Privacy Policy

Last updated: July 2, 2026

1. Introduction

SIA TWIN ("we", "us", "our") operates avots.ai, an AI model aggregator platform. This Privacy Policy describes how we collect, use, and protect your personal data when you use our services.

2. Data We Collect

We collect the following types of data:

• Account data: name, email address, password (hashed), preferred interface language, referral code
• Authentication data: Google OAuth profile (if used), session tokens, refresh-token identifiers
• Usage data: conversations, messages, file uploads, model preferences, generated media (images, audio, video)
• Technical data: IP address, device type, browser, access timestamps
• Payment data: subscription plan, transaction history, invoice records. Card numbers and crypto wallet addresses are processed by third-party payment providers (Stripe, CoinGate); we do not store or have access to them.

3. How We Use Your Data

• To provide and maintain the avots.ai service
• To authenticate your identity and manage your account
• To process payments and manage subscriptions, including sending crypto renewal reminders before subscription expiry
• To route your requests to third-party AI model providers (OpenRouter, Fal.ai)
• To send transactional emails in your selected language (verification, password reset, subscription renewal)
• To improve our service and fix issues
• To prevent fraud and abuse (rate limiting, refresh-token reuse detection)

4. Third-Party Service Providers

To deliver the Service, we share specific data with the following processors:

• Third-party AI providers: to generate the result you request, the content you actively submit - your text prompts and any photos, videos or audio files you upload - is transmitted to the AI provider behind the model you selected. Depending on the model, this is one of: OpenAI, Google, Anthropic, xAI, ByteDance, Kuaishou (Kling), MiniMax, Black Forest Labs (FLUX), ElevenLabs, or another model listed in the app, routed through the OpenRouter (openrouter.ai/privacy) or Fal.ai (fal.ai/privacy) platforms. This content is shared solely to process your request and return the generated result; we do not use it for advertising and never sell it. These processors are bound by their own privacy policies and data processing agreements providing protection consistent with this policy and applicable EU data protection law (GDPR). No other data from your device (contacts, photo library, location) is shared with AI providers. In the mobile app we additionally ask for your explicit permission before the first generation.
• AI media generation (Fal.ai): prompts you submit for image, video, or audio generation are sent to Fal.ai. Generated media is stored on our servers and served back to you.
• Stripe (card payments - Merchant of Record): for all card transactions, Stripe Payments Europe Limited acts as the Merchant of Record under the Stripe Managed Payments programme. Your billing address, email, payment instrument and applicable VAT identifier are processed by Stripe to complete the sale, collect VAT on our behalf in 80+ countries, and issue the tax receipt to you. See stripe.com/privacy.
• CoinGate (crypto payments): when you choose to pay in cryptocurrency, your email and order details are forwarded to CoinGate, UAB, to create a payment order. CoinGate converts the received crypto to EUR before settling with us. See coingate.com/privacy.
• Email delivery (own SMTP): verification, password reset and renewal emails are delivered via our own mail server. Open-tracking pixels are included to measure deliverability.
• Infrastructure: hosting on European Union infrastructure (Hetzner Cloud and Cloudflare for DDoS / CDN).
• Legal requirements: we may disclose data when required by law or to protect our legal rights.

We do not sell your personal data to third parties.

5. Data Storage and Security

Your data is stored on servers located in the European Union. We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted passwords (bcrypt)
• HTTPS/TLS encryption for all communications
• HttpOnly cookies for authentication tokens
• Access logging and session management

6. Data Retention

• Account data is retained as long as your account is active
• Deleted conversations are permanently removed after 30 days
• Access logs are retained for 90 days
• You can request account deletion at any time through Settings

7. Face Data

Some avots.ai features (for example photo effects, AI headshots, avatars, face swap and photo animation) work with photos or videos that you voluntarily upload and that may contain human faces.

• What we collect: the photos and videos you choose to upload. We do not use facial recognition and we do not create biometric templates, faceprints or any other biometric identifiers. For some features an automated yes/no check confirms that a face is present in the image before processing starts; this check does not identify the person and no numeric face signature is stored.
• How we use it: uploaded images and videos are used solely to generate the specific result you requested (for example a stylized portrait or an animated photo) and for the face-presence check described above. We do not use face data for advertising, profiling, identification or for training our own models.
• Sharing: to generate your result, the uploaded image or video is transmitted to the third-party AI processors listed in Section 4 (OpenRouter with its underlying model providers, and Fal.ai) solely for processing your request. We do not sell face data and do not share it with any other third parties.
• Storage: uploads and generated media are stored on our servers located in the European Union (see Section 5).
• Retention: your uploads and generated media are retained while your account is active so you can access them in your archive. You can delete individual files at any time, and you can request full account deletion in Settings, which permanently removes your uploads and generated media in accordance with Section 6.

8. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access your personal data
• Rectify inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to data processing
• Data portability
• Withdraw consent at any time

To exercise these rights, contact us at hello@avots.ai.

9. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies. Third-party analytics may use their own cookies.

10. Children

avots.ai is not intended for users under 16 years of age. We do not knowingly collect data from children.

11. Changes

We may update this Privacy Policy from time to time. We will notify users of significant changes via email or in-app notification.

12. Contact

For questions about this Privacy Policy, contact us at hello@avots.ai.