Privacy Policy
Last updated: 2026-10-16
Cavro ("we") respects and protects your privacy. This Privacy Policy ("Policy") explains how we collect, use, store, and share your personal information when you use Cavro (the "Service"), and the rights you have under applicable law.
Please read this Policy carefully before using the Service. By using the Service you confirm that you have read and agree to this Policy. We may update this Policy from time to time; we will notify you in advance of material changes through email or in-app notice.
1. Data Controller
The data controller for the Service is:
- Company name: CAVRO, LLC
- Registered address: 131 Continental Dr, Suite 305, Newark, DE 19713, New Castle County, United States
- Privacy contact email: support@cavro.ai
- Data Protection Officer (DPO): Appointed. Contact email: support@cavro.ai
2. Information We Collect
2.1 Information You Provide
- Account information: name, email, and profile image.
- Payment information: transaction amount and payment status. We do not store full card numbers — card data is handled by our payment processor (see Section 5).
- Communications: emails, tickets, and feedback you send to support.
- Uploaded content: images, video, prompts, and other material you submit to the Service.
2.2 Information Collected Automatically
- Device and network: IP address, device model, operating system, browser type, time zone.
- Usage behavior: page visits, feature usage, activity logs, session duration.
- Log data: request times, error logs, performance data.
2.3 Information from Third Parties
- Third-party sign-in (Google): we support sign-in through Google. When you sign in, we receive basic profile information authorized by you and your Google privacy settings, such as your name, email address, and profile image.
3. How We Use Your Information
| Purpose | Legal basis |
|---|---|
| Providing and maintaining the Service | Contract performance |
| Billing and payment processing | Contract performance |
| Customer support | Contract performance / Legitimate interest |
| Service notices (billing, security, policy updates) | Legitimate interest |
| Security and fraud prevention | Legitimate interest |
| Product optimization and analytics | Legitimate interest |
| Legal compliance | Legal obligation |
| Marketing — product updates and offers (optional) | Consent |
We may aggregate or de-identify data for statistical analysis. Such data cannot be used to identify you.
4. Cookies and Tracking Technologies
| Type | Purpose | Can be disabled |
|---|---|---|
| Strictly necessary | Maintain sign-in, session, core functionality | No |
| Functional | Theme and language preferences, personalization | Yes |
The Service currently does not use third-party analytics or advertising cookies. If we introduce analytics or marketing cookies in the future, we will disclose the tools and their privacy policies here and, where required, obtain your consent first. You can manage cookies through your browser settings.
5. Sharing and Disclosure
We do not sell your personal information, including as "sale" is defined under applicable law (such as the CCPA). We share your information only in the following situations:
- Service providers: cloud hosting, payment, support, and infrastructure vendors, bound by confidentiality agreements. Payment card data is exclusively processed by our PCI-DSS-compliant payment processor Stripe and is not stored on our servers.
- Third-party AI model providers: to fulfill a generation request, we transmit the inputs you provide (including prompts and reference images) and the corresponding generated output to third-party AI model providers, and receive the generated output back. We do not send them your name, email address, or account credentials.
- Business partners: not applicable; no data is shared with business partners for their own purposes.
- Legal and regulatory requirements: in response to law, court orders, or lawful requests from competent authorities.
- Business transactions: in a merger or acquisition, with prior notice and continued protection obligations.
- With your consent: for other purposes, based on your explicit prior consent.
6. Data Security Measures
- Encryption in transit: TLS / HTTPS.
- Storage security: sensitive data such as account credentials is encrypted or hashed.
- Access control: least-privilege principle; employees sign confidentiality agreements.
- Regular security audits and vulnerability scans.
If a security incident affects your rights, we will notify you and the relevant regulators in accordance with law within 72 hours of discovery, where required. Please keep your account credentials safe and do not share them.
7. Data Retention
| Data type | Retention period | Disposal on expiry |
|---|---|---|
| Account information | While active; 90 days after account deletion | Deleted or anonymized |
| Transaction records | As required by law, typically 7 years | Deleted or archived |
| Support records | 2 years | Securely deleted |
| Security audit logs | 12 months | Securely deleted |
| Uploaded and generated content | Until you delete it or terminate your account; 90 days after cancellation | Securely deleted |
8. Your Data Rights
To exercise the following rights, contact us and we will respond within 30 calendar days.
| Right | Description |
|---|---|
| Right to know | Learn what data we collect and use |
| Right of access | Obtain a copy of your personal information |
| Right to correct | Correct inaccurate or incomplete information |
| Right to delete | Request deletion under certain conditions |
| Right to restrict processing | Pause processing in certain circumstances |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interests or for marketing |
| Right to withdraw consent | Withdraw consent-based processing authorization |
If you believe we have not handled your request properly, you have the right to complain to your local data protection authority.
9. Marketing Communications and Opt-Out
With your consent, we may send marketing information via email or in-app notifications about product updates and offers. You can opt out at any time by clicking the "unsubscribe" link in an email, turning off marketing notifications in account settings, or contacting us. Opting out does not affect service-essential notices (such as billing and security alerts).
10. International Data Transfers
Our servers and partners may be located in United States. Where data is transferred across borders, we safeguard it by:
- entering into data processing agreements incorporating the EU Standard Contractual Clauses (SCCs);
- transferring only to recipients that provide an equivalent level of protection;
- other safeguards, such as adequacy decisions or BCRs.
11. Children's Privacy
The Service is intended for users aged 18 and above. We do not knowingly collect information from anyone below that age. If you believe a minor has provided us with information, please contact us immediately and we will delete it as soon as possible.
12. Third-Party Links and Services
The Service may contain third-party links or integrate with third-party services. This Policy applies only to information we collect directly. We are not responsible for third parties' data practices, and we recommend reviewing their policies before use.
13. Changes to This Policy
For material changes, we will notify you at least 14 days in advance via a platform notice or your registered email, and update the "Last updated" date at the top of this page. Continued use after the effective date constitutes acceptance.
14. Contact Us
- Privacy contact email: support@cavro.ai
- Customer support email: support@cavro.ai
- Company name: CAVRO, LLC
- Mailing address: 131 Continental Dr, Suite 305, Newark, DE 19713, United States
- Service hours: Monday–Friday, 9:00 AM–5:00 PM Eastern Time (ET)
CAVRO, LLC · https://cavro.ai