Privacy Policy

Last updated: August 5, 2026

This Privacy Policy explains how Ovid ("we", "us", "our") collects, uses, and protects personal data when you use https://ovid.art (the "Service"). We are the data controller for the personal data described below.

Our processing is subject to the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable national law. By using the Service, you acknowledge this Privacy Policy.

1. Who We Are

Ovid is operated from France. Our data protection contact is contact@ovid.art. We do not currently have a designated Data Protection Officer; requests directed to the contact email above will be handled as DPO inquiries pending the appointment of one.

2. What Data We Collect

We collect the categories of personal data below. The Service has no upload surface: we do not collect photographs of you, and we process no biometric data.

2.1 Account Data

Email address, name, and authentication credentials when you register. If you use Google sign-in, we receive the data Google makes available at authentication (name, email, profile photo URL).

2.2 Purchased Content

AI-generated images delivered on pack purchase are stored on encrypted servers in the EU (Frankfurt, Germany) and associated with your account. They depict synthetic subjects, not you. You may download or delete them at any time.

2.3 Payment Data

Payment transactions are processed by our payment processor. We do not store full card numbers or payment credentials. We receive transaction confirmation and billing details necessary for record-keeping and refund processing.

2.4 Usage Data

Server logs, IP addresses, browser type, device information, and interaction data (pages visited, actions taken). We also collect anonymised analytics data via Google Analytics 4. See Section 8 (Cookies and Analytics).

3. How We Use Your Data

• To operate and deliver the Service (generate images, process payments, manage accounts)
• To enforce our Terms of Service and Acceptable Use Policy
• To detect and prevent abuse, fraud, and illegal activity
• To respond to legal requests and cooperate with law enforcement
• To improve the Service through aggregated analytics
• To send transactional emails (order confirmation, magic-link authentication)

We do not sell your personal data. We do not use your personal data to train AI models.

4. Legal Bases for Processing

5. Data Retention

• Purchased images: retained as long as your account is active. Deleted on account closure or upon your request.
• Account data: retained for the life of the account, plus up to 3 years after closure for legal compliance purposes.
• Payment records: retained for 10 years as required by French accounting law (Code de commerce).
• Server logs: retained for up to 12 months for security and abuse-detection purposes.

6. Data Sharing and Transfers

We share personal data only with:

• Infrastructure providers (AWS — EU region; all data processed and stored in Frankfurt, Germany).
• Payment processor — processes card transactions on our behalf under their own privacy policy.
• Analytics — Google Analytics 4, with IP anonymisation enabled.
• Law enforcement — in response to valid legal process or where required by law.

We do not transfer personal data outside the European Economic Area except where required by law or where the transfer is covered by an appropriate safeguard (e.g. EU Standard Contractual Clauses).

7. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — obtain a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure (Art. 17) — request deletion of your data, subject to legal retention obligations.
• Right to restriction (Art. 18) — restrict processing in certain circumstances.
• Right to portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw at any time by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, email contact@ovid.art. We will respond within 30 days. We may request identity verification before processing a request.

You also have the right to lodge a complaint with your national data protection authority. In France: CNIL.

8. Cookies and Analytics

We use the following:

• Session cookies — strictly necessary for authentication. These are not tracked analytically.
• Age acknowledgment cookie — records only the fact that you confirmed being 18 or older at the site entry gate, for one year. It contains no personal data.
• Google Analytics 4 — with IP anonymisation enabled. Collects anonymised usage data (pages viewed, session duration, referral source). No advertising or cross-site tracking.

Strictly necessary cookies do not require your consent. Analytics cookies are set under our legitimate interest in service improvement; you may opt out by using browser extensions such as the Google Analytics Opt-out Browser Add-on.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All data is encrypted at rest and in transit. Our infrastructure is hosted on AWS in Frankfurt, Germany, within the EU.

No method of transmission over the internet is 100% secure. We notify affected users and the competent supervisory authority in the event of a data breach as required under GDPR Articles 33 and 34.

10. Contact and Complaints

For questions about this Privacy Policy, to exercise your rights, or to report a data protection concern:

Email: contact@ovid.art

If you are unsatisfied with our response, you may lodge a complaint with the French data protection authority, the CNIL, or the supervisory authority in your country of residence.