This policy explains what personal information HeyEva Inc. (“diffusr”, “we”, “us”) collects when you use diffusr: the website at diffusr.ai, the app at app.diffusr.ai, and diffusr’s API and MCP server. It covers what we do with that information, who we share it with, how long we keep it, and the choices you have. HeyEva Inc. is responsible for your information (the “controller”). Questions? Email hello@diffusr.ai.
The short version
- We collect your Google account basics (name, email, photo), what you upload and make, what you buy, and how you use the app.
- We use it to run diffusr: to make your images and videos, bill you, keep accounts safe, and improve the product.
- To make your content, we send your prompts and files to the company that runs the AI model you pick, such as OpenAI, Google or BytePlus.
- Your files live at links that are hard to guess, but anyone who has a link can open that file.
- We record how you use the app, including session replays, to fix problems and improve it.
- We don’t sell your personal information, and we don’t train AI models on your content.
- You can ask us to show, correct, export or delete your data at any time.
1.What we collect
From your Google account. When you sign in with Google, we receive your name, email address, profile photo and Google account ID. We never get your Google password, or access to your Gmail, Drive or anything else in your Google account.
What you put in and make. This includes:
- prompts, scripts, and your messages to our agents;
- images, video clips and audio (including voice clips) you upload, and their file names;
- the people you add to your cast library, with their pictures and voices;
- the images, videos and audio you generate;
- your canvases, films, templates and settings.
Payments. Stripe handles all payments. We never see your full card number. We keep your Stripe customer ID, what you bought, when, and for how much, and your credit balance and history. We also keep a card “fingerprint” from Stripe, a code that identifies a card without revealing its number. We use it to give free credits only once per card.
How you use diffusr.
- In the app, we use PostHog to record what happens during a visit: the pages you view, what you click, how fast pages load, and session replays. A replay is a video-like record of your screen in the app during a visit. It shows what’s on the page, but masks what you type into text boxes. We link this to your account, including your name and email.
- When you sign in, we store your IP address and your browser type with your session.
- Vercel, our host, measures page views and page speed without cookies.
- Our hosting and job providers keep technical logs, such as IP addresses, requests and errors.
API and MCP. If you create an API token, we keep its name, when it was last used, and a secure hash of it, never the token itself. If you connect an app like Claude or ChatGPT, we keep a record of that connection. When a connected app calls diffusr, we receive only what it sends to our tools, such as a prompt, file links and settings. We don’t receive your conversation with that app.
When you contact us. Your email address and what you write to us, including credit requests you send from the app.
2.How we use it
- To run diffusr: sign you in, run your generations, store and show your work, and run our agents.
- To bill you and keep track of your credits.
- To keep diffusr safe: stop fraud and abuse, enforce our Terms, and protect accounts. For example, we automatically refuse sign-ups from disposable or abused email domains, and give free credits only once per card. If we refused you by mistake, email us.
- To help you when you ask for support.
- To improve diffusr: fix bugs, find slow pages, and decide what to build next.
- To follow the law, for example tax and accounting rules.
We don’t sell your personal information or share it for advertising. We don’t train AI models on your content.
Legal bases (if you’re in the EEA or UK). We use your information to perform our contract with you (running diffusr and billing you); for our legitimate interests (security, fraud prevention, analytics and improving diffusr), which we balance against your rights; to meet legal obligations; and with your consent where the law requires it.
4.Where your information is
HeyEva Inc. is a US company, and our main servers are in Singapore. Some of the companies above process information in other countries, including the United States. When your information leaves your country, we rely on the safeguards the law requires, such as standard contractual clauses.
5.How long we keep it
- Your account and content: for as long as your account is open.
- Removed generations: removing a generation hides it from your account. The file itself stays in storage, and its link keeps working, until your account is deleted.
- Copies at BytePlus: stay in our private asset library until they’re replaced. The library holds a limited number of files and removes the oldest first.
- Session replays: deleted after 30 days. Other analytics events are kept while they help us improve diffusr.
- Billing records: as long as tax and accounting laws require.
- When you delete your account: we delete your account and your files within 30 days, except records the law makes us keep. Copies in backups disappear as the backups roll over.
6.Your choices and rights
- See, correct, export or delete your data: email hello@diffusr.ai. We’ll reply within 30 days. We may need to confirm it’s you first.
- Tokens and connected apps: revoke them any time in Settings.
- Object: you can object to how we use your information, including for analytics. Email us.
Depending on where you live (for example the EEA, the UK, California, the Philippines or Singapore), the law gives you rights to access, correct, delete and move your data, and to object to or restrict how we use it. You can also withdraw consent you’ve given. We give these rights to everyone, wherever you live, and we won’t treat you differently for using them. You can also complain to your local data protection authority.
California. We don’t sell your personal information, or share it for cross-context behavioral advertising.
8.Security
We use HTTPS everywhere, keep API tokens only as secure hashes, limit who on our team can see your data, and use providers that take security seriously. No system is perfectly secure. If a breach affects your information, we’ll tell you and the authorities as the law requires.
9.Children
diffusr is for people 18 and older. We don’t knowingly collect information from children. If you think a child has given us personal information, email us and we’ll delete it.
10.Changes to this policy
We’ll post updates here with a new date. If a change is important, we’ll tell you by email or in the app before it takes effect.
11.Contact
HeyEva Inc. · 131 Continental Drive, Newark, Delaware 19702, USA · hello@diffusr.ai