Version 3.0 · Effective: 13 October 2026
This policy explains what Aivi 3.0 does with your data, in plain words. Short version: your photos are used only to make your images, we delete them quickly, and you can delete your data in the app at any time.
Zentropi LLC runs Aivi and decides how your data is used. Postal address: Zentropi LLC, 447 Broadway, 2nd Floor Suite #1809, New York, NY 10013, United States. Contact: [email protected].
Your photo (and any text you type, such as a name or hint of up to 200 characters) is sent to our server and shared with our AI processing partner solely to process your request and create your image. Our AI processing partner is a company in the USA. It keeps the images it creates for up to 14 days and its request logs (which include your prompt and links to the input images) for up to 2 months, then deletes them. Its terms allow it to use the content it receives to operate and improve its services.
When you use Create, the text you type (your prompt, up to 500 characters) and the style you pick are sent to our server and to AI service providers to check the request and create your image. Before generating, an automatic check refuses requests for real or identifiable people, sexual content involving minors and explicit content; a refused request costs you nothing. If you turn on "Enhance my prompt", an AI model rewrites your text into a more detailed prompt in the chosen style. Prompts are kept with the image for 30 days and deleted with it. Your prompt goes to the same AI processing partner, with the retention described above.
If you report an image, we store your report (the reason and an optional note) with a reference to the image, so we can review it. Reports are deleted after 90 days, and earlier if you delete your data. Only our owner can see them. Legal basis: legitimate interest in keeping the service safe (Art. 6(1)(f) GDPR).
Raw uploads are deleted automatically within about 1 day. The processed copy of your photo is deleted when your image is done, and at the latest after 7 days. Created images are deleted after 30 days. You can delete any image earlier in the app. Our AI processing partner keeps the images it creates for up to 14 days and its request logs for up to 2 months.
Before your first upload or your first Create, Aivi shows a consent card that says what is sent, who processes it, and that results are kept for 30 days. By tapping Agree and continue on that card you give explicit consent (Art. 6(1)(a) and, for photos of faces, Art. 9(2)(a) GDPR). The processing itself is needed to deliver the image you ask for (Art. 6(1)(b)). To withdraw, go to Settings, Privacy, and switch off "Photo processing". No more photos are sent after that; your library and credits stay. Withdrawing does not affect what happened before.
See "How we handle your photos". We use this data only to make your images. We also keep the images in your library for 30 days.
You do not need to sign up. The first time you open Aivi we create a pseudonymous account for you: it has an ID, not your name. To make misuse harder, your iPhone proves it is a genuine device using Apple App Attest. We store an account ID, a device ID, the public App Attest key and Apple's device receipt, and a secret that lets you get back into your account (we keep only its hash; the secret itself is in your iCloud Keychain). Legal basis: contract, and our legitimate interest in security and fraud prevention (Art. 6(1)(f)).
Signing in with Apple is optional. It is needed before you buy a credit pack, so your credits follow you to a new iPhone. We receive Apple's identifier for you. We do not store your name or email address from Apple. Legal basis: contract.
Payments go through Apple. We use RevenueCat to check subscriptions and purchases. We receive purchase details (product, date, price, status) and keep a record of credits you bought and used. We do not see your card or Apple ID details. Legal basis: contract and legal obligation (tax and accounting law, Art. 6(1)(c)).
We use these to see which screens and styles people use and whether purchases work. Only events from a fixed list are sent, such as onboarding step, paywall view, style opened, generation started or finished, and purchase. Photos, typed text, names and emails are never sent. Mixpanel uses a random ID created on your device (not your account ID). GA4 uses Google's app-instance ID and the iOS vendor ID (IDFV). We do not use the advertising ID (IDFA) and never show a tracking prompt. We also send the GA4 "purchase" event (plan, price and currency) to Google, which we use to measure Google Ads app campaigns. In the EEA, the UK and Switzerland you can withdraw consent in Settings ("Share anonymous usage"); elsewhere you can object by email (see "Legal basis for analytics").
With your consent we use Google Analytics to measure visits; you can change it at any time. Nothing is measured and no analytics cookie is set until you choose "Accept" in the banner; "Decline" is remembered on this device. We measure page views and clicks on App Store links, to learn which pages help people find Aivi. Your IP address is sent to Google to estimate your rough location and is not stored. We have turned off Google signals and all advertising features. The cookies (_ga, _ga_<id>) expire after 14 months, and Google Analytics keeps the data no longer than 14 months. Legal basis: your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG). Google processes the data for us under the Google Analytics terms. Withdrawing consent stops the measurement and removes the cookies.
See How Google uses information from sites that use its services.
Firebase Crashlytics (Google) collects crash logs and basic stability data so we can fix bugs. We add only the style ID, app build and environment. In the EEA, the UK and Switzerland it runs only with your consent (the analytics question; the Settings switch withdraws it), legal basis Art. 6(1)(a). Elsewhere: legitimate interest in a stable app (Art. 6(1)(f)); object by email to [email protected].
In some places in the app you can watch a short ad to earn credits. Ads come from Google AdMob and are loaded only after you tap "watch". We never show banners or pop-up ads. In the EEA, UK and Switzerland, Google's consent form asks for your choice first (basis: consent, Art. 6(1)(a)); if you say no, no ad is loaded and the ad option is hidden. You can change your choice in Settings under "Ad privacy choices" (shown where Google requires it). In other regions our basis is legitimate interest in offering a free option. We do not ask for app tracking permission and do not use the advertising ID. Google may receive technical data such as your IP address and device information to deliver and measure the ad. To give you the reward, Google calls our server with our account ID for you and a one-time code. We record that code, the reward, and your country (from your IP address when you start the ad) to apply daily limits and prevent abuse. We keep these reward records at most 13 months from when you watched the ad, also after account deletion (unused codes are removed after 2 days). We show rewarded ads only, and they are never personalised for users we know are minors.
If you allow notifications, we store your Apple push token so we can tell you when an image is ready. Turn them off in iOS Settings at any time. Legal basis: consent.
If you write to us, we use your email address and message to answer you. If you rate an image or send feedback in the app, we store that and any text you add. Legal basis: legitimate interest and contract. We keep support emails and feedback text for 24 months after the last message.
Our servers keep technical logs without photos or typed text. Web server logs are kept for 14 days. Application logs are kept for 14 days, with account IDs and IP addresses shortened to the first three parts. We apply limits per account, device and IP address. If safety filters refuse several requests, we record that and may pause generation for review. These safety records stay with your account and are deleted with it. Legal basis: legitimate interest in security and safe use.
To create images you must provide a photo and agree to photo processing. Account and device identifiers are needed to run your account; without them Aivi cannot work. Analytics and crash reports (in the EEA, the UK and Switzerland), ads, notifications and Sign in with Apple are optional (Sign in with Apple is needed only before you buy a credit pack).
Some checks are automatic: safety filters on text and images can refuse a request; Apple's device checks and our limits can turn off the free first image or lower limits for a device that looks abusive; repeated refusals can pause generation. These are meant to protect people and prevent fraud. We make no other fully automated decision with legal effect on you. If you think a decision was wrong, write to [email protected] and a person will review it.
Account, device and push data stay until you delete your account, even if you stop using the app. You can delete it any time in the app. Short-lived security records (for example account-recovery attempts) are deleted after 90 days. We keep the record of your consent while your account exists. Reward-ad records (one-time codes, grants, ad transaction ID, country) are kept at most 13 months from when you watched the ad, also after you delete your account (unused codes are removed after 2 days). Support emails and feedback text are deleted 24 months after the last message.
We keep purchase and invoice records as long as tax and accounting law requires, up to 10 years. This includes the technical keys that prevent a purchase from being counted twice. Unprocessed purchase events from Apple and RevenueCat are deleted after 13 months.
See "Deleting your data". Fraud-prevention records are kept at most 3 years from your deletion request. Records that stop people from reusing the free first image (a hash of the device key ID and of the free-claim token) are deleted 12 months after your account deletion is completed and any legally required financial retention (see fraud prevention) has ended. The "free image used" mark and fraud flag in Apple's DeviceCheck stay stored by Apple on Apple's servers; we cannot erase them, and they contain no personal data.
GA4 keeps event data no longer than 14 months. Crashlytics keeps crash traces for 90 days. Mixpanel events are tied to a random ID, not to your account, and Mixpanel keeps them under its own retention rules (currently up to 2 years). Web server and application logs are kept for 14 days. Encrypted backups are kept 30 days and age out within 35 days.
Go to Settings, Privacy & data deletion, then "Delete my data". This closes your account, signs out your devices, and deletes your photos, results, push tokens, consent records, recovery secret and feedback. We also revoke your Sign in with Apple link and delete your RevenueCat record. We reset your analytics ID: data recorded under the old ID is no longer linked to you. Mixpanel keeps it under its own retention rules (currently up to 2 years). The same applies to the GA4 identifier, which is reset; GA4 keeps event data no longer than 14 months. If you have an active subscription, cancel it in your Apple ID settings (the app links to it); deleting your data does not cancel it.
You can also write to [email protected] and ask us to delete your data. We may ask you to prove the account is yours, for example from inside the app.
If you bought something, we keep the financial records (purchases, credits, refunds and their state) for tax and accounting law. While a refund could still happen, or you owe credits after a refund, we also keep a pseudonymous fraud-prevention record: a keyed hash of your Sign in with Apple identifier, plus the purchase records and financial state. We keep it until 180 days after your latest purchase or subscription period end, and 90 days after the last related event, and at most 3 years from your deletion request. We also set a one-bit mark in Apple's DeviceCheck for your device if there is open debt. To stop people from reusing the free first image, we keep a hash of the device key ID and of the free-claim token until 12 months after your account deletion is completed and any legally required financial retention has ended. The mark is stored by Apple on Apple's servers, we cannot erase it, and it contains no personal data. This stops deleting and reinstalling from being used to abuse refunds or the free first image. We also keep an internal account number without personal details, needed for our accounting records. Photos, typed text, name and contact details are not kept. Legal basis: legitimate interest in preventing refund fraud (Art. 6(1)(f)). You can object (see Your rights). We review each objection and delete the record at once if the risk period has ended.
Authorities, when the law requires it. A buyer, if Zentropi LLC is sold or merged, under the same rules as this policy. We do not sell your data.
Where a recipient is outside the EU/EEA, we rely on the EU-US Data Privacy Framework if the recipient is certified, otherwise on the EU Standard Contractual Clauses. Google states that it is certified under the Data Privacy Framework, and RevenueCat offers the Standard Contractual Clauses in its data processing terms. Our server and database are in Germany (Hetzner, Nuremberg); stored photos and results are in Western Europe (Cloudflare R2). Cloudflare is a US company. Our AI processing partner is a US company and may store data in the USA. We have asked it for a data processing agreement with the EU Standard Contractual Clauses.
Aivi is not directed to children, and we do not knowingly collect children's data. If you are under 18 (or under the age of digital consent in your country), you need a parent's or guardian's consent. Rewarded ads are never personalised for users we know are minors. If you think a child has used Aivi without consent, write to us and we will delete the data.
Data is encrypted in transit. Your files are stored privately and reachable only through short-lived links. We use Apple App Attest to make it harder for other devices to use your account, and we limit access to our systems. No system is perfectly secure.
Or write to [email protected]. Because your account is pseudonymous, we may ask you to show it is yours, for example from inside the app. We reply within one month.
We have no establishment in the EU. You can complain to the data protection authority in the EU/EEA country where you live, or to the UK Information Commissioner's Office (ICO).
If we change this policy in an important way, we will tell you in the app before it takes effect. The version and date at the top show the current version.
Questions about this privacy policy?
For questions, requests or complaints about your data, write to us: