Privacy policy
Version 2.0 · effective October 14, 2026
Who we are
Norvilo is operated by Uncertainty Works Ltd., a company registered in England and Wales (company number 17169253), registered office 124–128 City Road, London, EC1V 2NX, United Kingdom ("Norvilo", "we"). We are the controller of your personal data. Contact for any privacy question: support@norvilo.sbs.
What data we collect
| Category | What exactly | Source |
|---|---|---|
| Account | email, password hash (we never store the password itself), display name if you set one, language | you |
| Orders & payments | order number, plan, amount, currency, status, the payment provider's transaction reference | us and the payment provider |
| Content | chats, prompts, projects, files and generated images, videos and audio | you |
| Usage | credits spent per model and day, number of requests | the service |
| Technical | a keyed hash of your IP address (we don't store the raw IP), browser type, sign-in times | your device |
| Consents | which documents (and versions) you accepted, your cookie and newsletter choices | you |
We do not receive or store card details: payments are made on the payment provider's page. We don't ask for your name, address or phone number to sell you a plan.
Country detection. When you open the site we look up the country of your IP address in a local database (DB-IP) to choose the language and show an approximate price in your currency. The IP address is used only for this lookup and is not stored; you can change the language and country at any time.
Operational visit log. To watch that the site and checkout work, the team receives short notes about visits in a private work chat (Telegram): pages opened, country, device type (phone/computer), traffic source (for example, an ad) and whether an order was started. No IP address, e-mail, password or payment data is included. A random identifier kept only in the browser tab (sessionStorage, deleted when the tab is closed) links the pages of one visit.
Why and on what legal basis
- Providing the service — account, chat, generation, workspace, credits. Basis: performance of the contract (Terms of service).
- Payments and accounting — orders, payment confirmation, bookkeeping and tax. Basis: contract and legal obligation.
- Security — preventing abuse and fraud, rate limiting. Basis: legitimate interests.
- Anonymous analytics — only with your consent to analytics cookies.
- News and offers by email — only with your separate consent; you can unsubscribe any time.
Processing of AI requests
To produce an answer, image, video or audio, the text of your request, the previous messages needed for context and any attached files are sent to the provider of the model you selected (for example OpenAI, Anthropic, Google, ByteDance, Kling, Alibaba, Black Forest Labs, Runway, Luma, MiniMax, ElevenLabs) through its commercial API. The provider processes them to return the result, under its API terms with us.
- We send only what is needed for that request. Your email, password and payment details are never sent to model providers.
- Under their commercial API terms, providers generally do not use API data to train their models by default.
- Norvilo does not train models on your chats, files or creations.
- AI output can be inaccurate. Don't submit data you are not allowed to share, such as other people's personal data without a legal basis.
Who else receives data
| Recipient | Purpose | Data |
|---|---|---|
| AI model providers | producing the result | request content and attachments |
| Payment provider | taking the payment | order number, amount, currency, email |
| Hosting and infrastructure | running the service | all service data over encrypted connections |
| Email service | service emails | email address, message content |
We use processors under data-processing agreements. An up-to-date list is available on request at support@norvilo.sbs. We do not sell personal data and do not share it for third-party advertising.
International transfers
Model providers and infrastructure may process data outside your country, including in the United States. Where required, transfers are protected by the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, or rely on adequacy decisions.
How long we keep data
| Data | Period |
|---|---|
| Account and content | while your account exists; after deletion, up to 30 days in backups |
| Orders and payment records | 6 years, as required by UK tax and accounting rules |
| Security logs | 90 days |
| Consent records | while the consent is valid and 6 years after |
Your rights
You may request access, correction, deletion, restriction, portability, object to processing and withdraw consent. Export and account deletion are available in your workspace settings; for anything else write to support@norvilo.sbs. We reply within one month. You can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data-protection authority of your country.
Security
Passwords are stored only as Argon2id hashes, API keys as hashes, connections are encrypted (HTTPS), and staff access to data is limited and logged. If an incident affects your data, we will notify you as required by law.
Children
Norvilo is not intended for people under 18.
Changes
Each version of this policy has a number and an effective date. We will email you about material changes at least 14 days before they take effect.