Privacy Policy

This policy explains what personal data Narva collects, why, and what you can do about it.

What we collect

• Account data: name, email, password hash or Google account id, avatar.
• Content: topics, scripts, uploaded audio, images, video clips, voice samples for cloning, and the videos we generate.
• Billing: handled by Stripe; we store your Stripe customer id, plan and credit history, never your card number.
• YouTube: OAuth tokens (encrypted), channel id, channel name and thumbnail for channels you connect.
• Usage: logs needed to run, secure and improve the Service.

How we use it

Only to provide the Service: generate and store your videos, upload them to channels you choose, process payments, send transactional emails (for example “your video is ready”), prevent abuse and provide support. We do not sell personal data and we do not use your content to train our own models.

Processors

To generate videos we send the necessary parts of your content to AI providers acting on our behalf: Anthropic (scripts and scene planning), ElevenLabs (narration, transcription, voice cloning) and Kie.ai (image and music generation). Files are stored with our hosting and storage providers. Payments are processed by Stripe.

Google user data

Narva’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request the youtube.upload scope to upload videos you explicitly publish and youtube.readonly to show your channel name. We never post, edit or delete anything on your channel without your action. Revoke access anytime by disconnecting the channel or at myaccount.google.com/permissions; we delete the tokens immediately. See also the Google Privacy Policy.

Retention

Your videos and files are kept while your account exists. Deleting a video deletes its files; deleting your account (Settings → Profile) deletes your data within 30 days, except records we must keep for tax purposes.

Your rights

You can access, correct, export or delete your data, and object to processing. Email [email protected]. EU/UK users may also complain to their data protection authority.

Security

Traffic is encrypted with TLS, OAuth tokens are encrypted at rest and media is served through signed, expiring links.