receive task inputs only, never your account details.
Cookies
| Cookie | Purpose | Kept for | Needs consent |
|---|---|---|---|
tvn_session | Keeps you signed in | 30 days | No, strictly necessary |
tvn_auth | Tells our pages you are signed in, so they only ask the server when you are. No personal data | 30 days | No, strictly necessary |
tvn_consent | Remembers your cookie choice | 12 months | No, strictly necessary |
tvn_attr | Remembers which page or campaign brought you to Tovano, so we know which marketing works | 90 days | Yes, marketing |
_ga, _ga_* | Google Analytics: which pages are used. IP addresses are shortened | 400 days | Yes, analytics |
We don't use advertising cookies. Google Analytics loads only after you accept analytics. Change your choice at any time with Cookie settings in the footer.
Your rights
You can ask to see, correct, export or delete your personal data, and you can object to its use. Write to legal@tovano.ai. You can also complain to your data protection authority.
Security
Data is encrypted in transit (TLS) and at rest. API keys are stored only as hashes. See security.