Privacy policy

• Your account: email address, name (if you give one), a hash of your password (never the password itself), or your Google account's email and name if you sign in with Google.
• What you upload and make: images you upload, descriptions you type, and the drawings and exports made from them.
• Payments: your plan, subscription status and renewal date, what you paid and when, and your credit balance. Card details go to our payment provider, Dodo Payments, and never reach us.
• Technical data: your IP address and request details in server logs, used for security, abuse limits and fixing errors.
• Usage analytics (only if you accept analytics cookies): the pages you visit and what you do on them, such as signing up, uploading, converting, generating, editing, downloading and buying; whether your account is on a free or paid plan, and the plan or pack you buy with its list price; and your browser, device type and approximate location (country and city, which Google works out from your IP address). We never send your name, email address, account id, images, file names or prompts.

• To run the service: sign you in, trace, generate, edit, export and save your drawings, run your plan and keep your credit balance.
• To send account emails: email verification, password reset and changes to your account. Payment receipts come from Dodo Payments. We don't send marketing email without asking.
• To keep Adaver safe: rate limits, the human check, blocking automated use, and reviewing requests our content rules refuse.
• To understand how Adaver is used, which features help people, and where sign-up, conversion and checkout go wrong, so we can improve it. This uses usage analytics, and only if you accept analytics cookies.
• We never sell your data, and your images and drawings are never used to train AI models.

• Conversions (the uploaded image, every version and its exports): deleted 24 hours after they are made, or sooner if you delete them.
• Drawings you save to My drawings: until you delete them or your account.
• The text of a refused request: 30 days, so it can be reviewed, then deleted.
• Your account: until you delete it. A deleted account is removed for good after 30 days.
• Security and access logs: up to 12 months.
• Usage analytics: Google keeps the detailed data for 14 months and then deletes it. Only aggregated reports, such as visits per month, remain after that.
• Deleted files can stay recoverable in storage for up to 30 days before they are erased. Payment records are kept as long as tax and accounting law requires.

We use these providers, only for the purpose listed:

• Microsoft Azure (Central India): hosting, the database and file storage.
• Dodo Payments: checkout, subscriptions, payments and receipts (as merchant of record).
• Resend: account emails.
• Cloudflare: DNS and the human check (Turnstile).
• Anthropic and Azure OpenAI: drawings from descriptions and AI edits. Your request and, for edits, the drawing are sent to the model.
• Microsoft Azure AI Content Safety: an automatic safety check of descriptions and the images sent with them, of images the models make, and of images you upload for tracing (on the website and in the Figma plugin). It returns a verdict only; we keep a fingerprint of a checked image in memory so it is not checked twice, never the image.
• Google: if you sign in with Google, to confirm who you are; and, if you accept analytics cookies, Google Analytics, to measure how the site is used (see Analytics).

The Adaver plugin for Figma uses your Adaver account. This section says what it sends us and what we keep.

• What the plugin sends. The layers you select, exported as one PNG image, the preset and the settings you chose, and a plugin token that proves who you are. It does not send your file name, layer names, comments or anything else from your Figma file. The image is sent under a fixed name, not the name of your layer.
• What we keep: nothing of your image. The PNG and the SVG we send back are held in memory only while the conversion runs. We do not write them to disk, to our database or to file storage. The tracing engine keeps recent images in its memory for a short time to be faster, never on disk; they are gone when they are replaced or when the engine restarts.
• What we do keep. A record that one image was used (your account, the time, the result, no image data); the plugin token, stored only as a one-way hash with its last four characters, and removed 30 days after you disconnect or it is revoked; request counters used against abuse, which include your IP address and are deleted after 24 hours; and, for each press of Vectorize, a random id and a fingerprint of the image and settings (a one-way hash that cannot be turned back into the image), so that a retry after a lost answer is never charged twice, deleted after 24 hours. Our server logs hold the time, the page, the result, a request id and your account id for each call, never your image or your token. How long logs are kept is set in our hosting account.
• No AI drawing models. Tracing runs on our own engine. Your plugin images are not sent to Anthropic, Azure OpenAI or any other model that draws or edits.
• Safety check. Before tracing, each image is checked automatically by Microsoft Azure AI Content Safety, as on the website. It may refuse an image; a refused image is not charged.
• Disconnect. Press Disconnect in the plugin, or change your password, or delete your account: the plugin token stops working at once. Deleting your account removes your plugin tokens and usage records.
• Figma. Figma runs the plugin and has its own privacy policy.

We use Google Analytics 4 to understand how the site is used. It runs only if you accept analytics cookies in the banner; until you do, nothing is loaded from Google.

• What is sent. The usage analytics listed under What we collect. Page addresses are sent without anything after the "?", and drawing ids are replaced, so Google sees `/editor/:id`, not which drawing. Our admin pages send nothing.
• What is not sent. Your name, email address, account id, images, file names or prompts. Google Analytics does not log or store IP addresses; it uses them only to work out your country and city.
• Not linked to your account. We send no account identifier, so analytics data cannot be looked up or deleted per person. For your account data, use the Account page or write to us.
• No advertising. Advertising features, Google signals and links to Google Ads are turned off, and we don't use analytics for advertising.
• Changing your mind. Open Cookie settings (also in the footer) at any time. Declining stops analytics and deletes its cookies. You can also use Google's opt-out add-on. Google's own privacy policy: policies.google.com/privacy.

We use the cookies needed to keep you signed in (nc_access and nc_refresh, which scripts on the page can't read, and nc_session, a marker with no secret in it that tells the page you're signed in) and to finish a Google sign-in (nc_oauth). Cloudflare's human check may set its own cookies to tell people from bots.

If you accept analytics, Google Analytics sets the cookies `_ga` and `_ga_<id>` to count visits; they last up to two years unless you decline or clear them. They are not set if you decline, and declining later deletes them. Your choice is stored in your browser (`adaver.analytics-consent`) so we don't ask again, and you can change it at any time from Cookie settings in the footer.

We use no advertising cookies. The site also stores a few preferences, such as the theme, in your browser.

• Contract: your account, your drawings, your plan and credits, and account emails, because you asked us to provide the service.
• Legitimate interests: security, abuse and fraud prevention, blocking automated use, and fixing errors. We weigh these against your rights and keep only what we need.
• Legal obligation: payment and tax records.
• Consent: usage analytics with Google Analytics, only if you accept. You can withdraw consent at any time from Cookie settings; this stops analytics from then on.
• Apart from analytics, we don't rely on consent for anything we do today. If that changes (for example marketing email), we will ask first, and you can withdraw consent at any time.

Wherever you live, you can ask us to show you (access), correct, export (portability) or delete (erasure) the personal data we hold about you, restrict how we use it, or object to how we use it. If you are in the EU, the UK or another place with data-protection law such as the GDPR, these are your legal rights, and you can also complain to your data-protection authority. In India, you can also use our grievance process (write to the address below) and nominate someone to act for you.

• Change your name, email or password, or delete your account, on the Account page.
• For anything else, write to contact@nuvai.dev from your account's email address. We answer within 30 days.

Adaver is hosted in India (Azure Central India). Some providers above process data in other countries, such as the United States. For people in the EU or the UK, we rely on recognised safeguards for these transfers, such as the European Commission's standard contractual clauses.

We don't make decisions with legal or similarly significant effects about you by automated means alone. Our bot protection, rate limits and content rules can block a request or pause an account automatically; you can ask a person to review it.

Traffic is encrypted (HTTPS), passwords are stored as slow hashes, files are private to your account, and secrets are kept in a key vault. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires, including within 72 hours where the GDPR applies.

Adaver is for people 18 and over, and we don't knowingly collect children's data. If we learn we have, we will delete it.

We will update this page when what we collect or how we use it changes; the date at the top shows the latest version. Questions: contact@nuvai.dev. See also our Terms and conditions.