Privacy Policy for Havira

2.1 Information You Provide

• Account Information: User ID and authentication credentials (provided through Firebase Authentication)
• Email Address: Email addresses may be collected through Firebase Authentication and are used solely for the purpose of fulfilling data export requests and other account-related communications as necessary for the provision of the Service
• Video Generation Data:
  • Text Prompts: Text descriptions you provide for video generation
  • Reference Images: Images you upload to guide video generation (maximum 1 image for OpenAI Sora, up to 3 images for Google Veo)
  • Processing: Reference images and prompts are processed for video generation and content moderation purposes
  • Retention: Reference images are stored temporarily during video generation and are deleted when you delete your account or video request as described in Section 6
• Payment Information: Transaction data processed through RevenueCat (we do not store credit card details)

2.2 Automatically Collected Information

• Usage Data: Information about how you use our Service, including videos generated and features accessed
• Device Information: Device type, operating system, unique device identifiers, and mobile network information
• Log Data: IP address, access times, app crash reports, user identifiers, and other information necessary for operational, security, and compliance purposes

2.3 Information from Third Parties

• Authentication Data: We use Firebase Authentication to manage user accounts
• Payment Data: RevenueCat provides us with transaction information for in-app purchases

3.1 Essential Services (Legal Basis: Contractual Necessity)

• Providing and maintaining the Service
• Processing your video generation requests
• Managing your token balance and transactions
• Authenticating your identity and managing your account
• Processing payments and preventing fraud

3.2 Service Improvement (Legal Basis: Legitimate Interest)

• Collecting anonymized analytics data to analyze usage patterns and improve our Service
• Anonymized analytics are collected automatically and do not include personally identifiable information (PII) or user IDs
• This data helps us develop new features, fix technical issues, and improve the overall user experience
• Anonymized analytics collection cannot be disabled as it is necessary for service improvement under our legitimate interest

3.3 Communications (Legal Basis: Legitimate Interest / Consent)

3.4 Analytics (Legal Basis: Consent)

• With your explicit consent, we use Google Analytics with full tracking capabilities, including linking analytics data to your user account
• When consent is granted, analytics data is linked to your account ID for better insights and personalization
• When consent is denied, we still collect anonymized analytics (see Section 3.2) but without linking data to your account
• You can grant or withdraw this consent at any time through the app settings (Settings → Privacy → Analytics & Data Collection)
• Important: Even when you disable the Analytics consent toggle, anonymized analytics collection continues automatically for service improvement purposes (see Section 3.2)

3.5 Legal Compliance and Audit Logging (Legal Basis: Legal Obligation / Legitimate Interest)

• Complying with applicable laws and regulations
• Responding to legal requests and preventing misuse
• Maintaining transaction and security-related audit records as required by law
• Recording security- and compliance‑relevant actions (such as account deletion, data export, and certain admin actions) in append‑only audit logs
• Maintaining operational logs containing user identifiers and system information necessary for security monitoring, debugging, and compliance purposes

5.1 Consent Management

You can control the following consent preferences in the app:

• Required: Terms of Service and Privacy Policy acceptance (required to use the Service - processed under contractual necessity, not consent)
• Analytics: Google Analytics tracking with account linking (optional, requires consent)
• Marketing: Marketing communications and future advertising (optional, requires consent)

5.2 Your Rights Under GDPR (EU Users)

If you are located in the European Economic Area (EEA), you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of processing
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

5.3 Your Rights Under CCPA (California Users)

If you are a California resident, you have the following rights:

• Right to Know: What personal information we collect, use, and disclose
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: Equal service regardless of exercising your rights

5.4 Exercising Your Rights

To exercise any of these rights:

Alternatively, email us at support@edusta.dev with your request.

We will respond to your request within:

• GDPR: 30 days (extendable by 60 days for complex requests)
• CCPA: 45 days (extendable by 45 days)

6.1 Active Accounts

We retain your personal information for as long as your account is active or as needed to provide you with our Service.

6.2 Account Deletion and Data Anonymization

When you delete your account using the in‑app tools, we:

• Delete your authentication data from Firebase Authentication
• Delete or clear your consent preferences
• Delete your device tokens (including push notification tokens)
• Delete your video requests and all generated content (videos, thumbnails)
• Delete all reference images you uploaded
• Delete all associated media files stored in our infrastructure
• Delete or anonymize related records in our databases where possible

For certain records, instead of full deletion we may anonymize the data by removing or replacing direct identifiers (such as your user ID) while retaining non‑identifiable information (for example, token transaction history or moderation events without a user link). This is necessary to:

• Comply with legal and accounting obligations
• Maintain accurate aggregate statistics about service usage
• Prevent abuse, fraud, and misuse of the Service

6.3 Legal Requirements

We may retain or anonymize certain records for legal and accounting purposes, including:

• Payment transaction data (as required by tax and financial regulations)
• Security and audit logs for fraud prevention and legal compliance

The retention period for such records typically does not exceed 7 years or as required by applicable law.