Privacy Policy

The short version

Your photos are used for the generation you asked for and nothing else. They are sent to the AI provider that runs the model, because that is how the generation happens. We do not run facial recognition on them, we do not build a faceprint, and we do not use them to train anything. Both the photo and the result are deleted after 30 days. There is no advertising or analytics tracking on this website at all.

1. Who we are

Two companies, with different jobs, and it matters which is which.

• The controller — the company that decides why your data is processed and is answerable for it — is the seller of your purchase, which depends on the payment channel and is named on your receipt: Boros Studio LLC or Oha Tech LTD. For a purchase made through the Outpost checkout, Outpost is an independent controller of the billing and payment data it handles, under its own privacy policy.
• The processor is NATIVES AI YAZILIM UYGULAMA BİLGİ TEKNOLOJİLERİ REKLAMCILIK DANIŞMANLIK SANAYİ VE TİCARET ANONİM ŞİRKETİ (“Natives AI”), İçerenköy Mah., Topçu İbrahim Sk., Quick Tower No: 8-10D, Ataşehir / İstanbul, Türkiye — a veri işleyen under Turkish law. It develops and operates evili.ai and processes your data on the controller’s instructions. It is also who answers support@evili.ai.

You do not have to work out which is which to exercise a right. Write to support@evili.ai for anything on this page — including a request to see or delete your data — and it reaches the right company.

2. What we collect

2.1. Your account

Your e-mail address, and your name and profile picture if you sign in with Google. Your language preference. A confirmation that you are 18 or over.

2.2. What you upload

The photos you add to a generation. You can also save up to three reference photos so you do not have to re-upload them; those stay until you delete them.

2.3. Face data in your photos

This is the part of the page worth reading slowly, because a photo of a face is treated as sensitive or biometric information in some places — including Illinois, Texas and Washington, and under European law when it is used to identify somebody.

A template puts the person in your photo into a generated scene. To do that, the photo is sent to the AI provider that runs the model, and the model reads the face in it in order to draw it. That is the whole of what happens to it. Specifically:

• We do not run facial recognition. Your face is never used to identify or authenticate you, or to work out who you are.
• We do not create or store a faceprint. No scan of facial geometry, no embedding, no template, no biometric identifier is derived from your photo and kept by us. There is no database of faces here, because the product does not need one to work.
• We do not match you against anything — not other photos, not other users, not any external source.
• We never sell, lease, trade or profit from face data, and we do not disclose it to anyone except the model provider that renders your generation and the storage providers that hold the file (section 4).
• We do not use it for training. Not ours — we have no models of our own — and we choose providers on the basis that API input is not used to train theirs.

Your consent, and how to withdraw it. Nothing is collected from a camera or a public source: you choose a photo and press the button that starts the generation, and that is the consent this processing rests on. You can withdraw it at any time by deleting the saved photo, deleting the generation, or deleting your account — each removes the photo behind it.

Retention and destruction schedule. This paragraph is our published schedule for photographs containing face data, and it is the same one in section 8: the photo behind a generation and the generation itself are permanently deleted 30 days after the generation finishes, from every store that holds them. A saved reference photo is deleted when you delete it, and at the latest when you delete your account. Deleting your account destroys both immediately. We hold no face data for any longer period and for no other purpose.

2.4. What you type

The description on templates that take one. It is screened automatically before it reaches a model.

2.5. What you generate

The resulting video or image, which template made it, and its status while it runs.

2.6. Your coins and payments

Purchases, plan status, and what each generation spent. Card numbers never reach us: the payment page is Stripe’s, and we receive the result, the card brand, the last four digits and expiry, the country of the card, and a customer reference — not the full number and never the security code.

2.7. Technical records

IP address, device and browser, and error logs. Used to keep the service working, to render it correctly, and to stop abuse and fraud.

2.8. What we do not collect

We do not ask for your date of birth, your phone number, your precise location or your contacts. We do not use an advertising identifier on the website, we run no advertising or analytics tracker on it (section 6), and we do not record your voice or build a voiceprint — no feature on evili.ai takes audio from you.

2.9. Children

Evili is for people aged 18 and over and we do not knowingly collect anything from a child. If you believe a child has an account, write to us and we will remove it. We enforce a zero-tolerance child-safety policy and report apparent child sexual abuse material to the appropriate authorities, including NCMEC.

3. What we use it for

Each purpose below, and the lawful basis we rely on for it if you are in the EEA or the UK. We do not use your data for anything that is not on this list.

There is no marketing or advertising row in that table, and that is not an omission: we do not do it from this website.

4. Who else processes it

Evili is not a model. Making a video means sending your photo to the company that runs the model, so this list is the important part of this page rather than the small print. Each provider gets only what it needs for the job named, and none of them is paid for your data.

4.1. AI model providers

• fal.ai (United States) — runs the generation models. Receives your uploaded photo and your description. We contract on terms that restrict use of your content to serving your request and prohibit its use to train the provider’s own models.
• OpenAI (United States) — screens a typed description before it reaches a model. Receives the text, not your photo.

4.2. Payment

• Stripe — takes card payment on the website and holds the payment record. Receives your name and e-mail, the card details you enter on Stripe’s own page, the amount and currency, your IP address, the card brand, the last four digits and expiry, the card country and a recurring-billing indicator.
• Other payment providers and our orchestrator — a card payment may instead be routed to another provider we engage, which may include Adyen, through our payment orchestration provider Payrails. They receive the same categories as Stripe plus routing metadata and a tokenised card reference.
• Outpost — where the checkout indicates the sale is made through it, Outpost is the seller and processes your order, billing, payment and tax data as an independent controller under its own privacy policy.
• RevenueCat — verifies subscriptions bought inside the mobile app. Receives a user identifier, subscription status and purchase events.
• Apple and Google — where you bought inside a mobile app, the store is the merchant and processes that payment under its own policy. We receive the subscription status, not your card data.

4.3. Storage and delivery

• Cloudflare — stores and streams your generations (R2 and Stream).
• Amazon Web Services — object storage, the fallback store for the same files.
• Bunny — the CDN that delivers finished media to your device.

4.4. Account messages

• Resend — sends account e-mail: sign-in links, receipts, cancellation confirmations. Receives your e-mail address.
• Google — sign-in, if you use it, and Firebase for push notifications in the mobile app.

4.5. We do not sell or share it, and there is no ad tech here

We do not sell your personal information, and we do not share it for advertising or cross-context behavioural advertising. There is no advertising pixel, no attribution SDK and no analytics tracker on evili.ai — not Meta, not Google Ads, not TikTok, not a session recorder. If that ever changes, this section changes first and you will be asked to consent before any such cookie is set. We honour Global Privacy Control signals.

4.6. Law, and a sale of the business

We may disclose personal data to law enforcement or another authority where the law, a subpoena or a court order requires it. If the business is merged, acquired or sold, your data may transfer to the acquirer, subject to this policy.

5. Training

We do not use your photos or your generations to train models. We do not have models of our own to train. What the model providers in 4.1 do with data sent to them is governed by their own terms, and we choose providers on the basis that API input is not used for training.

6. International transfers

The providers above are largely in the United States, so if you are in the EEA or the UK your data is transferred outside it. For those transfers we rely on the European Commission’s Standard Contractual Clauses, or the UK International Data Transfer Addendum, or a provider’s certification under the EU–US Data Privacy Framework where it has one. You can ask us which applies to a particular provider.

7. Cookies

This website sets two cookies, both strictly necessary: one holds your sign-in session and one lets it be renewed without making you sign in again. That is the entire list. They are first-party, they carry no advertising or analytics identifier, and there is nothing here to consent to or opt out of — which is why you have not been shown a cookie banner. Clearing them signs you out. The mobile app uses a device advertising identifier that you can reset or limit in your device settings.

8. How long we keep things

• Generations and the photos behind them — 30 days, then deleted from every store that holds them. Everybody, including subscribers. This is also the destruction schedule for face data in section 2.3.
• Saved reference photos — until you delete them, or until you delete your account.
• Your account — until you delete it.
• Payment records — kept after deletion where accounting and tax law requires it. This is the one thing deleting your account does not erase.
• Technical logs — a short window for diagnosing faults and investigating abuse.

9. Your rights

To exercise any of them, write to support@evili.ai. We answer within 30 days, and sooner in practice. We will not charge you for it or treat you differently for asking.

9.1. Deleting everything

Your account page has a delete button and it does what it says: it cancels any subscription we bill, then removes your generations, your uploaded photos, your saved reference photos, your profile and your coin balance. It is not reversible and there is no waiting period. You do not have to ask us, and you do not have to give a reason.

Two things it cannot do. Unused coins are lost and are not refundable, so if you only want to stop being charged, cancel your plan instead — see Terms sections 8 and 9. And a subscription bought inside a mobile app keeps billing until you cancel it in the store, because only the store can stop it.

10. Türkiye (KVKK)

Law No. 6698 on the Protection of Personal Data (KVKK) applies to this processing, because Natives AI — the processor named in section 1, and the company that actually holds and handles the data — is established in Türkiye. Under Article 11 you may ask whether your data is processed and for what purpose, ask who it has been transferred to at home or abroad, have it corrected, deleted or destroyed, have those corrections passed on to the recipients above, object to a decision reached solely by automated analysis, and claim compensation for loss caused by unlawful processing. Section 9 is how to exercise any of them — the same address, the same 30 days.

The face data in section 2.3 is özel nitelikli (special-category) personal data under Article 6, and we rely on your explicit consent for it — the generation you started — and on nothing else. Transfers abroad, which is most of section 4, rest on that same explicit consent together with the safeguards in section 6. You may complain to the Kişisel Verileri Koruma Kurulu if you are not satisfied with our answer.

11. If you are in California, or another US state with a privacy law

You have the right to know what we collect and why, to a copy of it, to have it corrected, to have it deleted, and to limit the use of sensitive personal information — and not to be treated worse for exercising any of them. Sections 2 and 4 are the notice at collection: the categories we collect, the purposes, and every recipient.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of and no “Do Not Sell” link to click. We honour Global Privacy Control signals. Face data in a photo you upload is sensitive personal information and is used only to produce the generation you asked for (section 2.3). To exercise a right, write to support@evili.ai; if somebody acts on your behalf we will ask for proof of that.

12. Security

Media is served through signed, expiring links rather than public addresses, sign-in uses short-lived tokens, data is encrypted in transit, and generated files are stored under keys that cannot be guessed from your account. No service is immune, so if a breach ever affects your data we will tell you, and the relevant authority, rather than wait to be asked.

13. Changes

If this policy changes, the date at the top changes with it, and we will e-mail you before a change that materially affects how your data is used takes effect — including before we would ever add an advertising tracker or a new category of recipient.

14. Who to contact

Processor, and the address that answers:

• NATIVES AI YAZILIM UYGULAMA BİLGİ TEKNOLOJİLERİ REKLAMCILIK DANIŞMANLIK SANAYİ VE TİCARET ANONİM ŞİRKETİ
• İçerenköy Mah., Topçu İbrahim Sk., Quick Tower No: 8-10D, Ataşehir / İstanbul, Türkiye
• Registered in Türkiye · nativesai.studio
• support@evili.ai

Controller: the seller named on your receipt — Boros Studio LLC (1111b South Governors Avenue, STE 7399, Dover, DE 19904, United States), or Oha Tech LTD (Promachon Eleftherias 1, Floor 1, Flat/Office 18/19, Agios Athanasios, 4103, Limassol, Cyprus). A request sent to the address above reaches it; you do not need to write separately.

If you are not satisfied with our answer you may complain to your data-protection authority: the Kişisel Verileri Koruma Kurulu in Türkiye, or your local supervisory authority if you are in the EEA or the UK.