Legal

Privacy Policy

ravana.solutions, Thailand | Last updated: 18 Dec 2025 | Contact: info@ravana.solutions

This Privacy Policy explains how ravana.solutions ("ravana", "we", "us") collects, uses, and protects personal data when you use ravana.solutions (the "Service"). We act as the data controller. We comply with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and, where applicable to users in those regions, the EU/UK GDPR and the California CCPA/CPRA.

1. Data We Collect

Account: email address and sign-in provider (Google/Apple), used to create and secure your account.

Payment: billing country and transaction records. Card data is handled by the payment processor, not us. We use this data to process purchases, tax, and fraud prevention.

Prompts (Inputs): text you enter to generate content, used to generate your results and perform safety/abuse checks.

Uploaded images: reference images you upload, used to generate image-to-video or reference results.

Outputs: generated images and videos, stored and delivered through the Service.

Technical: IP address, device/browser, and usage analytics, used for security, fraud prevention, and service improvement.

2. Uploaded Images of People (Sensitive Data)

If you upload an image that contains an identifiable person, that image may constitute biometric or special-category personal data under the GDPR and similar laws. We process such images only with your explicit consent, which you provide by confirming at upload that you have the right to use the image and consent from any people shown. We do not perform facial recognition or matching, and we do not use uploaded images to train AI models. Uploaded images are automatically deleted within 30 days.

3. How We Use Data

To provide the Service: generate, store, and deliver your Outputs.
To process payments, calculate tax, and prevent fraud and abuse.
To enforce our Acceptable Use Policy and comply with legal obligations.
To improve reliability and performance (using aggregated or de-identified data where possible).

We do not use your prompts, uploads, or outputs to train AI models. We do not sell your personal data.

4. Legal Bases (GDPR)

Account, payments, providing the Service: performance of a contract (Art. 6(1)(b)).

Prompts, fraud/abuse detection, security: legitimate interests (Art. 6(1)(f)).

Uploaded images of identifiable people: explicit consent (Art. 9(2)(a)).

Cookies/analytics, marketing email: consent (Art. 6(1)(a)).

5. Retention

Prompts (Inputs): retained up to 30 days, then deleted or de-identified.
Uploaded images: automatically deleted within 30 days.
Outputs (generated files): retained up to 90 days; you may delete them sooner.
Account and transaction records: retained as long as your account is active and as required for legal/accounting purposes, then deleted.
Technical/log data: up to 12 months.

6. Sharing and Sub-processors

We share data only with service providers who help us run the Service, under data-processing agreements:

Google Cloud (Vertex AI) - AI generation (Gemini, Veo). Your Inputs are sent to Google to produce Outputs; configured so they are not used to train Google's models.
Stripe / PayPal - payment processing.
Firebase (Google) - authentication.
Gmail, Zoho mail, Mail Chimp - transactional email and product analytics.

We may also disclose data where required by law or to protect rights and safety. International transfers are protected by appropriate safeguards (e.g., Standard Contractual Clauses) where required.

7. Your Rights

Depending on your location, you may have rights to access, correct, delete, or export your data; to withdraw consent; to object to or restrict processing; and (CCPA) to opt out of "sale" or "sharing" - noting that we do not sell personal data. You can exercise these rights in your account settings or by contacting info@ravana.solutions. You may also lodge a complaint with your local data protection authority (in Thailand, the Office of the Personal Data Protection Committee (PDPC)).

8. Security

We use industry-standard measures including encryption in transit, access controls, secret management, and signed time-limited URLs for file access. No system is perfectly secure; we cannot guarantee absolute security.

9. Cookies

We use essential cookies for sign-in and security, and (with your consent where required) analytics cookies. EU/UK visitors are shown a consent banner for non-essential cookies.

10. Children

The Service is for users aged 18 and older. We do not knowingly collect data from anyone under 18. If we learn that we have, we will delete the account and associated data.

11. Changes and Contact

We may update this Policy and will post the new version with an updated date.

Privacy questions or requests: info@ravana.solutions