Privacy Policy

This Privacy Policy explains how IMVICA ("IMVICA", "we", "us", "our") collects, uses, stores and shares personal data when you use our authority and visibility platform for thought leaders (the "Service"). We act as a data controller for the personal data described below. IMVICA is operated from the United Kingdom and serves members worldwide, so this policy is written to comply with the UK GDPR, the EU GDPR, the Swiss FADP and to address the core expectations of other major privacy regimes including the California Consumer Privacy Act (CCPA/CPRA), the Australian Privacy Act, the Canadian PIPEDA and similar laws.

1. Who we are

IMVICA is operated by Sophie Stardust, based in England and Wales. For any privacy question, request, or to exercise your rights, contact privacy@crvi.app. If you are in the EU you may also contact us at the same address; we will appoint an EU representative on request where required.

2. What we collect

• Account data: name, email address, password hash, authentication metadata, sign-in timestamps and IP address.
• Author profile and content: biographical information, audience, goals, book and brand assets, ideas, drafts, actions, press kit material and any other content you choose to add.
• Prompts and AI inputs: the text, briefs and reference material you submit to AI-assisted features.
• Usage analytics: pages visited, features used, session counts, device type, browser and approximate stage progression. Only collected if you accept analytics cookies.
• Affiliate and referral data: referral codes, click metadata (hashed IP, user agent, referrer) used to attribute commissions.
• Billing data: handled by our payment processor (Stripe). We receive limited metadata such as the last four digits of your card, country and subscription status; we never receive or store full card numbers.
• Support correspondence: messages you send us by email or in-app, and our replies.

We do not knowingly collect special category data (such as health, racial or political information) and we ask you not to upload it. We do not knowingly collect data from children under 16; the Service is not directed at children.

3. How we use your data

• To provide, operate and improve the Service.
• To authenticate you and keep your account secure.
• To generate AI-assisted suggestions from the prompts you submit.
• To process payments and manage subscriptions.
• To run anonymised analytics on platform usage (consent-based).
• To send service emails (essential) and, where you have opted in, product updates.
• To prevent fraud, abuse and to enforce our Terms.
• To comply with legal, tax and accounting obligations.

4. Legal bases (UK / EU GDPR)

• Contract: to provide the Service you have signed up for.
• Legitimate interests: to keep the Service secure, prevent abuse, debug issues and improve features. We balance these interests against your rights.
• Consent: for optional analytics cookies and marketing emails. You can withdraw consent at any time.
• Legal obligation: for tax, accounting, fraud prevention and responding to lawful requests.

5. AI features and your content

IMVICA uses third-party large language models and image models to power suggestions, drafts and other AI-assisted features. When you use these features, the prompts and reference material you submit are sent to the relevant AI provider so they can generate a response.

• We choose providers that contractually commit not to train their models on your prompts by default.
• AI providers may retain inputs and outputs for a short period for abuse monitoring, in line with their own policies.
• AI output can be inaccurate, biased or look similar to existing material. You are responsible for reviewing it before publishing.
• Please do not submit confidential third-party information, special category personal data, or other people's private information into AI features.

6. How long we keep it

Account and content data are retained while your account is active. After you delete your account, we remove personal data from production systems promptly and from encrypted backups within 90 days. Anonymised analytics and aggregated data may be retained for longer. Financial records are kept for up to 7 years to satisfy UK tax law.

7. Who we share data with

• Supabase (database, authentication, file storage), hosted in the EU.
• Cloudflare (infrastructure, security and content delivery).
• Stripe (payments).
• Resend or equivalent provider (transactional email), when configured.
• AI providers (currently including Google and OpenAI) for AI-assisted features.
• Professional advisers, regulators and law enforcement, where legally required.

We never sell your personal data and we do not share it for cross-context behavioural advertising.

8. International transfers

Some of our providers are located outside the UK and EEA, including in the United States. Where personal data is transferred internationally we rely on UK and EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision where one exists. You can request a copy of the relevant safeguards by emailing us.

9. Your rights

Depending on where you live, you may have the right to:

• Access a copy of your personal data.
• Correct inaccurate or incomplete data from inside your account.
• Delete your account and associated personal data.
• Object to or restrict certain processing.
• Receive your data in a portable format.
• Withdraw analytics or marketing consent at any time.
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

US residents (including California) may additionally request information about categories of personal data collected and shared, and may opt out of the "sale" or "sharing" of personal data, although IMVICA does not sell or share personal data as defined under those laws. You can export your data or delete your account from Account settings.

10. Cookies and tracking

Essential cookies keep you signed in and remember your preferences and consent choices. Optional analytics cookies are only set after you accept them in the consent banner; you can change your choice at any time in Account settings. Affiliate referral codes are stored for up to 60 days to attribute commissions.

11. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, encryption at rest, scoped access controls and row-level security on databases. No system is perfectly secure; please use a strong unique password and do not share your credentials.

12. Changes

We may update this policy as the Service evolves. Material changes will be flagged in-app or by email. Continued use of the Service after a change means you accept the updated policy.

13. Contact

Privacy questions or requests: privacy@crvi.app.