Privacy Policy

1. Scope and contact

This Privacy Policy explains how the operator of Flova (fvz.ai; the app name shown at Google sign-in is Flova) (“we” or “us”) collects, uses, shares, stores and protects your personal information when you visit the website, sign in to your account and use the creative features, and what rights you have.

The Service is intended mainly for business users, and the owner of your organization can manage the organization's members and content. Privacy questions and requests to delete account data can be sent to [email protected].

2. Information we collect

Account information: email address, display name, account identifier, organization and role, account approval status, and language and time zone preferences. If you register with an email address and password, we store a hash of the password, never the password itself.

Google sign-in information: when you sign in with Google, we request the openid, email and profile scopes and obtain from Google your unique account identifier, email address and its verification status, and your name. Our current sign-in implementation stores the unique account identifier, email address and name in your website account. We do not ask for your Google password, and we do not request access to Gmail, Google Drive, Contacts or Calendar.

海云星 ERP sign-in information: when you sign in with or link a 海云星 ERP account, we obtain from the ERP your account identifier, email address, name or username, the name of your company and the company's paid status, and we store ERP access tokens in encrypted form with your sign-in session.

Creative and transaction information: the prompts, images, videos, brand assets, model assets and project content you submit; your conversations with the AI assistant; and the generated content, point records, purchase orders (number of points, amount, payment channel, payment order number and payment status) and collaboration information that result from using the Service. Payments are processed by payment service providers; we do not collect or store your bank card number or payment account password.

Operational information: to provide the Service, troubleshoot problems and prevent abuse, we process sign-in sessions, request times, IP addresses and necessary activity and error logs, and we may record the requests sent to AI models and their responses for quality review, cost accounting and security review.

3. How we use information

We use account information to verify your identity, create or link your website account, keep you signed in, manage organization and member permissions, and handle account support requests. Account data obtained through Google sign-in is used for these account functions. When you sign in with Google for the first time, the website creates an organization for you; if an account with the same verified email address already exists, Google sign-in is linked to that account.

We use the creative content you submit to perform the AI analysis, image or video generation, translation and collaboration features you request, and we use order and point information to bill for the Service, reconcile payments and handle refunds or disputes. Necessary operational information is used for service stability, security and risk control (for example, sign-in rate limiting and detection of abnormal accounts), and to send you verification codes, invitations and account notification emails.

We do not sell your personal information, we do not use it for personalized advertising, and we do not use your content to train AI models.

4. Cookies and similar technologies

This website uses only cookies that are necessary to provide the Service: a sign-in session cookie (session), usually valid for 30 days and renewed while you are active; a language preference cookie (NEXT_LOCALE) and a time zone cookie (tz), each valid for one year; and temporary cookies used during Google or ERP sign-in to protect against forged requests, valid for 10 minutes.

We do not use analytics, advertising or cross-site tracking cookies. You can restrict cookies in your browser, but necessary features such as signing in may then stop working.

5. Service providers and sharing

To provide the Service, we engage the following service providers to process the data necessary for the relevant features: cloud servers, databases, object storage and content delivery (Alibaba Cloud, mainly in Singapore); network acceleration, security protection and email delivery (Cloudflare); AI model services, including OpenAI, Google (Gemini), DeepSeek, Volcengine (video generation, in mainland China), Vercel (AI Gateway), Cloudflare Workers AI and other model providers used to complete specific requests; and payment service providers (Alipay and bank checkout).

Google handles sign-in authorization for Google accounts, and 海云星 ERP handles sign-in authorization for ERP accounts. When you use the ASIN feature, we access public Amazon product pages to obtain product information. Authorized members of your organization may see shared content and member profiles.

Apart from the cases above, we disclose information only as necessary to provide the features you request, maintain security, comply with legal obligations, respond to lawful requests from competent authorities, or with your consent. In the event of a merger, acquisition or asset transfer, we will require the successor to continue to comply with this Policy or else to obtain your consent again.

6. Google user data

We do not sell personal information obtained through Google sign-in, and we do not use it for advertising. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can revoke Flova's access in the third-party connections settings of your Google account. Revoking Google access does not by itself delete your existing website account or projects.

7. International processing

The servers and file storage of the Service are located mainly in Singapore. To perform the features you request, your data may be transferred to and processed in other countries or regions where our service providers are located, including the United States and mainland China. We choose service providers with appropriate security capabilities, take the measures required by applicable law, and transfer only the data necessary to complete the request concerned.

8. Retention

We keep your account and project data for as long as needed to provide the Service. Sign-in sessions are usually valid for 30 days and are renewed while you are active; expired sessions are deleted regularly, and you can end your current session by signing out.

Purchase orders and point records are kept for the periods required by accounting, tax and other laws. When you request deletion, we verify the request and handle the applicable account and personal data; records that must be kept for transaction reconciliation, security incidents or by applicable law, and backups that have not yet rotated, may be retained, and we will tell you what is retained.

9. Security

We protect your information with measures such as HTTPS encryption in transit, password hashing, encrypted storage of ERP tokens, protected sign-in cookies, data isolation between organizations, account permission controls and sign-in rate limiting.

No measure is completely secure on the internet. If a personal information security incident occurs, we will take remedial action as required by law and notify you by email, in-product notice or other means.

10. Your rights

On your profile page you can change your name, language and time zone, change your email address with an email verification code, and set or change your password. You can decide whether to use Google sign-in, and you can sign out at any time.

You can write to [email protected] to request access to, a copy of, correction of or deletion of your personal information, to withdraw your consent, or to close your account. The owner of an organization can also remove members from the organization. To protect your account, we may ask you to verify your identity; for shared organization data, transaction records and backups, we will explain the scope of handling for your specific request. We will reply within 15 working days, unless the law provides otherwise.

If you believe that our processing of personal information infringes your lawful rights, you may also lodge a complaint with the personal data protection authority where you live.

11. Minors

The Service is intended for businesses and their staff and is not directed to anyone under 18. We do not knowingly collect personal information from minors; if we discover that we have done so, we will delete it promptly.

12. Changes to this Policy

We will publish updates to this Policy and their effective date on this page. For significant changes to the purposes, methods or scope of personal information processing, we will inform you in advance through the website, by email or by other appropriate means.

13. Contact us

If you have any questions, comments or requests about this Policy or our processing of personal information, please email [email protected].