Privacy Policy

Last Updated: January 9, 2025

1. Introduction

Anava, Inc. ("Company," "we," "us," or "our") is committed to protecting the privacy and security of our users' personal information. This Privacy Policy explains how we collect, use, store, and protect your data when you use our AI image analysis service.

Data Controller: Anava, Inc.
Contact: legal@anava.ai

This policy complies with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable privacy laws.

2. Information We Collect

We collect the following categories of personal information:

IMPORTANT: We do NOT collect or store:

• Your uploaded images (deleted immediately after AI analysis)
• Payment information (service is currently free)
• Biometric data
• Children's data (service is 13+ only)

3. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Contract (Article 6(1)(b)): Processing necessary to provide our AI image analysis service
• Consent (Article 6(1)(a)): Analytics and optional features (you can withdraw anytime)
• Legitimate Interest (Article 6(1)(f)): Security, fraud prevention, service improvement
• Legal Obligation (Article 6(1)(c)): Compliance with applicable laws

4. How We Use Your Information

We use your data for these specific purposes:

• Service Delivery: Process AI image analysis requests using your API key
• Account Management: Authenticate and manage your account
• Communication: Send important service updates (not marketing)
• Security: Detect and prevent fraud, abuse, and security threats
• Analytics: Improve our service (only if you consent via cookie banner)
• Legal Compliance: Respond to legal requests and enforce our terms

5. Third-Party Services & Data Sharing

We integrate with third-party services. We do NOT sell your personal information.

International Data Transfers: Your data may be transferred to Google Cloud servers in the United States. We ensure adequate safeguards through Google's Standard Contractual Clauses (SCCs).

6. Data Retention

We retain your data as follows:

• Account Data: While your account is active + 30 days after deletion
• Uploaded Images: Deleted immediately after AI analysis completes (typically < 30 seconds)
• Analytics: 14 months (Firebase default retention period)
• Security Logs: 90 days for fraud prevention and security investigations
• Legal Requests: As long as required by law

7. Your Privacy Rights

GDPR Rights (EU/UK Residents)

You have the following rights under GDPR:

• Right of Access (Article 15): Request a copy of your personal data
• Right to Rectification (Article 16): Correct inaccurate data
• Right to Erasure (Article 17): Delete your account and data
• Right to Data Portability (Article 20): Export your data in JSON format
• Right to Object (Article 21): Opt out of analytics and processing
• Right to Restrict Processing (Article 18): Limit how we use your data
• Right to Withdraw Consent (Article 7(3)): Revoke analytics consent anytime

CCPA Rights (California Residents)

Under the California Consumer Privacy Act, you have:

• Right to Know: What personal information we collect, use, and share
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do NOT sell personal information (no opt-out needed)
• Right to Non-Discrimination: Equal service regardless of privacy choices

How to Exercise Your Rights

To exercise any privacy rights:

1. Account Deletion: Use the "Delete Account" option in Settings page
2. Data Export: Contact legal@anava.ai
3. Other Requests: Email legal@anava.ai with your request

Response Time: We respond to verified requests within 30 days (GDPR) or 45 days (CCPA).

8. Data Security

We implement industry-standard security measures:

• Encryption: HTTPS/TLS for all data transmission
• Firebase Security: SOC 2 Type 2 compliant infrastructure
• Access Controls: Two-factor authentication (2FA) for our team
• API Key Storage: Encrypted at rest in Firebase Firestore
• Image Processing: Images deleted immediately after analysis (no storage)
• Regular Audits: Security reviews and vulnerability scanning

Breach Notification: If a data breach occurs, we'll notify affected users within 72 hours (GDPR) and comply with all applicable breach notification laws.

9. Children's Privacy (COPPA)

Our service is NOT intended for children under 13 years old. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at legal@anava.ai. We will delete the information within 30 days.

10. Cookies & Tracking Technologies

We use cookies and similar technologies:

• Essential Cookies: Required for authentication and security (no consent needed)
• Analytics Cookies: Firebase Analytics for usage insights (requires consent via banner)
• localStorage: Store preferences like EULA acceptance and cookie consent

You can control cookies through our cookie consent banner or your browser settings.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be posted with an updated "Last Updated" date.

Continued use after changes constitutes acceptance. For significant changes, we may email registered users.

12. Contact & Complaints