Privacy Policy

Last Updated: October 22, 2026

1. Introduction

Welcome to Havira ("we," "our," or "us"). This Privacy Policy explains how Engin Deniz Usta collects, uses, discloses, and protects your personal information when you use the Havira mobile application and related services, including publicly accessible share pages (collectively, the "Service").

We are committed to protecting your privacy and ensuring transparency about our data practices. This policy complies with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable privacy laws.

Contact Information:

• Service Provider: Engin Deniz Usta
• Email: support@havira.app
• Address: Brennerei 2, 82024, Taufkirchen, Germany

Table of Contents

1. Introduction
2. Information We Collect
   • 2.1 Information You Provide
   • 2.2 Biometric and Face Data
   • 2.3 Automatically Collected Information
   • 2.4 Information Collected from Share Page Visitors
   • 2.5 Information from Third Parties
3. How We Use Your Information
   • 3.1 Essential Services
   • 3.2 Service Improvement
   • 3.3 Communications
   • 3.4 Analytics
   • 3.5 Legal Compliance and Audit Logging
   • 3.6 Administrative Access to User Content
   • 3.7 Automated Decision-Making
   • 3.8 Product Experiments
4. Third-Party Services
   • 4.1 OpenAI Moderation API
   • 4.2 Google (Veo)
   • 4.3 Kling AI
   • 4.4 fal.ai
   • 4.5 Google Firebase
   • 4.6 Google Analytics
   • 4.7 RevenueCat
   • 4.8 Google Cloud Platform
   • 4.9 AppsFlyer
   • 4.10 Vercel Analytics (Website Only)
   • 4.11 Plausible Analytics (Website Only)
   • 4.12 Analytics and Deep-Linking Technologies
   • 4.13 Apple AdServices Attribution (iOS Only)
   • 4.14 Google Play Install Referrer (Android Only)
   • 4.15 Google Vertex AI (Gemini): Image Content Analysis
   • 4.16 Sentry (Backend Error Monitoring)
   • 4.17 Cloudflare Turnstile (Share Page Only)
5. Your Privacy Choices and Rights
   • 5.1 Consent Management
   • 5.2 Your Rights Under GDPR (EU Users)
   • 5.3 Your Rights Under CCPA (California Users)
   • 5.4 Exercising Your Rights
6. Data Retention
   • 6.1 Active Accounts
   • 6.2 Data Deletion and Anonymization
   • 6.3 Legal Requirements
7. Data Security
8. Children's Privacy
9. International Data Transfers
10. Changes to This Privacy Policy
11. Contact Us

• 11.1 For EU Users (GDPR)

1. Legal Basis Summary

2. Information We Collect

We adhere to the principle of data minimization as required by Article 5(1)(c) GDPR, collecting only the personal information that is necessary for the specific purposes outlined in this Privacy Policy.

2.1 Information You Provide

• Account Information: User ID and authentication credentials (provided through Firebase Authentication)
• Email Address: Email addresses may be collected through Firebase Authentication and are used solely for the purpose of fulfilling data export requests and other account-related communications as necessary for the provision of the Service
• Video Generation Data:
  • Text Prompts: Text descriptions you provide for video generation. If you choose to include your prompt when sharing a video, your text prompt will be visible to anyone who views the shared link. You control this for each share via the "Include my prompt" toggle on the share screen
  • Reference Images: Images you upload to guide video generation (up to 5 images for Google Veo and up to 2 images for Kling AI models)
  • Processing: Reference images and prompts are processed for content moderation and safety verification purposes. In addition, when you upload a photo as the first frame for image-to-video generation, that image is analyzed automatically so that the subject you uploaded is preserved in the generated video (see Section 4.15)
  • Retention: Reference images are stored temporarily during the video generation process and are deleted when you delete your account or individual video request as described in Section 6
• Payment Information: Transaction data processed through RevenueCat (we do not store credit card details)

2.2 Biometric and Face Data

Havira does not collect, process, or store biometric data. We do not perform face recognition, biometric identification, or face-embedding computation, and we never use uploaded images to identify, verify, or single out a specific individual.

When you upload a photo as the first frame for image-to-video generation, our system runs an automated content-analysis pass on that image using Google's Vertex AI (Gemini) service (see Section 4.15). This pass produces only a coarse, structured description of the scene (for example, the type of main subject, such as a person, pet, or object, and how many subjects appear), so that our prompt-enhancement step keeps your subject present in the generated video instead of unintentionally replacing it. This analysis does not recognize, match, or identify any individual, does not extract facial features or biometric templates, and is not used to make any decision about you. The description is used in memory for that single generation and is not retained as a separate stored record.

Reference images you upload may contain your face or the faces of others, but Havira treats these images as generic visual inputs for video generation and the content analysis described above only. Reference images are handled exactly as described in this Privacy Policy: they are sent to our content-moderation provider (OpenAI), to Google's Vertex AI (Gemini) service for the content-analysis pass described above (first-frame uploads only), and to the video-generation provider you selected (Google Veo, Kling AI, or fal.ai), stored in Google Cloud Storage during the active life of your account or video, and deleted when you delete the associated video or your account.

2.3 Automatically Collected Information

• Usage Data: Information about how you use the app, such as screens viewed and features used, is collected in the app only if you have switched on Analytics (see Section 3.4). The videos you generate and your transactions are kept on our servers to provide the Service (see Section 3.1)
• Device Information: Device type, operating system, mobile network information, and vendor-scoped device identifiers (IDFV on iOS, Android ID on Android). These identifiers are used to manage push notification delivery and are not advertising identifiers. We do not collect the Apple Identifier for Advertisers (IDFA) or request App Tracking Transparency (ATT) consent. If you switch on Analytics, they are also processed by AppsFlyer and Google Analytics (Sections 4.6 and 4.9)
• Account Activity: For every account, our servers keep the time of your last sign-in (updated at most every 15 minutes), the platform you use (iOS or Android) and the language of your app (see Section 3.2)
• Country: When your account is first created, our servers derive the country from the IP address of that first request and keep only the country, never the IP address (see Section 3.2)
• Attribution Data: Only if you have switched on Analytics: information collected through our deep linking provider (AppsFlyer) and through Apple's and Google's own attribution functions to understand how you discovered and installed the app, including device identifiers, IP address, and app install events (see Sections 4.9, 4.13 and 4.14)
• Log Data: IP address, access times, user identifiers, and other information necessary for operational, security, and compliance purposes

2.4 Information Collected from Share Page Visitors

When a user shares a generated video, a short preview clip and a static thumbnail of the video become accessible to anyone with the share link. If you view a shared link (without being a registered user), we collect limited data:

• IP Address: Used for rate limiting and report deduplication (to prevent abuse of the report feature). IP addresses collected for report deduplication are stored temporarily (24-hour retention) and are not linked to any user account
• Server Access Logs: Standard server logs (IP address, User Agent, access time) are collected for security and operational purposes
• View Count: We keep aggregate view counts for shared content. This is a counter and does not identify individual viewers
• Links to the app stores: Some links on havira.app and in our posts lead through AppsFlyer's link service, which sends you to the right app store for your device (see Section 4.9)

If the video creator chose to include their prompt when sharing, the text prompt used to generate the video is also visible on the share page. If a shared link contains personal information about you without your consent, you may use the report feature on the shared page.

We do not require account registration, cookies, or any form of authentication to view shared content. Our website (havira.app) uses Vercel Analytics and Plausible Analytics to count page views on all pages, including share pages. Neither service uses cookies, fingerprints users, or tracks users across sites (see Sections 4.10 and 4.11). The shared video page also loads Cloudflare Turnstile to protect the report feature against automated abuse. Turnstile processes browser and device signals for that purpose only; it does not use cookies for tracking or advertising and does not profile you across sites (see Section 4.17).

2.5 Information from Third Parties

• Authentication Data: We use Firebase Authentication to manage user accounts. When you sign in with Google, Google shares your name, email address and a link to your profile picture with Firebase Authentication, which stores them in your account record. We use only your email address; we do not read, display or otherwise use your name or profile picture, and they are deleted together with your account. When you sign in with Apple, we request only your email address. If you shared your name through Apple earlier, it may also be held in that record, and we do not use it either.
• Payment Data: RevenueCat provides us with transaction information for in-app purchases

3. How We Use Your Information

We use your personal information for the following purposes:

3.1 Essential Services (Legal Basis: Contractual Necessity)

• Providing and maintaining the Service
• Processing your video generation requests, including content moderation and safety verification
• Managing your credit balance and transactions
• Authenticating your identity and managing your account
• Processing payments and preventing fraud

3.2 Service Improvement (Legal Basis: Legitimate Interest)

• If you have not switched on Analytics, the app collects no analytics data (see Section 3.4)
• For every account, our servers keep the account activity described in Section 2.3: the time of your last sign-in, the platform, the language of your app and the country of your first contact. We keep one value of each, without a history, for as long as your account exists
• From the data our servers already hold to provide the Service (for example accounts created, videos generated and purchases), we compute totals without any user ID, such as how many people use Havira and come back to it. We use these totals to run and improve the Service, not to make decisions about you
• Our legitimate interests are keeping accounts secure, answering your support requests, sending you messages in your language, setting prices and reporting by market, and knowing whether Havira is used and works
• Country: When your account is first created, we derive your country from the IP address of that first request. We keep only the country, never the IP address, and we do not update it later. We use it to set prices and to report on our business by market. It is deleted with your account
• Right to object: You may object to this processing at any time, on grounds relating to your particular situation (Article 21 GDPR), by writing to support@havira.app from the email address of your account or with your account ID. We then stop, unless we can demonstrate compelling legitimate grounds, for example the security of your account, and we tell you the outcome. Deleting your account (Section 6.2) ends this processing

3.3 Communications (Legal Basis: Contractual Necessity / Legitimate Interest / Consent)

• Service Notifications (Contractual Necessity): Push notifications about something you use or asked for, such as your video being ready or having failed, credits added to your account, notices about your subscription and balance, and views of a video you shared, are part of the Service (Article 6(1)(b) GDPR). Reminders about a trial you started, such as that your trial credits are ready to use, are also service notifications. They are not based on consent. They are sent only with your device's notification permission, which you can switch off at any time in your device's notification settings
• Product News & Offers (Consent): Push notifications that promote something, such as product news, new features, new AI providers, new content and special offers, including offers for Havira Pro, are sent only if you have switched on "Product News & Offers" (Article 6(1)(a) GDPR, see Section 5.1). You can switch it off at any time in Settings
• Email Communications (Legitimate Interest):
  • Responding to your requests and inquiries
  • Sending critical service updates and account-related information
  • Data export delivery (as requested by you)

3.4 Analytics (Legal Basis: Consent)

Analytics is optional and off unless you switch it on ("Accept all", or "Analytics" under "Manage" or in Settings). If you switch it on, we:

• use Google Analytics for Firebase with your account ID, to understand how Havira is used and to improve it (see Section 4.6)

• start AppsFlyer, which we use only for deep links and to see how you installed the app (see Section 4.9)

• read Apple's AdServices attribution token (iOS) or the Google Play install referrer (Android) on your device, so that we can see which of our ads or links brought you here (see Sections 4.13 and 4.14)

• Legal Basis: Your consent (Article 6(1)(a) GDPR) and, where information is stored on or read from your device, § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). For users in Türkiye, this consent is also explicit consent (açık rıza) under Article 5(1) KVKK

• If Analytics is off: The app collects no analytics, AppsFlyer does not start, the app does not read the attribution token or the install referrer, and the ad information is deleted. What remains is the processing on our servers described in Section 3.2, which does not rest on consent

• Withdrawal: You may switch Analytics off at any time in Settings. The processing above then stops, and we delete your install attribution record and the campaign attributes stored with RevenueCat. Withdrawing consent does not affect the lawfulness of the processing carried out before the withdrawal

• New Analytics text: Since app version 1.3.0 on iOS and version 1.2.0 on Android, Analytics also covers our ad measurement (Sections 4.13 and 4.14). If you switched on Analytics in an earlier version, the app asks you again, and the ad measurement does not run until you agree to the new text

• You can set your Analytics preference even before you link a Google or Apple account, and the choice you make while using the Service as a guest carries forward when you later link an account

3.5 Legal Compliance and Audit Logging (Legal Basis: Legal Obligation / Legitimate Interest)

• Complying with applicable laws and regulations
• Responding to legal requests and preventing misuse
• Maintaining transaction and security-related audit records as required by law
• Recording security- and compliance‑relevant actions (such as account deletion, data export, and certain administrative actions) in secure audit logs
• Maintaining operational logs containing user identifiers and system information necessary for security monitoring and compliance purposes
• Consent records: When you make a consent choice or accept the Terms of Service and this Privacy Policy, we keep a record of it with the time, the version of the text, your choice, and the IP address and user agent of the request, so that we can show what you agreed to (Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR). We keep these records while your account exists. "Delete my data" removes the IP address and user agent from them; "Delete Account" also removes your user ID
• Retention: App and request logs are kept for 30 days. The audit log covers security events, data-rights requests and administrative actions; it may include your user ID and IP address and is kept for 12 months

Law Enforcement and Legal Requests: We may be required to disclose your personal information to law enforcement agencies, regulatory authorities, or other government bodies when we believe in good faith that such disclosure is necessary to: (a) comply with applicable laws, regulations, legal processes, or enforceable governmental requests; (b) enforce our Terms of Service, including investigation of potential violations; (c) detect, prevent, or otherwise address fraud, security, or technical issues; or (d) protect the rights, property, or safety of Havira, our users, or the public as required or permitted by law.

When legally permitted, we will attempt to notify you of such requests. However, we may be prohibited from providing notice in certain circumstances, including when the request includes a court order prohibiting disclosure or when disclosure would compromise an ongoing investigation.

3.6 Administrative Access to User Content (Legal Basis: Legitimate Interest)

• Authorized administrative personnel may access user-generated content only when necessary for legitimate business purposes, including but not limited to content moderation, user support, security investigations, fraud prevention, or compliance with legal obligations
• Administrative access is restricted to verified personnel and is subject to appropriate access controls and oversight
• Access is limited to the minimum content necessary for the stated purpose and is conducted in accordance with the principle of data minimization
• Users retain control over their content and may exercise their right to deletion as described in Section 6, which will result in the removal of generated content

Only Engin Deniz Usta holds the administrator role. Every time user content is opened in our admin panel, an entry is written to the audit log (see Section 3.5).

3.7 Automated Decision-Making (Legal Basis: Contractual Necessity / Legitimate Interest)

We use automated decision-making processes in the following circumstances:

• Content Moderation: All video generation requests are automatically evaluated for compliance with safety policies and usage guidelines. Content that violates these policies is automatically rejected without human review. This automated processing is necessary to ensure the safety and integrity of our Service and to comply with our terms of service.

• Account Management: Each rejected request counts as a strike, weighted by how clearly the check flagged it. Your account is suspended automatically if your weighted strikes within a short period reach a limit, or if the number of rejected requests over time reaches a higher limit. Requests in the most serious categories lead to an immediate suspension. Such automated decisions are made in accordance with our terms of service and are necessary to prevent abuse and maintain service security.

• What we keep: When a request is rejected, we keep a record of it with your account: the text prompt, the categories and scores of the check, and whether it led to a suspension. We use it to enforce our rules and to review a decision you contest. When you use "Delete my data", we remove the prompt text from the record; the record stays with your account so that a suspension still applies. When you delete your account, we also remove your user ID

• Flagged but allowed requests: If the check flags a request that stays below our limits and is allowed, we keep its text prompt and the scores of the check with your account, to tune the check. We remove the prompt and your user ID from this record when you use "Delete my data" or delete your account; in any case, we delete the record after 90 days

Your Rights: Under GDPR Article 22, you have the right not to be subject to automated decision-making that produces legal effects or similarly significantly affects you. However, automated content moderation and account management decisions are necessary for the performance of our contract with you and for our legitimate interests in maintaining service safety and security. If you believe an automated decision has been made incorrectly, you may contact us to request a review of the decision (see Section 11 for contact information).

3.8 Product Experiments

• Purpose: We test variants of parts of the app, for example a different screen or wording, to find out which works better
• What we process: Your account is assigned to a variant. For each experiment, we record with your account when you were shown a variant and certain outcomes, such as a completed purchase. We evaluate the results as totals per variant
• Legal Basis: Legitimate interest (Article 6(1)(f) GDPR): improving the Service by testing product variants. This does not depend on your Analytics choice
• Retention: These events are deleted 90 days after the experiment ends. "Delete my data" and "Delete Account" delete them earlier (see Section 6.2), and they are included in your data export (see Section 5.4)
• Right to object: You may object by writing to support@havira.app from the email address of your account or with your account ID (see Section 5.2)

4. Third-Party Services

We use the following third-party services to provide and improve our Service:

4.1 OpenAI Moderation API

• Purpose: Content moderation and safety verification for all video generation requests submitted through our Service
• Data Shared: User-provided text prompts, reference images (if uploaded), and still frames taken from generated videos are shared with OpenAI's Moderation API for content safety verification
• Processing: All video generation content is processed through OpenAI's Moderation API to ensure compliance with safety policies and usage guidelines
• Privacy Policy: https://openai.com/policies/privacy-policy

4.2 Google (Veo)

• Purpose: Video generation services from text prompts and reference images (up to 5 images per request: first frame, last frame, and up to 3 reference images)
• Data Shared: User-provided text prompts and reference images (if uploaded, limited to 5 images per request)
• Processing: Your prompts and images are processed by Google's Veo API for video generation purposes
• Privacy Policy: https://policies.google.com/privacy

Extend When you use the Extend feature on a Veo-generated video, the video's storage path in Google Cloud Storage is passed back to Google's Veo API to generate a 7-second continuation. The video remains within Google's infrastructure throughout this process.

4.3 Kling AI

• Purpose: Video generation services from text prompts and reference images (up to 2 images per request: first frame and last frame)
• Data Shared: User-provided text prompts and reference images (if uploaded, limited to 2 images per request)
• Processing: Your prompts and images are processed by Kling AI's API (operated by Kuaishou Technology) for video generation purposes
• Privacy Policy: https://klingai.com/global/docs/privacy-policy

Generated Video Reprocessing (Remix) When you use the Remix feature, the video you previously generated may be sent to Kling AI for processing. This video may contain your likeness if you used a reference photo during the original generation. The video is transmitted via a short-lived, time-limited HTTPS URL (valid for 1 hour) and is used solely to generate your requested remix. After transmission, Kling AI processes the video according to their own privacy policy.

Cross-Provider Note: Generated videos may be processed by different AI providers than the one that originally created them. Specifically, any generated video may be sent to Kling AI if you choose to use the Remix feature.

4.4 fal.ai

• Purpose: AI video generation services
• Data Shared: User-provided text prompts and reference images; video source URLs when using the Remix feature
• Processing: Your prompts and images are processed by fal.ai (Fal AI Inc., United States) for video generation purposes
• Privacy Policy: https://fal.ai/privacy

4.5 Google Firebase

• Purpose: User authentication, device checks (App Check), push notifications (FCM) and, only with your Analytics consent, usage analytics (see Section 4.6)
• Data Shared: User authentication data, device tokens (FCM tokens), vendor-scoped device identifiers (IDFV on iOS, Android ID on Android)
• Device Identifiers: We collect vendor-scoped device identifiers solely for operational purposes, including associating push notification tokens with devices and preventing duplicate registrations. These identifiers are not advertising identifiers and are not shared with third parties for tracking or advertising purposes
• Privacy Policy: https://firebase.google.com/support/privacy

Crash reports from Apple and Google: The app contains no crash reporting SDK, and we do not store or read anything on your device for this purpose. If you have allowed your device to share analytics or diagnostics with app developers in its settings, Apple (through App Store Connect and Xcode) or Google (through Google Play) may make crash reports about Havira available to us. Apple and Google collect these reports as independent controllers under their own privacy policies; we receive crash logs (such as the stack trace, device model, operating system and app version) without our user ID. Legal basis: legitimate interest (Article 6(1)(f) GDPR) in keeping the app stable. You can switch this sharing off at any time in your device settings.

4.6 Google Analytics

• Purpose: Usage analytics, only if you have switched on Analytics (see Section 3.4)
• Data Shared: App usage data (such as screens viewed, features used and app events) with your account ID, and device information
• Only with your consent: Google Analytics collects nothing before you answer the privacy preferences, nothing if you choose "Reject all" or leave Analytics off, and nothing after you switch it off. Advertising signals are always off: we do not use Google Analytics data for advertising
• Legal Basis: Your consent (Article 6(1)(a) GDPR; § 25(1) TDDDG)
• Retention: Google Analytics keeps event-level data for 2 months and user-level data for up to 14 months after your last activity, then deletes it. A copy of this data is exported to our Google Cloud project in the EU for analysis and deleted after 14 months
• Privacy Policy: https://policies.google.com/privacy
• Control: You may switch Analytics on or off at any time in Settings

4.7 RevenueCat

• Purpose: In-app purchase management, subscription processing, refund request handling, and subscription cohort analytics
• Data Shared: Transaction data, user ID, and acquisition campaign identifiers (only with your Analytics consent, see Sections 4.13 and 4.14), for subscription cohort analytics. When you request a refund through Apple, RevenueCat may share purchase consumption data with Apple on our behalf (including account tenure, purchase history, and refund history) to assist Apple in processing your refund request
• Privacy Policy: https://www.revenuecat.com/privacy

4.8 Google Cloud Platform

• Purpose: Storage of generated videos and uploaded reference images
• Data Shared: Generated video files and reference images uploaded by users to guide video generation
• Privacy Policy: https://cloud.google.com/terms/cloud-privacy-notice

Other service providers: We also use the following service providers, each as a processor on our behalf under a data processing agreement: Supabase (our database, hosted in Ireland); Redis Cloud (Redis Ltd.), which provides short-lived counters and caches for rate limits (servers in Frankfurt, Germany, EU); SMTP2GO (delivery of emails such as your data export, sent from servers in the EU; SMTP2GO is based in New Zealand, for which the European Commission has adopted an adequacy decision); and Vercel (hosting of the website havira.app).

4.9 AppsFlyer

• Purpose: Deep links, including deferred deep links (a link you tapped before installing the app opens the right content once the app is installed), and install attribution (which of our links or campaigns led to your install). We do not send in-app events or purchases to AppsFlyer
• Only with your consent: The AppsFlyer SDK starts only after you have switched on Analytics (see Section 3.4) and stops when you switch it off. Without it, links you tap are opened by the app itself; deferred deep links and some short links then do not work
• Data Shared:
  • Device identifiers: IP address, User Agent, Android ID (Android), IDFV (iOS). We do not collect the Apple Identifier for Advertisers (IDFA) on iOS or the Google Advertising ID (GAID) on Android
  • Device information: Device model, OS version, system language, timezone
  • App events: App install event, deep link click data
  • Account ID: Current versions of the app (iOS 1.3.0 and later, Android 1.2.1 and later) do not send your Havira account ID to AppsFlyer. Earlier versions did, so that the install could be matched to your account
• Data NOT Collected: AppsFlyer does not collect precise GPS location data through our integration. We do not collect the IDFA or request App Tracking Transparency (ATT) consent on iOS
• Processing: AppsFlyer processes this data as a data processor on our behalf, subject to AppsFlyer's Data Processing Addendum (DPA) and in accordance with applicable data protection laws
• Retention: AppsFlyer keeps user-level data only for a limited period set by its own retention rules, and aggregated reports for up to 25 months. When you switch Analytics off, use "Delete my data" or delete your account, for installs from earlier versions of the app we automatically ask AppsFlyer to erase the data linked to your account ID. For installs from current versions, AppsFlyer holds no account ID for you, and its data is kept only under AppsFlyer's own retention rules. You can also ask us at any time (support@havira.app)
• Legal Basis: Your consent (Article 6(1)(a) GDPR; § 25(1) TDDDG). For users in Türkiye, this consent is also explicit consent (açık rıza) under Article 5(1) KVKK
• Privacy Policy: https://www.appsflyer.com/legal/services-privacy-policy/
• Opt-Out: Switch Analytics off in Settings at any time (see Section 5.1). The SDK then stops
• Links on our website and in our posts: Some links on havira.app and in our posts lead through AppsFlyer's link service. When you tap one, AppsFlyer, as our processor, processes your IP address, browser and device type, the time and the link parameters to send you to the right app store and, if you install the app and switch on Analytics, to open the linked content and count the install. Legal basis: legitimate interest (Article 6(1)(f) GDPR) in sending visitors to the right destination and knowing which of our links are used

4.10 Vercel Analytics (Website Only)

• Purpose: Website analytics (page views, Web Vitals performance metrics) for havira.app
• Data Collected: Page URL, referrer URL, browser type, device type, operating system, geographic region (country-level). No cookies are set, no user fingerprinting is performed, and no cross-site tracking occurs
• Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR): we have a legitimate interest in understanding aggregate website usage to maintain and improve our web presence. This processing is minimal and does not affect your rights or freedoms
• Data NOT Collected: Vercel Analytics does not collect IP addresses for analytics purposes, does not use cookies or localStorage for tracking, and does not identify or track individual visitors across sessions
• No storage on your device: Vercel Web Analytics sets no cookies and stores nothing on or reads nothing from your device, so no consent under § 25 TDDDG is required
• Privacy Policy: https://vercel.com/legal/privacy-policy

4.11 Plausible Analytics (Website Only)

• Purpose: Privacy-friendly website analytics for havira.app. We chose Plausible because it is built with privacy by design: it gives us the aggregate traffic insights we need without any of the data collection typical analytics tools require
• Data Collected: Page URL, referrer URL, UTM campaign parameters (source, medium, campaign), browser type, device type, operating system, and country-level geographic region. All statistics are aggregated; individual visits are never stored or identifiable
• No Cookies: Plausible does not use cookies or any persistent identifiers. It uses your IP address only briefly to count a visit and stores no IP address or identifier of you. It does not fingerprint users or track users across sessions or websites
• No storage on your device: Plausible sets no cookies and stores nothing on or reads nothing from your device, so no consent under § 25 TDDDG is required
• Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR): we have a legitimate interest in understanding aggregate website traffic to maintain and improve our web presence. This processing is minimal and does not affect your rights or freedoms
• Data Location: Plausible is an EU-based company; all data is processed and stored on EU infrastructure
• Privacy Policy: https://plausible.io/privacy

4.12 Analytics and Deep-Linking Technologies

We use analytics and deep-linking technologies within our mobile applications to provide, maintain, and improve our Service. We do not track you across other companies' apps or websites, we do not use your data to target or personalize ads, and we do not share it with data brokers. These technologies are implemented through Google Analytics, AppsFlyer, and Firebase, and are categorized as follows:

• Essential: These technologies are necessary for the Service to function properly and are processed under contractual necessity pursuant to Article 6(1)(b) GDPR. They support essential functionality including authentication and session management. These cannot be disabled as they are necessary for the Service to operate.

• Analytics: Analytics covers linking your use of Havira to your account (Google Analytics with your account ID), deep links and install attribution through AppsFlyer, and our own measurement of which of our ads or links brought you here, through Apple's AdServices attribution token (iOS) and the Google Play install referrer (Android) (see Sections 3.4, 4.9, 4.13 and 4.14). It is optional and requires your consent pursuant to Article 6(1)(a) GDPR and § 25(1) TDDDG. It is off unless you switch it on. When it is off, the app collects no analytics and the ad information is deleted; Section 3.2 describes what our servers keep without your consent. You may grant or withdraw consent for Analytics at any time in the Service's settings.

• Product News & Offers: Product News & Offers consent (formerly "Marketing") is used for push notifications about product news, new features, new AI providers, new content and special offers. It is optional and requires your consent pursuant to Article 6(1)(a) GDPR. We do not share data with advertising partners. If we ever do, we will name each partner in this Privacy Policy and ask for your consent again, with a new text, before any data is shared. You may grant or withdraw this consent at any time in the Service's settings.

Managing Preferences: You may control your preferences for Analytics and Product News & Offers through the Service's privacy preferences. Essential technologies cannot be disabled as they are necessary for the Service to function. You may also manage app permissions, such as notifications, through your device settings. For more information, please refer to your device documentation.

Third-Party Providers: The technologies used within our mobile applications are implemented through Google Analytics (https://policies.google.com/privacy), AppsFlyer (https://www.appsflyer.com/legal/services-privacy-policy/), and Firebase (https://firebase.google.com/support/privacy). For detailed information about each provider's data practices, please refer to their respective privacy policies as described in Sections 4.5, 4.6, and 4.9.

4.13 Apple AdServices Attribution (iOS Only)

• Purpose: Measuring which of our paid App Store ads (Apple Ads, formerly Apple Search Ads) led to an install of the app, so that we can judge which campaigns are worth running. We do not use this information to show you ads, to personalize ads or to track you across other companies' apps or websites
• Only with your consent: The app reads the attribution token only after you have switched on Analytics in the privacy preferences (see Sections 3.4 and 5.1). Analytics covers this measurement since app version 1.3.0; if you switched on Analytics in an earlier version, the app asks you again and does not read the token until you agree to the new text. If you do not switch on Analytics, the app does not read the token and none of the processing described in this section takes place
• What the app reads and sends: With your consent, the iOS app asks Apple's AdServices framework on your device for an attribution token and sends it to our backend in a request authenticated with your account. The token is a signed string generated by Apple and valid for 24 hours. It does not contain the Apple Identifier for Advertisers (IDFA)
• What Apple returns: Our backend sends the token to Apple's AdServices server. Apple replies either that the install did not come from an Apple ad, or with the details of the ad, such as the campaign, ad group, keyword and ad identifiers, our organization identifier at Apple Ads, the conversion type (download or redownload), the country or region of the campaign and, where Apple provides it, the click date. Apple returns no device identifier and no IDFA
• How we store it: We store Apple's reply, or the fact that the install did not come from an Apple ad, together with your account. Because this attribution record is linked to your account, it is personal data
• RevenueCat: If the install came from an ad, we also send the campaign, ad group and keyword identifiers and the source label "Apple Search Ads" to RevenueCat, which stores them as attributes of your customer record. RevenueCat processes them on our behalf as a processor, so that we can compare subscriptions by campaign (see Section 4.7)
• Retention: We keep the attribution record for 12 months after it is created, or until you withdraw your consent or delete your data or account, whichever comes first
• Withdrawal: You can withdraw your consent at any time by switching off Analytics in the app's settings. We then delete your attribution record and the campaign attributes stored with RevenueCat. Withdrawing consent does not affect the lawfulness of the processing carried out before the withdrawal
• Apple's role: Apple processes the token and its own advertising data as an independent controller under its own privacy policy; Apple is not our processor. We receive from Apple only the campaign details described above (source: Apple, Article 14 GDPR). No third-party attribution provider is involved in this flow; AppsFlyer is not involved
• Legal basis: Your consent: Art. 6(1)(a) GDPR for the processing, and § 25(1) TDDDG for reading the token from your device. For users in Türkiye, this consent is also explicit consent (açık rıza) under Article 5(1) KVKK
• No ATT prompt: AdServices attribution does not use the IDFA and does not require App Tracking Transparency (ATT) consent, so the app does not show the ATT prompt. This is separate from your Analytics choice, which the app always asks for
• Privacy Policy: https://www.apple.com/legal/privacy/

4.14 Google Play Install Referrer (Android Only)

• Purpose: Measuring which of our paid Google Play campaigns (Google Ads) or other marketing links led to an install of the app, so that we can judge which campaigns are worth running. We do not use this information to show you ads, to personalize ads or to track you across other companies' apps or websites
• Only with your consent: The app reads the install referrer only after you have switched on Analytics in the privacy preferences (see Sections 3.4 and 5.1). Analytics covers this measurement since app version 1.2.0 on Android; if you switched on Analytics in an earlier version, the app asks you again and does not read the install referrer until you agree to the new text. If you do not switch on Analytics, the app does not read the install referrer and none of the processing described in this section takes place
• What the app reads and sends: With your consent, the Android app reads the install referrer from Google Play on your device through the Play Install Referrer Library: the campaign parameters (UTM parameters) of the link that led to the install, and the times of the click and of the install. The app sends them to our backend in a request authenticated with your account. The install referrer does not contain the Google Advertising ID (GAID)
• What we derive: Our backend extracts the campaign, source, medium and, where present, the ad group and keyword. It does not contact Google for this. If the install referrer is empty, we record that the install did not come from a tagged link
• How we store it: We store the result and the install referrer together with your account. Because this attribution record is linked to your account, it is personal data
• RevenueCat: If the install came from a tagged link, we also send the campaign, ad group and keyword and the source label "Google Ads" to RevenueCat, which stores them as attributes of your customer record. RevenueCat processes them on our behalf as a processor, so that we can compare subscriptions by campaign (see Section 4.7)
• Retention: We keep the attribution record for 12 months after it is created, or until you withdraw your consent or delete your data or account, whichever comes first
• Withdrawal: You can withdraw your consent at any time by switching off Analytics in the app's settings. We then delete your attribution record and the campaign attributes stored with RevenueCat. Withdrawing consent does not affect the lawfulness of the processing carried out before the withdrawal
• Google's role: Google provides the install referrer as part of Google Play, which you use under Google's own terms and privacy policy. Google acts as an independent controller for its Google Play data; Google is not our processor for this flow. The install referrer originates from Google Play (source: Google, Article 14 GDPR). No third-party attribution provider is involved in this flow; AppsFlyer is not involved
• Legal basis: Your consent: Art. 6(1)(a) GDPR for the processing, and § 25(1) TDDDG for reading the install referrer on your device. For users in Türkiye, this consent is also explicit consent (açık rıza) under Article 5(1) KVKK
• No advertising identifier: The Install Referrer flow does not use the GAID. We do not enable Google Ads consent through this flow
• Privacy Policy: https://policies.google.com/privacy

4.15 Google Vertex AI (Gemini): Image Content Analysis

• Purpose: When you upload a photo as the first frame for image-to-video generation, we run an automated content-analysis pass on that image so our prompt-enhancement step can keep your uploaded subject present in the generated video. Google is already engaged as our provider for video generation (Veo) and cloud infrastructure; this is an additional processing purpose using Google's Vertex AI (Gemini) service
• Data Shared: The first-frame image you uploaded. No account identifiers, contact details, or payment data are sent with it
• What we receive: A short, structured text description of the image: the type of main subject (for example, a person, pet, or object), the visible key elements, and the number of subjects in frame. We do not receive, request, or compute any facial-recognition data, biometric template, or unique-person identifier
• How it is used: The description is used in memory to guide that single video generation and is not stored as a separate data category
• Legal Basis: Contractual necessity (Art. 6(1)(b) GDPR): the analysis is part of delivering the image-to-video generation you requested
• Processing: Google processes this image as a data processor on our behalf under the Google Cloud Data Processing Addendum. Vertex AI does not use your image to train Google's models
• Privacy Policy: https://cloud.google.com/terms/cloud-privacy-notice

4.16 Sentry (Backend Error Monitoring)

• Purpose: Backend error monitoring. When a request to our servers fails unexpectedly, we capture the error so we can diagnose and fix it
• Data Shared: A pseudonymous user identifier (our internal account ID, when the failing request was authenticated), the stack trace of the error, and the request route and HTTP method
• Data NOT Collected: Sentry's automatic personal-data collection is disabled in our configuration, so we do not send request bodies, headers, cookies, IP addresses, or email addresses with error events
• Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR): we have a legitimate interest in keeping the Service reliable and in diagnosing failures that affect you. The data is limited to technical diagnostics and a pseudonymous identifier, and cannot be used to profile you
• Processing: Sentry (Functional Software, Inc.) processes this data as a data processor on our behalf under its Data Processing Addendum
• Retention: Error events are kept for at most 90 days
• Privacy Policy: https://sentry.io/privacy/

4.17 Cloudflare Turnstile (Share Page Only)

• Purpose: Bot protection for the publicly accessible share page. Turnstile verifies that the report feature is used by a person and not by an automated script
• Data Collected: Browser and device signals (such as browser and operating system characteristics, and interaction signals within the page) and the IP address of the request, processed by Cloudflare to produce a pass or fail verdict. Turnstile does not use cookies for tracking or advertising, does not build a cross-site profile, and does not require you to solve a puzzle
• Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR): protecting a public endpoint against automated abuse is strictly necessary to keep the report feature usable. Because the processing is strictly necessary to deliver the page you requested, it is not subject to a consent gate
• Processing: Cloudflare, Inc. processes this data as a data processor on our behalf under its Data Processing Addendum
• Privacy Policy: https://www.cloudflare.com/privacypolicy/

5. Your Privacy Choices and Rights

5.1 Consent Management

When you first open the app, it shows your privacy preferences with three equal choices: "Accept all", "Reject all" and "Manage". "Manage" shows each category with its own switch. Nothing optional is on until you choose, and you can change your choice at any time in Settings. There are three categories:

• Essential: Terms of Service and Privacy Policy acceptance and everything needed to provide the Service (required to use the Service, processed under contractual necessity, not consent)
• Analytics: Google Analytics with your account ID, AppsFlyer for deep links and install attribution, and reading Apple's AdServices attribution token (iOS) or the Google Play install referrer (Android) to see which of our ads or links brought you here (optional, requires consent, see Section 3.4). When it is off, the app collects no analytics and the ad information is deleted: we delete your attribution record and the campaign attributes stored with RevenueCat (see Sections 4.13 and 4.14)
• Product News & Offers: Push notifications about product news, new features, new AI providers, new content and special offers (optional, requires consent). We do not use this for personalized advertising.

Important: "Essential" processing is not based on consent but on contractual necessity under Article 6(1)(b) GDPR. This means we must process certain data to provide the Service you've requested. The Analytics and Product News & Offers categories are genuinely optional and based on your consent, which you can withdraw at any time without affecting the core functionality of the Service.

What stays when Analytics is off: The app collects no analytics. Our servers keep the account activity and compute the totals described in Section 3.2, which you can object to (Section 5.2). Apple and Google may make crash reports available to us without our user ID if you allow this in your device settings (Section 4.5).

You may manage your privacy preferences at any time through the Service's settings.

5.2 Your Rights Under GDPR (EU Users)

If you are located in the European Economic Area (EEA), you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of processing
• Right to Data Portability: Receive your data in a machine-readable format, including signed download links for your generated videos and uploaded reference images
• Right to Object: Object, on grounds relating to your particular situation, to processing based on legitimate interests, such as the account activity and totals in Section 3.2 and product experiments in Section 3.8, by writing to support@havira.app from the email address of your account or with your account ID
• Right to Object to Automated Decision-Making: Request human review of automated decisions that significantly affect you (see Section 3.7)
• Right to Withdraw Consent: Withdraw consent at any time

5.3 Your Rights Under CCPA (California Users)

If you are a California resident, you have the following rights:

• Right to Know: What personal information we collect, use, and disclose
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: Equal service regardless of exercising your rights

5.4 Exercising Your Rights

To exercise any of these rights:

Data Export: You may request a copy of your personal data through the Service's data export features, which are accessible through the Service's settings. Upon request, you will receive your data in a machine-readable format via the email address associated with your account. The export includes time-limited signed download links for your media files so you can download your videos and reference images directly. These links expire 7 days after the export is delivered.

The exported data includes:

• Account information (user ID, credit balance)
• Consent preferences and audit trail
• Install attribution record (see Sections 4.13 and 4.14), if one exists
• Product experiment events (see Section 3.8)
• Device tokens and device identifiers registered for push notifications
• Video generation requests and metadata, including signed download links for each generated video (MP4), preview (MP4), poster image (JPEG), and any uploaded reference images
• Credit transaction history
• Content moderation violations (if any)
• Summary statistics (total credits earned/spent, videos generated, etc.)

The signed download links in the export are valid for 7 days from delivery. The actual media files are served from our Google Cloud Storage infrastructure and are not embedded in the export file itself.

Account Deletion: You may delete your account and associated personal data with "Delete Account" in the Service's settings. For step-by-step instructions, visit https://havira.app/account/delete. Alternatively, you may contact us at support@havira.app to request account deletion.

Data Deletion (Without Account Closure): With "Delete my data" in the Service's account settings, you can exercise your right to erasure (GDPR Article 17) without closing your account. Your account, your sign-in and your credit balance stay. We delete your content (videos, previews, thumbnails and uploaded reference images), your prompts, your device tokens, your install attribution record and your product experiment events, and we remove the IP address and user agent from your consent records (see Section 6.2). The deletion request is processed asynchronously after submission.

We will respond to your request within:

• GDPR: 30 days (extendable by 60 days for complex requests)
• CCPA: 45 days (extendable by 45 days)

6. Data Retention

6.1 Active Accounts

We retain your personal information for as long as your account is active or as needed to provide you with our Service.

6.2 Data Deletion and Anonymization

You have two options for exercising your right to erasure, both accessible through the Service's settings (Profile > Account):

1. Delete my data: Keeps your account, your sign-in and your credit balance.
2. Delete Account: Deletes your data and permanently closes your account, including removal of your authentication credentials.

With "Delete my data", we:

• Delete your content: videos, video previews, thumbnails and the reference images you uploaded
• Delete your prompts
• Delete your device tokens (including push notification tokens) and associated device identifiers
• Delete your install attribution record (see Sections 4.13 and 4.14) and the campaign attributes stored with RevenueCat
• Delete your product experiment events (see Section 3.8)
• Remove the IP address and user agent from your consent records

With "Delete Account", we delete everything listed above and additionally:

• Delete your authentication data (Firebase Authentication credentials)
• Delete your consent preferences
• Anonymize your user record (email address removed, account status set to "deleted")
• Anonymize your token transaction records and consent records (user ID removed, timestamps preserved for legal compliance)

Rejected-request records are handled as described in Section 3.7.

Videos created through Remix or Extend operations are stored and deleted under the same policy as originally generated videos.

For certain records, instead of full deletion we may anonymize the data by removing or replacing direct identifiers (such as your user ID) while retaining non‑identifiable information. This is necessary to:

• Comply with legal and accounting obligations
• Maintain accurate aggregate statistics about service usage
• Prevent abuse, fraud, and misuse of the Service

6.3 Legal Requirements

We may retain or anonymize certain records for legal and accounting purposes, including:

• Payment transaction data (as required by tax and financial regulations)
• Security and audit logs for fraud prevention and legal compliance

The retention period for such records typically does not exceed 7 years or as required by applicable law.

App and request logs are deleted after 30 days. The audit log, which covers security events, data-rights requests and administrative actions and may include your user ID and IP address, is deleted after 12 months (see Section 3.5).

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest
• Access Controls: Restricted access to personal data on a need-to-know basis
• Secure Infrastructure: Use of Google Cloud Platform with industry-standard security
• Regular Updates: Security patches and updates are applied promptly
• Authentication: Secure user authentication through Firebase
• Incident Response: We maintain procedures to detect, respond to, and report security incidents

Data Breach Notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify Supervisory Authority: Report the breach to the relevant supervisory authority (in Bavaria, the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)) within 72 hours of becoming aware of it, as required by GDPR Article 33. The notification will include information about the nature of the breach, the categories and approximate number of affected individuals, the likely consequences, and the measures we propose to address the breach.

• Notify Affected Users: If the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay, as required by GDPR Article 34. The notification will be sent to the email address associated with your account and will include: (a) a description of the nature of the breach; (b) the name and contact details of our data protection contact point; (c) a description of the likely consequences of the breach; and (d) a description of the measures we have taken or propose to take to address the breach and mitigate its possible adverse effects.

We may delay notification to users if doing so would impede a criminal investigation or if we have implemented appropriate technical and organizational measures that render the data unintelligible to unauthorized persons (such as encryption). We will document all breaches, including the facts relating to the breach, its effects, and the remedial action taken.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

8. Children's Privacy

Our Service is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@havira.app, and we will delete such information promptly.

9. International Data Transfers

We are based in Germany and process data within the European Economic Area (EEA). However, some of our third-party service providers may process data outside the EEA, including:

• OpenAI (United States): For content moderation
• Google (United States): For video generation (Veo), image content analysis (Vertex AI / Gemini), cloud infrastructure, analytics, and Play Install Referrer attribution (Android)
• Apple (United States): Receives the AdServices attribution token for the exchange described in Section 4.13 (only with your Analytics consent). Apple acts as an independent controller, not as our service provider
• Kling AI (China/Singapore): For video generation services
• fal.ai (United States): For AI video generation services
• RevenueCat (United States): For payment processing
• AppsFlyer (Israel/United States): For deep links and install attribution (only with your Analytics consent)
• Sentry (United States): For backend error monitoring
• Cloudflare (United States): For bot protection on the share pages
• Vercel (United States): For hosting and analytics of the website havira.app

When we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission
• EU-U.S. Data Privacy Framework (DPF) for transfers to certified U.S. organizations
• Other appropriate safeguards as required by applicable data protection laws

You can request a copy of the safeguards we rely on by writing to support@havira.app.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We track all versions of this Privacy Policy and will notify you of significant changes by:

• Updating the "Last Updated" date at the top of this policy
• Displaying a notification in the app when you open it, prompting you to review the updated policy
• For material changes, requesting renewed consent where required

Notification Method: We notify you of Privacy Policy updates through notifications provided when you access the Service. We do not send email notifications or push notifications for Privacy Policy updates. You will be prompted to review and accept updated policies when you access the Service.

We encourage you to review this Privacy Policy periodically.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: support@havira.app

Postal Address:
Engin Deniz Usta
Brennerei 2
82024 Taufkirchen
Germany

11.1 For EU Users (GDPR)

As a Germany-based service provider, we serve as the data controller for your personal information.

Data Protection Officer: We do not currently have a designated Data Protection Officer (DPO) as our processing activities do not meet the thresholds requiring mandatory DPO appointment under GDPR Article 37. For data protection inquiries, please contact us using the information provided in Section 11.

You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your residence, place of work, or place of alleged infringement.

Competent Data Protection Supervisory Authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach Website: https://www.lda.bayern.de

12. Legal Basis Summary

For quick reference, here's how we process your data:

Note: "Essential" functionality in the app's privacy preferences (Section 5.1) refers to processing based on contractual necessity, not consent.

---

Thank you for trusting Havira with your personal information. We are committed to protecting your privacy and providing you with transparency and control over your data.