Privacy Policy — Belvora

The localized version of this page is not yet available — the English text is the authoritative version for now.

Belvora ("we", "us") operates the video generation service available at this domain. This Privacy Policy explains what personal data we collect, how we use it, and your rights under the LGPD (Brazil) and GDPR (EU).

1. Information we collect

Account data — email address, display name and avatar (from Google OAuth when you sign in with Google), authentication tokens.
Generation data — prompts, uploaded reference images/videos/audio, output videos, generation metadata (model, duration, resolution, aspect ratio).
Billing data — Stripe customer ID, transaction history, credit balance. We do not store credit card numbers; payments are processed by Stripe.
Technical data — IP address for rate limiting (via Upstash Redis), browser user-agent, language preference (used to pick BRL vs USD pricing).

2. Third-party processors

We share data only with the processors strictly required to deliver the service:

Supabase — authentication, database, file metadata.
Cloudflare R2 — storage for uploaded inputs and generated outputs.
fal.ai — runs the video generation models (Seedance 2.0, Runway Gen-3, Luma Dream Machine). We send your prompt and reference URLs to fal.ai.
Stripe — payment processing.
Resend — transactional email (generation ready / failed notifications).
OpenAI — prompt moderation (we send only the prompt text, never your uploads).
Sentry — error monitoring (we send error stack traces, not your generation content).

3. How we use your data

To deliver video generations you request and bill credits accordingly.
To send transactional emails about your generations and account.
To prevent abuse via rate limiting and prompt moderation.
To improve the product (aggregate, non-identifiable analytics).

We do not sell your data, use it to train AI models, or use generated outputs for marketing without your explicit consent.

4. Retention

Uploaded inputs (R2 inputs/): deleted after 7 days.
Generated outputs (R2 outputs/): kept indefinitely until you delete them.
Account data: kept while your account is active; deleted on request.
Webhook events log: kept for 90 days for auditability.

5. Your rights

You have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your account and all associated data.
Export your generations (a downloadable MP4 archive).
Withdraw consent at any time (account deletion).

Email privacy@belvora.tech to exercise any of these rights.

6. Cookies

We use only essential cookies: a Supabase session cookie for authentication, a belvora_currency cookie to remember your currency preference, a belvora_locale cookie for language preference, and a belvora_cookie_ackcookie to remember you've seen the cookie banner. No tracking or advertising cookies.

7. Children

Belvora is not intended for users under 18. We do not knowingly collect data from minors.

8. Changes

We'll notify you by email of material changes to this policy. The "Last updated" date above always reflects the current version.

9. Contact

Questions? privacy@belvora.tech