Privacy Policy

1. Who operates NOUVETTE

The NOUVETTE service at nouvette.app is operated by AiA 2024 EOOD (registered foreign-language name A&A 2024), a single-member limited liability company registered in Bulgaria under EIK/UIC 207712372. Its registered office is 34 Brigadirska Street, 2650 Sapareva Banya, Municipality of Sapareva Banya, Kyustendil Region, Bulgaria. We are the controller for the personal data described here when determining its purposes and means. Email support@nouvette.app with privacy questions or requests. For the company phone and complete registration details, see our separate company information page.

2. What personal data we process

Depending on which features you use, this can include the following:

• Access and security data: IP address, request date and time, requested page or API path, browser and device information, response status, rate-limit information and pseudonymous visitor identifiers. Our web server produces access logs even if you do not create an account or accept optional analytics.
• Creative content: text/scripts, voice selections, media search terms, PDF text, public blog URL and extracted article content, uploaded MP3s, photos or video, project settings, generated audio/video, editing instructions, job identifiers and processing/error records. Content can itself contain personal data about you or others.
• Accounts and optional tools: if registration is offered and used, email address, password hash, verification or reset records, session information, credits and account operations; if you connect a social account, platform identifier, display name, authorization tokens, permissions and publishing metadata.
• Newsletter and messages: email address, subscription status, source of sign-up, consent/confirmation timestamps, unsubscribe records and information you send to support.
• Browser storage: necessary session and anonymous-access cookies, and drafts and preferences stored locally in your browser. Optional analytics identifiers are explained separately below.

We do not need identity documents to provide the present anonymous creator tools. Please do not submit passwords, financial or health information, sensitive personal data, or another person's private information in scripts or uploads unless you have a lawful reason and it is necessary for your task.

3. Why we use data and our legal basis

Service delivery (GDPR Article 6(1)(b)): receive your requested content, run selected tools, generate or edit outputs, maintain your projects while available, and administer an account or connected publishing feature where used. Without the requested input, we cannot provide the corresponding output.

Security and reliability (Article 6(1)(f)): maintain access logs and rate limits, prevent misuse and unauthorized project access, diagnose failures and preserve service availability. Our legitimate interest is a secure and functioning online service; you can object where applicable.

Newsletter (Article 6(1)(a)): send product updates only if you separately opt in and confirm when that flow is enabled. You can unsubscribe or withdraw consent at any time; withdrawal does not affect prior lawful processing.

Optional Google Analytics (Article 6(1)(a)): measure page usage and traffic sources only after your affirmative choice, if this feature is activated. Simply visiting the site or using the free creator tools does not constitute analytics consent.

Support and legal obligations (Articles 6(1)(f) and 6(1)(c)): respond to your requests, resolve disputes, and preserve information when a specific law requires us to do so. Where necessary to perform a contract, we rely on Article 6(1)(b) instead.

4. Where your content goes and third parties

We process content on our application infrastructure and, depending on the exact feature, may contact external services. This list describes integrations present in the service; it does not mean that every provider receives every script or file.

• Media discovery: Pexels, Pixabay, Wikimedia Commons, Openverse, NASA and DVIDS may receive searches derived from your scene descriptions or related requests; downloaded media and provider metadata return to our service. Public blog import requests the URL you submit from the article's hosting site.
• Optional processing: Groq may receive prompt or scene-planning text where its integration is configured; AI Horde may receive image-generation prompts when its story-image service is selected; Viggle may receive uploaded assets when its optional animation feature is chosen. These third-party processing paths may not be used in every job.
• Messages: Resend may receive your address and email content when email delivery is enabled (for example, verification, newsletter or job notifications).
• Connected publishing: if you deliberately connect YouTube/Google or TikTok, those services receive authorization information and the publishing materials you choose to submit.
• Infrastructure: the website's hosting, networking and security suppliers may process technical service data necessary to operate the platform. Competent authorities may receive data when legally required.

External providers have their own processing and retention terms for data they receive. Some processing may occur outside the European Economic Area. The specific destination and applicable transfer mechanism depend on the enabled provider and its contractual terms; request details of a particular transfer and safeguards through our privacy contact before submitting sensitive content. We have not verified that all providers store data only in the EEA.

5. How long we keep information

• Video, audio and temporary generation assets: the application has a default cleanup window of approximately three hours of inactivity, with periodic sweeps. Active jobs, editor activity, interrupted work, caches and backups can affect actual deletion time. This is not a guarantee that every copy, record or third-party copy disappears exactly three hours after upload.
• Immediate upload workflows: MP3/photo-to-video temporary working folders are scheduled for removal after the response or on failure; interrupted processes may require subsequent cleanup.
• Browser drafts: remain in your own browser storage until you clear them, clear the site's storage or browser settings remove them; server cleanup does not remove your local drafts.
• Session and visitor cookies: the current account-session and anonymous visitor cookies are configured for up to 30 days, subject to earlier expiry or logout.
• Web access logs: our current web-server rotation configuration is daily with 14 archived rotations. Security investigations, other logs and backups may have different retention; do not assume that rotating a log deletes every copy immediately.
• Accounts, newsletter, social connections, billing records (if applicable), and support correspondence: kept while needed for the service, your preferences, applicable statutory obligations or to resolve requests/disputes. A universal automatic deletion deadline is not configured for each of these databases. Contact us to request deletion and learn the applicable criteria for your data.
• Third parties: their retention may differ; please consult the applicable provider terms or request information from us about the enabled feature.

6. Cookies, browser storage and analytics

Necessary storage includes nouvette_anon, used to protect access to anonymous generation jobs, and nouvette_session, used for signed-in sessions if accounts are enabled. Both are configured as Secure, HttpOnly and SameSite=Lax cookies, with a maximum age of 30 days. Your browser may also retain scripts/drafts and editor preferences in local storage, including keys beginning nouvette_; these are not a substitute for downloading your files.

Google Analytics is not currently loaded on our public pages by the prepared site integration. If we activate it, we will provide separate Accept and Reject controls before loading Google's tag, explain how to change or withdraw your choice, and update this notice as needed. After affirmative consent, Google Analytics can receive page paths, referral source, approximate location, browser/device information and pseudonymous analytics identifiers, and may set cookies such as _ga. The planned implementation does not send scripts, editor/job URLs or page-query parameters to Analytics and keeps advertising consent denied. Rejecting optional analytics will not prevent normal access to creator tools. We do not claim that the website's essential server access logs stop when you reject Analytics.

Google's data collection and settings are described in its Analytics documentation and Privacy Policy. Analytics property-level retention settings must be verified before activation; we do not claim a specific period for Analytics user or event data at present.

7. Your privacy rights

Subject to the conditions and exceptions in applicable law, you can request access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You may withdraw consent for newsletters or optional analytics without affecting processing carried out before withdrawal. Send requests to support@nouvette.app; we may need to verify that you control the relevant account or project before disclosing or deleting information. We normally respond within one month, subject to lawful extensions.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), or with another competent supervisory authority in the EU/EEA. You can also contact us first so we can investigate.

8. Security, external links and changes

We use access controls, short-lived workspaces, transport security and other technical safeguards to reduce risk, but no online service can guarantee absolute security. Keep your account credentials and job links private and download finished work before temporary storage expires.

Links to third-party websites, stock providers or connected social networks are subject to their own privacy notices. We may update this policy when service features, providers or legal requirements change; the effective date shown at the top will be updated when a change takes effect. For privacy-related questions, contact support@nouvette.app.

Further information about data protection rights: European Data Protection Board. The General Data Protection Regulation is the governing EU text.