Privacy Policy

1. Data we collect

We collect only what we need to run Tasvr:

• +Account data: your email address and name. If you sign up with email, your password is stored only as a secure hash by our sign-in provider. If you use Google, see section 2.
• +What you create: prompts, briefs, canvas set-ups, generated and edited images, galleries and saved settings.
• +Reference photos you choose to upload to guide an image (see section 4).
• +Face scans: the five still photos a face scan keeps and the angles and timing of the scan. When someone scans through a scan link you send, their name, email and agreement (see section 4).
• +Payment records: your plan, transactions, receipts and credit balance. Card, UPI and bank details go straight to Razorpay; we never see or store them.
• +Usage and device data: IP address, browser and device type, timestamps, errors and the features you use, for security and to keep the service working.
• +Product analytics: pages viewed and in-app events. Unless you accept analytics cookies they are counted without cookies and never linked to you; if you accept, they are linked to your account ID, not your email (see our Cookie Policy).
• +Optional answers you give us, such as who you make images for, and messages you send us.

2. Google user data (Sign in with Google)

When you choose “Continue with Google”, Google shares your name, email address, profile picture and Google account ID with Tasvr. We request only Google’s basic sign-in permissions (openid, email and profile). We do not ask for, and cannot see, your Gmail, Google Drive, Contacts, Calendar, Photos or any other Google data.

• +How we use it: only to create your Tasvr account and sign you in, to show your name and picture inside Tasvr, and to send you account emails such as sign-in codes, receipts and important service notices.
• +How we store it: in our account database (Supabase), protected by access controls, for as long as your Tasvr account exists.
• +How we share it: only with the service providers that host and run Tasvr for us (section 5), and only so they can do that. We do not sell it, use it for advertising, or pass it to data brokers.
• +We do not use Google user data to develop, improve or train AI or machine-learning models.
• +People at Tasvr do not read it, except with your permission, to investigate security or abuse, or where the law requires.
• +Deleting it: when you delete your Tasvr account (section 8) we delete the Google data we hold. You can also remove Tasvr’s access at any time at myaccount.google.com/permissions.

Tasvr’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use your data

• +To run Tasvr: sign you in, create and store your images, manage credits and subscriptions, and help you when you contact us.
• +To keep Tasvr safe: prevent fraud and abuse, and enforce our Acceptable Use Policy.
• +To improve Tasvr: from usage patterns and product analytics (cookieless unless you agreed to analytics cookies); and to tailor starting points from the optional answers you give us.
• +To meet legal duties: accounting and tax records, and lawful requests from authorities.

We do not sell your personal data. We do not use your prompts, images or reference photos to train AI models; the only exception is scan photos that the person in them has separately agreed to share (section 4). We send account and service emails; we will only send marketing emails if you opt in, and every one will have an unsubscribe link.

4. Reference photos and face scans

If you upload a photo to guide a generation, we use it only to guide the pose, look and composition of the images you ask for. We never use it to identify or verify anyone, and we don’t extract or store a facial-recognition template from it. It stays in your reference library until you delete it or your account is deleted.

If you upload a photo of someone else, you confirm you have their consent (for a minor, their parent or guardian’s consent), and we record that you confirmed it. Anyone who thinks their photo was uploaded without consent can email us and we will remove it.

Face scans. When you scan a face with your camera, the scan measures the position of the face on your own device, only to guide the turns and to check that a real, live face is in front of the camera. Those measurements never leave your device and are never stored. We keep five still photos from the scan, plus the angles and timing of the scan as a record. We keep no video, and we don’t make a face template or use the photos to identify anyone.

Scan links. When someone opens a scan link you send, they see who is asking and why, and agree before any scan. We keep their name, email and agreement, and the avatar is saved to your account. We email them a receipt with a link to withdraw. Withdrawing deletes the scan photos and the avatar, takes them off your catalogues, and stops new images being made with their face. Images already made stay with you.

Training. Scan photos are used to train or test how Tasvr makes faces only if the person in them ticks a separate, optional box. They can turn it off at any time; that stops future use but can’t undo what a model has already learned. Uploaded photos and anyone under 18 are never used for training.

Consent records (who agreed to what, when, and with which wording) are kept for as long as the avatar exists and for 3 years after it is deleted, without the photos.

5. Who we share data with

Only the providers we need to run Tasvr, each limited to its job:

• +Supabase: database, sign-in and file storage (servers in Tokyo, Japan).
• +Vercel: hosting for the website and app (Tokyo, Japan).
• +AI service providers: they receive your prompt or brief and any reference images, only to create the image you asked for, to help write its prompt, or to check it against our content rules. They do not receive your name or email, and they may process data outside India.
• +Razorpay: payments and subscriptions.
• +Resend: sends account emails such as sign-in codes, scan-link receipts and catalogue enquiries.
• +PostHog: product analytics on EU servers; cookieless and not linked to you unless you accept analytics cookies.

We also disclose data where the law requires it, and to a buyer or successor if Tasvr is merged or sold (we would tell you first). Images you choose to share through a gallery link are visible to anyone who has access to them.

6. Where your data is stored

Your account data, images and reference photos are stored in Japan (Supabase and Vercel, Tokyo region); analytics data is stored in the EU. Our providers may process data in other countries; they work for us under written terms that bind them to our instructions. We do not transfer personal data to any country the Government of India restricts under the DPDP Act.

7. How long we keep it

• +Account and profile data, including Google sign-in data: for as long as your account exists, and deleted within 30 days of your request to delete the account, except records we must keep by law.
• +Images and reference photos: while your account is active, until you delete them. Storage on free accounts is limited: if an account has no paid plan and hasn’t been used for 90 days, we may delete its stored images and reference photos. Download anything you want to keep.
• +Payment and invoice records: at least 8 years, as the Companies Act, 2013 requires.
• +Security and usage logs: at least 1 year, and longer only when needed for a security investigation or legal duty.
• +Consent records for faces: while the avatar exists and 3 years after it is deleted, without the photos.

8. Your rights and choices

Under India’s Digital Personal Data Protection Act, 2023, you can ask for a summary of the personal data we hold and who we share it with, ask us to correct, complete or erase it, withdraw your consent, make a complaint, and name someone to act for you if you die or can’t act. Withdrawing consent is as easy as giving it: email hello@tasvr.ai from your account email, or use the withdraw link in a scan receipt. We reply within 7 days and finish within 30 days. If you withdraw consent, we stop the processing that depended on it; images already made stay with you. If you are in the EU, UK or California you also have the rights your local law gives you, such as data portability.

• +Update your name and profile picture in Settings.
• +Delete your account and data, or get a copy of it: email hello@tasvr.ai from your account email. We reply within 7 days and complete deletion within 30.
• +Analytics: change your choice any time from “Cookie preferences” at the bottom of every page.
• +Google: remove Tasvr’s access at myaccount.google.com/permissions.

9. Security

We protect data with encryption in transit, access controls, and database rules that limit each account to its own data. No system is perfectly secure. If a breach affects your personal data, we will tell you without delay, saying what happened, what data was involved, what we have done and what you can do, and we will tell the Data Protection Board of India as the law requires.

10. Children

Tasvr accounts are for people aged 18 and over, and we do not knowingly collect data from a child about themselves. You may add a photo of a child under 18 only if you are their parent or legal guardian or have their parent’s or guardian’s consent. We use it only to make the images you ask for: never for training, tracking or advertising. A parent or guardian can ask us to delete it at any time, and we will.

11. Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect, and update the date at the top of this page.

12. Contact and grievances

Email hello@tasvr.ai with any question or request about your data. Our Grievance Officer is Ankit Ohol (hello@tasvr.ai, +91 81693 05189); we acknowledge complaints within 24 hours and resolve them within 7 days. See our Grievance Redressal page for the full process. If you are not satisfied, you can complain to the Data Protection Board of India, after you have used this route first.

Tasvr is operated by Aerochrome Media Private Limited (CIN U74109MH2024PTC429880), 227, 2nd floor, Plot 8PT, C1 Wing B, Shram Shakti Co-op Premises Society, Wadala Truck Terminal Road, Antop Hill, Mumbai 400037, India. We are the Data Fiduciary for your personal data under the DPDP Act.