01Data controller
Kivo is published by Lou Jouhandeaud, entrepreneur individuel (sole trader), SIREN 109647040, SIRET 10964704000012, RCS Limoges 109647040, VAT FR67109647040.
Address: 5 impasse de la roche, 87000 Limoges, France. Contact: loujouhandeaudpro@gmail.com — +33 7 83 80 95 78.
02Information we collect
Kivo only collects what is necessary to run the service:
03Information you provide
Account creation: your email address and your sign-in method (password or Google). Passwords are stored encrypted by our authentication provider; Kivo never sees them in clear text.
In your profile: the first name you choose, an optional username, your language and appearance (dark or light mode).
04Images and uploaded content
Photos you upload are stored in a private storage space accessible only to your account. They serve as the base for the transformations you request.
Maximum size: 10 MB per image (JPG or PNG).
You are responsible for the images you upload: make sure you hold the necessary rights, including for identifiable people appearing in them.
05Generated content
Generated images are saved in your private space and remain available in your account.
They are not published by Kivo and are visible only to you.
06Prompts and projects
Your descriptions (prompts), your projects and their conversation messages are stored to keep your projects running and preserve your creation history.
07Personal identity
The Personal Identity feature (paid plans) lets you import reference photos to generate visuals of yourself. These photos are stored in your private space.
08Coins, subscriptions and payments
Kivo keeps a ledger of your Coins (grants, usage, refunds) and the history of your payments and subscriptions.
Card data never passes through Kivo’s servers: payments are processed by Stripe.
09Referrals and Creator Program
If you take part in referrals or the Creator Program, Kivo keeps the affiliate link, associated commissions and the information strictly needed to pay them.
10Security logs
Kivo keeps minimal technical logs (errors, security) to protect the service against abuse. Only the necessary technical information is collected.
11Contact requests
Messages sent through the Contact page are kept with the name, email, reason and message, in order to handle your request.
12How we use personal data
We use your data only to:
- provide the service: account creation, image generation, projects, Coins;
- manage subscriptions, payments and the Coin ledger;
- ensure security, and prevent abuse and fraud;
- answer your requests (support, contact);
- comply with our legal and accounting obligations.
13Legal bases
Contract performance: running the service and generations.
Legitimate interest: service security, abuse and fraud prevention.
Legal obligation: accounting and tax retention.
Consent: sending a message through the contact form.
14Third-party service providers
Kivo relies on strictly necessary providers:
15AI providers
Image generations are processed by Google’s models (Gemini / Nano Banana). For video, Kivo plans to use the Higgsfield API (coming soon).
Only the information needed for the generation (prompt, source image) is transmitted. See Google’s terms and privacy documentation for the associated processing.
Kivo does not claim that your content is used to train models.
16Payments
Payments are processed by Stripe (Stripe, Inc.). Card numbers do not transit through Kivo’s servers and Kivo does not store complete card numbers.
See Stripe’s own privacy and security documentation for details.
17Data retention
Retention is limited and proportionate to the purpose. The rules that apply:
- Uploaded photos: kept while the account and the relevant project are active; after account deletion, permanently deleted from active servers (exception: content reported under the Terms may be kept for up to 5 years where justified by legal/security requirements).
- Generated images: kept while your account is active; after deletion, intermediate archive for up to 5 years where necessary to establish, exercise or defend legal claims. Archived content is no longer part of your active space.
- Prompts: kept while the account is active; after deletion, kept for up to 1 year where necessary for applicable legal/security obligations, then deleted or permanently anonymised.
- Projects: kept while the account is active; after deletion, removed from active systems (technical cache cleanup: up to 30 days where applicable).
- Personal identity (reference photos): kept while the account is active; after deletion, archived for up to 3 years where necessary and proportionate to the applicable purpose.
- Coins and transactions: kept while the account is active; after deletion, intermediate archive for up to 5 years where necessary to establish financial/accounting history or defend contractual claims.
- Subscriptions: after contract termination, archived for up to 5 years where necessary for contractual/legal purposes.
- Payments and accounting records: 10 years where required by applicable accounting law (Article L123-22 of the French Commercial Code). This does not mean every payment-related personal data field is retained for 10 years.
- Referral data: kept while the account is active; after deletion, relevant referral/commission records may be archived for up to 5 years for financial, accounting, contractual or dispute purposes.
- Creator Program: kept while the contract/account relationship is active; after termination, relevant contracts and supporting records may be archived for up to 5 years; invoices/accounting records follow applicable accounting obligations.
- Security logs: relevant security/technical logs kept for up to 1 year where required or justified by legal/security requirements.
- Contact messages: kept while the request is being processed; after closure, relevant correspondence may be archived for up to 5 years where necessary and proportionate for support, contractual follow-up or dispute defence.
18International transfers
Some providers (hosting, database, AI, payments) may process data outside the European Union. Such transfers are governed by the mechanisms provided by applicable regulation (e.g. standard contractual clauses).
19Your rights
You have rights of access, rectification, erasure, restriction, objection and portability over your data, under the conditions set by applicable regulation.
To exercise your rights: loujouhandeaudpro@gmail.com. Account deletion is also available directly in Settings.
20Account deletion
When you delete your account:
- active account information is removed according to the deletion workflow;
- your active projects are deleted;
- your uploaded photos are deleted;
- active creations are removed from your user space;
- information that must legally be retained is placed in restricted/intermediate archive;
- retained information is not used for ordinary product functionality;
- retained records are deleted or anonymised once the applicable retention period expires.
21Security
Kivo applies appropriate technical and organisational measures: access control, encryption in transit, private image storage, security logs and restricted administrator access.
23Changes to this policy
This policy may be updated to reflect the evolution of the service. The last update date is shown at the top of this page.
24Contact
Lou Jouhandeaud — loujouhandeaudpro@gmail.com — +33 7 83 80 95 78 — 5 impasse de la roche, 87000 Limoges, France.
25Right to lodge a complaint with the CNIL
You may lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.