Privacy Policy

1. Introduction

Welcome to Loovie ("we," "us," "our," or the "Company"). We are committed to protecting your privacy and ensuring that your personal information is handled in a safe and responsible manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application Loovie (the "App") and our website located at https://loovie.app (collectively, the "Service").

This Privacy Policy is designed to meet the requirements of:

• The Australian Privacy Act 1988 and the Australian Privacy Principles (APPs)
• The EU General Data Protection Regulation (GDPR) for European users
• The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) for California residents
• Other applicable data protection laws

This Privacy Policy explains how we handle your information when you use the Service. If you do not agree with it, please do not use the Service. Where the law requires your consent for something, for example voice cloning, we ask for it separately at that point.

2. Information We Collect

2.1 Information You Provide Directly

When you use our Service, you may provide us with:

• Account: Email address, and your name if you sign in with Apple and share it. Optional display name and social media handle.
• Sign-in: A token from Apple or Google, or a one-time email link. We never see your Apple or Google password.
• Content: Text prompts, uploaded photos and videos, characters, backgrounds, projects, captions, lyrics, music, voice recordings, cloned and designed voices, chats with our in-app assistant, story plans, and photos and recordings captured in AR storyboard mode.
• Purchases: Transaction details (product, price, currency and country) received through RevenueCat from the Apple App Store or Google Play. We never receive your card details. If a purchase is refunded, we record the refund and adjust your credit balance as described in section 8.4 of our Terms of Service.
• Support and feedback: Messages and bug reports, and a screenshot and device details if you choose to attach them.
• Programs: If you join a competition, campaign, referral, gift link or our partner program, the details you give for it. For partners this includes name, company, website, social accounts, payout details, and the date, IP address and browser used to accept the partner terms.
• Consents: Records of confirmations you give us, such as voice cloning, BYO and MCP authorisations.
• Preferences: App settings, notification preferences, and feature preferences

2.2 Information Collected Automatically

When you use our Service, we automatically collect:

• Device information: Device model and brand, operating system and version, app version, screen size, timezone, language, a device identifier, and whether the device is an emulator. We use these to run the app, link installs to invite links, and stop the same device claiming free credits repeatedly.
• Install and referral information: The Google Play install referrer on Android, the invite or referral link you used, and campaign (UTM) parameters.
• Advertising measurement data: If you reach our website from one of our ads and ad measurement is on, we store the click identifier the ad platform added to the link (for example a Meta, TikTok, Reddit or ChatGPT Ads click ID) and the advertising cookie values set by that platform's pixel. If you later install the app, we may link that record to your account so we can report your sign-up, first video and first purchase back to that platform. See section 5.5.
• Usage Data: Features used, screens viewed, actions taken, generation history, export formats used
• Performance Data: App crashes, errors, load times, processing speeds
• Analytics Data: Session duration, engagement metrics and feature adoption through PostHog, linked to your Loovie user ID, signup date, authentication provider and subscription tier. PostHog also records session replays of screen interactions. For AI features, the text of prompts and AI responses may be recorded in PostHog against your user ID so we can measure quality and cost.
• Network and log data: IP address, timestamps, app version and error logs through Sentry. For invite links and competition clicks we may store the IP address itself.
• Push notification information: A OneSignal subscription identifier, your language, app version and subscription tier.

2.3 Information from Third Parties

We may receive information from:

• Authentication Providers: Basic profile information from Google or Apple when you sign in
• Payment Processors: Transaction confirmations and subscription status from RevenueCat
• Install and referral sources: The Google Play install referrer, invite and partner links, and campaign parameters, linked to your account when you install the app
• AI Service Providers: Processing status and metadata from the providers listed in section 14.1

2.4 Permissions We Request

Our App may request the following device permissions:

• Camera: To capture photos for characters and image-to-video generation, and to show your storyboard set in your room in AR (optional)
• Microphone and speech recognition: To speak prompts, record voiceovers and record voice samples for cloning (optional). On iOS speech to text runs on your device. On some Android devices your device's speech service, which may be provided by Google, processes the audio.
• Photo Library: To access images for video generation and save exported videos
• Screen recording (Android): To record AR storyboard takes (optional, microphone off)
• Notifications: To send you updates about video processing status (optional)

Loovie does not access your contacts. Loovie does not collect or use your location. The iOS app contains a location permission string that a third-party SDK requires, but Loovie does not use it.

3. How We Use Your Information

3.1 Service Provision

• Process your video generation requests using AI models
• Store and manage your projects, characters, and backgrounds
• Enable video editing and timeline management features
• Process exports and deliver your finished videos
• Manage your subscription and credit balance

3.2 Service Improvement

• Analyze usage patterns to improve features and user experience
• Monitor app performance and fix technical issues
• Develop new features based on user behavior and feedback
• Optimize AI model selection and processing speeds
• Measure the quality and cost of AI responses

3.3 Communication

• Send service-related notifications (video ready, export complete)
• Respond to support requests and inquiries
• Send important updates about your account or the Service
• Marketing communications (only with your consent)

3.4 Legal and Safety

• Comply with legal obligations and regulatory requirements
• Detect and prevent fraud, abuse, or violations of our Terms
• Protect the rights, property, and safety of our users and the public
• Enforce our Terms and Conditions

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process your personal data based on the following legal grounds:

Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests.

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information for money. Section 5.5 explains how we measure our own ads, which some privacy laws treat as sharing or selling, and your choices. We may share your information in the following circumstances:

In addition to the service providers and disclosures detailed below, your personal information may be disclosed to (a) third-party AI agents and applications that you authorise to access your Loovie account via our MCP (Model Context Protocol) interface, and (b) generation endpoints you configure under our Bring-Your-Own (BYO) feature. These recipients are not Loovie's service providers; they act on your instructions as separate data controllers. See section 5A (MCP Access) and section 5B (BYO Generation) below.

5.1 Service Providers

We share data with trusted third-party service providers who assist us in operating our Service:

• Cloudflare: Hosting, our main database and file storage, content delivery, email delivery for sign-in links, and some AI processing (image generation, speech transcription for captions, and a backup route for our AI assistant)
• Supabase: Sign-in and authentication
• RevenueCat: Manages in-app subscriptions and credit pack purchases made through the Apple App Store or Google Play. When you ask Apple or Google for a refund, RevenueCat may send them information about the purchase and whether it has been used, so they can decide your request.
• Stripe: Payouts to members of our partner and affiliate program. Stripe does not process app purchases.
• PostHog: Product analytics, session replay, in-app surveys and AI quality monitoring (linked to your Loovie user ID)
• Sentry: Crash and error reporting
• OneSignal: Push notification delivery
• Fal.ai: AI video, image, music, visual effects, upscaling and cutout processing
• Kie.ai: AI video, image, motion control, visual effects and upscaling
• MiniMax: AI video generation (see section 8)
• OpenRouter: Routes requests to AI language and video models, including models from OpenAI, Google and HeyGen, for our assistant, prompt improvement, story planning, scene analysis and some video features
• Apple/Google: App distribution, in-app purchases, sign-in and, on some Android devices, speech to text

Access to personal information is limited to authorised staff who need it to provide support, prevent fraud and operate the Service.

5.2 Legal Requirements

We may disclose information if required to:

• Comply with a legal obligation, court order, or government request
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing
• Protect the personal safety of users or the public
• Protect against legal liability

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information becomes subject to a different privacy policy.

5.4 Aggregated Data

We may share aggregated, anonymized data that cannot identify you personally for business purposes, research, or public reporting.

5.5 Measuring Our Own Advertising

Loovie does not show third-party advertising inside the app or on the website, and we do not sell your data to advertisers for money. We do advertise Loovie on other platforms, and we measure how those ads perform. To do that we use the advertising pixels and conversion interfaces of Meta (Facebook and Instagram), TikTok, Reddit and OpenAI (ChatGPT Ads), only for the platforms where we run ads. Some privacy laws, including California's, may treat sending these events as “sharing” or “selling” personal information for advertising, so we give you the choices below.

• Your choice on the website: In the European Economic Area, the United Kingdom, Switzerland and Canada the pixels load only after you accept in our banner. Everywhere else ad measurement is on by default and you can turn it off in the banner or with “Your privacy choices” in the website footer. We treat a Global Privacy Control signal or a Do Not Track setting from your browser as a choice to turn it off, unless you tell us otherwise. When you allow ad measurement we record your choice, the country we detected, the banner version and the time, so we can show what you chose. A decision to decline is kept in your browser and is not sent to us.
• Website pixels: When ad measurement is on, pixels from these platforms record page views, views of our audience pages and clicks on our App Store and Google Play buttons. We do not load them on sign-in, gift, invite, referral, partner dashboard or competition entry pages, or on any page whose address carries anything other than ad and campaign tags. The page address the platforms see can include those campaign tags and the ad click identifier.
• Linking a web visit to an install: When you click an App Store or Google Play button we store the ad click identifier, the advertising cookie values, your IP address, browser details and a device fingerprint (screen size, timezone, language) so we can recognise the same person if they install the app. This is a probabilistic match, not a certain one.
• Events from our servers, Android only: If you came from one of our ads, ad measurement was on, you confirmed you are 18 or over at sign-up and you did not opt out, we may send the ad platform that showed the ad three events: sign-up, your first finished video, and your first purchase (with value and currency). Each event carries the click identifier and advertising cookie values, the event time, the IP address and browser details from your web visit, and a stable one-way identifier we derive from your account or purchase ID. Where the match between your install and your web visit passes our stricter test, it also carries one-way (hashed) versions of your email address and account ID. Hashing makes the values harder to read but they are still personal information that the platform can match to its own users.
• iPhone and iPad: We do not send app events from our servers for iPhone or iPad users, we do not read your Apple advertising identifier, and the app does not ask to track you across other companies' apps and websites.
• What we never send: Your prompts, videos, images, voice recordings, characters or any other content you create.
• Why: To work out which ads lead to sign-ups and purchases, to pay for ads that work and stop ads that do not, and to help those platforms avoid showing our ads to the wrong people.
• Withdrawing: On the website, choose “Your privacy choices” and decline. We stop the pixels, clear the advertising cookies we can control and the click identifiers stored in your browser, and ask our servers to delete the click identifiers linked to that browser. In the app, turn off “Ad measurement” in Preferences, which clears the stored identifiers linked to your account and stops all further events. You can also email privacy@loovie.app. Events already received by an ad platform are handled under that platform's own policy (section 11).
• How long we keep it: We delete the click identifiers, advertising cookie values, IP address and browser details from our install link records after 90 days, and the log of events we sent after 180 days. Cookies set by the ad platforms follow their own lifetimes. Deleting your Loovie account deletes these records.

For visitors in the EEA and the UK, we and each ad platform decide together how the pixel data is collected and sent, so we are joint controllers for that collection and sending (GDPR Article 26). Each platform's terms set out its responsibilities, and each platform then uses the data for its own purposes under its own privacy policy. Our advertising is aimed at adults and is not aimed at children (see section 12). We send no events for accounts where the person has not confirmed they are 18 or over.

5A. Model Context Protocol (MCP) Access

Loovie operates an MCP server at api.loovie.app/v1/mcp that allows third-party AI applications (such as Claude Desktop, Claude Code, Cursor, ChatGPT, and other MCP-compatible clients) to access your Loovie account on your behalf.

5A.1 How authorisation works

When you connect an MCP client, you authorise it via OAuth 2.0 to access specific scopes, for example reading your projects, generating images or video, or reading your credit balance. Many MCP clients are bootstrapped via Dynamic Client Registration and are not pre-vetted by Loovie. You should review each client's own privacy policy before authorising it.

5A.2 Data disclosed to authorised MCP clients

Once authorised, the following data may flow from Loovie to that client, scoped to what you granted:

• Your projects and project content (timelines, clips, captions, music selections, transitions)
• Prompts you or the client submit to generation tools
• Generated images and videos, including signed URLs
• Character references and likenesses you have created in Loovie
• Asset metadata (filenames, sizes, types)
• Your credit balance and recent spend ledger entries
• Your Loovie user identifier (implicit in the access token)

5A.3 Legal basis and accountability

These third-party clients are independent data controllers, not Loovie's processors. Their handling of your data is governed by their own privacy policies, which Loovie does not control or warrant. Our lawful basis for this disclosure is your explicit consent (GDPR Article 6(1)(a)) given at the OAuth authorisation step.

5A.4 Revoking access

You can revoke an MCP client's access at any time by disconnecting Loovie in that client's own settings, or by emailing privacy@loovie.app and asking us to revoke it. Revoking access invalidates the client's tokens. Questions about MCP-related data handling can be sent to the same address.

5B. Bring-Your-Own (BYO) Generation

If you enable BYO and configure a generation endpoint, your generation requests, including prompts, parameters, and any character or reference images attached to the request, will be sent by the Loovie app on your device to the endpoint URL you provide. Your endpoint URL and access token are stored only on your device. Loovie's servers keep only a short-lived record of each pending BYO job so results can be matched to your account.

5B.1 Where your data goes

The BYO endpoint may be hosted on:

• Hardware you own and operate
• A third-party cloud GPU provider such as RunPod, Vast.ai, Lambda, or similar
• Any other infrastructure you control

Loovie does not vet, audit, or have a data processing agreement with these recipients. The endpoint may be located in any jurisdiction, including ones without an EU adequacy decision or APP-equivalent privacy framework.

5B.2 Your responsibilities

By enabling BYO and submitting a generation request to your endpoint, you:

• Acknowledge that you are the data controller for that processing leg of the journey;
• Consent to the international transfer of personal information under GDPR Article 49(1)(a) (explicit consent derogation);
• Acknowledge that Loovie has expressly informed you that Australian Privacy Principle 8.1 will not apply to this disclosure, and consent on that basis (Privacy Act 1988 (Cth), APP 8.2(b));
• Take responsibility for the privacy compliance of any reference images you submit, including obtaining consent from any identifiable individuals depicted.

Endpoint URL responsibility: Loovie does not re-validate the ownership of your configured BYO endpoint URL over time. If the underlying domain changes hands (sale, DNS hijack, expiry), the app will continue sending your generation requests to the URL until you update or remove it. You are responsible for maintaining control of the domain and removing the endpoint configuration promptly if you lose that control.

Questions about BYO-related data handling can be sent to privacy@loovie.app.

6. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy:

After the retention period expires, we will securely delete or anonymize your personal information. Some information may be retained longer if required by law or for legitimate business purposes.

6.1 MCP and BYO retention

• MCP access tokens expire after 15 minutes and refresh tokens after 30 days unless renewed by use. MCP clients that were registered automatically and have not been used for 90 days are removed.
• BYO endpoint URLs and access tokens are stored on your device only and are removed when you remove them or sign out.
• We record MCP tool usage (tool name, time, client and your user ID, not your prompts or images) in our analytics and server logs for security and abuse detection, retained as described above.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest
• Access Controls: Role-based access controls and authentication requirements
• Security Monitoring: Regular security audits and vulnerability assessments
• Incident Response: Established procedures for handling security incidents
• Employee Training: Regular privacy and security training for our team
• Third-Party Security: We require our service providers to maintain adequate security measures

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Loovie's security measures protect your data while it is held by Loovie. Once data has been disclosed to an MCP client or BYO endpoint at your authorisation, that data is governed by the recipient's security practices, which Loovie does not control or warrant. You should review the security posture of any MCP client or BYO infrastructure before authorising it.

Our breach notification commitments apply only to incidents affecting data held by Loovie. Breaches at MCP clients or BYO endpoints are the recipient's responsibility under their own laws and notification timelines.

8. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your country of residence, including the United States, where data protection laws may differ from your jurisdiction.

8.1 Transfer Safeguards

We ensure appropriate safeguards for international transfers:

• For EU/EEA Users: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission
• For Australian Users: We ensure recipients provide substantially similar protections as required by the APPs
• Adequacy Decisions: Where available, we rely on adequacy decisions by relevant authorities

8.2 Third-Party Processors Locations

• Cloudflare, RevenueCat, Stripe, Sentry, OneSignal: United States and other countries where the provider operates
• PostHog: United States
• Advertising platforms (Meta, TikTok, Reddit, OpenAI): United States and other countries where those companies operate
• AI services (Fal.ai, Kie.ai, OpenRouter and the model makers they route to): United States and other countries where those providers operate their servers
• MiniMax: MiniMax is a China-based company. Where it processes video generation requests is set by MiniMax and is not published by it, so processing can take place outside Australia, including in China

We name the provider for each AI feature in section 14.1. We take reasonable steps under the Australian Privacy Principles to make sure overseas recipients handle your information consistently with those principles, and we remain accountable for them.

When you authorise an MCP client or configure a BYO endpoint, your personal information may be transferred to countries outside Australia that may not provide a level of protection equivalent to the Australian Privacy Principles. By taking these actions you consent under APP 8.2(b) to the disclosure, and you acknowledge that APP 8.1 does not apply to the overseas recipient. Loovie will not be accountable under section 16C of the Privacy Act 1988 (Cth) for acts of recipients you have authorised.

9. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

9.1 Universal Rights

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information (subject to legal obligations and the retention described in section 6)
• Opt-out: Opt-out of marketing communications at any time

9.2 How to Exercise Your Rights

To exercise any of these rights:

• In-App: Access account settings for basic data management
• Email: Send requests to privacy@loovie.app
• Response Time: We will respond within 30 days (or as required by law)
• Verification: We may request information to verify your identity

9.3 Data Portability

You can export your data in a structured, commonly used format:

• Export your videos and projects directly from the app
• Request a full data export by contacting privacy@loovie.app. We will provide your account data and content in a machine-readable format within 30 days of a verified request.

9.4 Automated Decision-Making

To prevent abuse of free credits, our systems automatically assess signups using one-way hashes of your email address, device identifiers, network and browser details, and how many times an account has been deleted and recreated. Based on this, a new account may automatically receive no free credits or be blocked from signing up for a period. AI features generate content from your inputs and do not make decisions about you. If you think an automated decision about your account is wrong, contact privacy@loovie.app and a person will review it.

Limit on deletion requests: deletion requests apply to data held by Loovie. Data already disclosed to MCP clients or BYO endpoints that you authorised cannot be retrieved or deleted by Loovie. You must contact those recipients directly to exercise your erasure rights (GDPR Article 17) over their copies.

10. Cookies and Tracking Technologies

10.1 Mobile App

Our mobile app does not use cookies. It uses:

• Device Identifiers: To keep you signed in and to prevent abuse of free credits
• PostHog: Usage analytics, in-app surveys and session replay, linked to your Loovie user ID. Session replay records how screens are used, and images shown on screen can be visible in replays. You can turn off usage analytics and screen recordings at any time in Preferences. If you do, we will have less information to diagnose failed payments or product problems, so fixing them may take longer. Crash reports are still sent.
• Sentry: Crash reporting for error tracking and app stability

The app does not contain advertising SDKs, does not show ads, and does not read your Apple advertising identifier. Advertising measurement for the app happens on our servers as described in section 5.5.

10.2 Website

Our website uses:

• Essential storage: Required for website functionality
• PostHog: Analytics identifiers stored in your browser, with session recording of page interactions
• Advertising pixels (when ad measurement is on for you): Pixels from Meta, TikTok, Reddit and OpenAI set or read advertising cookies and identifiers (such as _fbp, _fbc, _ttp, __oppref and __obref), and we store the ad click identifier from the link you came from (such as fbclid, ttclid, rdt_cid or oppref) in your browser for up to 30 days. They are used only to measure our own ads (section 5.5). Your choice is stored in your browser and can be changed with “Your privacy choices” in the footer. Third parties set cookies through these pixels. You can also opt out of interest-based advertising at aboutads.info/choices, youronlinechoices.eu or in each platform's own ad settings.
• Browser fingerprinting: On competition and invite pages, and whenever you click an App Store or Google Play button, we generate a browser fingerprint (screen size, timezone, language and similar) to prevent duplicate votes and to link app installs to invite links and to our ads

10.3 Do Not Track

For ad measurement, we treat a Global Privacy Control signal or a Do Not Track setting as a choice to turn it off. Other parts of our website, such as product analytics, do not currently respond to Do Not Track signals.

11. Third-Party Services

Our Service integrates with various third-party services. Each has their own privacy policy:

This list covers Loovie's contracted service providers. It does not include third-party MCP clients you authorise or BYO endpoints you configure, those are independent recipients you choose directly. See section 5A and section 5B.

We are not responsible for the privacy practices of third-party services. We encourage you to review their privacy policies.

12. Children's Privacy

Loovie is for adults aged 18 and over. Our Service is not directed to children or anyone under 18, and we do not knowingly collect information from them. Children do not have Loovie accounts. Some parents and grandparents use Loovie to make stories together with the children in their lives. In that case the adult holds the device and stays in control, and we collect information only about the adult account holder.

12.1 Age Requirements

• Minimum age: 18 years, everywhere
• We ask new users to confirm they are 18 or over when they sign up
• We do not need or use photos of children to make a story

12.2 Parental Rights

Parents or guardians may:

• Ask us whether we hold information about their child
• Ask us to delete any account or information that belongs to someone under 18
• Refuse further collection of their child's information

If we learn that someone under 18 has an account or that we have collected information from a person under 18, we will close the account and delete that information promptly. Please contact us at privacy@loovie.app if you believe this has happened.

Because Loovie is for adults only, minors may not authorise MCP clients or configure BYO endpoints. Parents and guardians who become aware that a minor has done so should contact privacy@loovie.app for revocation assistance.

13. Marketing Communications

13.1 Consent

We will only send you marketing communications with your explicit consent, in compliance with:

• Australian Spam Act 2003
• GDPR requirements for EU users
• CAN-SPAM Act for US users

13.2 Types of Communications

• Service messages: Sign-in links, updates about your videos, and important account and billing notices
• Push notifications: Reminders and offers, such as unused credits and free video campaigns
• In-app surveys: Occasional optional questions about your experience
• Marketing emails: Only if you opt in

13.3 Unsubscribe

You can unsubscribe from marketing communications at any time by:

• Clicking "unsubscribe" in any marketing email
• Turning off Loovie notifications in your device settings
• Contacting us at support@loovie.app

14. AI-Generated Content and Privacy

14.1 Content Processing

When you use our AI features, your creative content is sent to third-party AI service providers for processing. The tables below detail exactly what data is sent, to which provider, and for what purpose, for each feature.

Clarification: MCP clients (section 5A) operate differently from our contracted AI providers: they receive your Loovie user identifier implicitly via the OAuth access token, and project metadata they retrieve may include names, character labels, or other identifying text you have entered.

Video Generation

Image Generation

Video Visual Effects (VFX)

Music Generation

Text Generation

The tables above cover the main generation features. Other features also send content to providers: voice (design, cloning, text to speech and voice conversion) runs on Loovie's own servers, and voice recordings and text are sent there; captions and transcription send audio from your clips to Cloudflare Workers AI; the AI assistant, story planning, prompt improvement and scene and character analysis send text, attached images and story details to OpenRouter, with Cloudflare Workers AI as a backup; cutout sends your photo or video to Loovie's own servers and to Fal.ai; swap, motion control and visual effects send your video and character images to Fal.ai, Kie.ai and OpenRouter (HeyGen); upscaling uses Fal.ai and Kie.ai; and the AR storyboard uses a photo of your room to generate scene images. A frame check sends still frames to a language model to see whether a person is in the shot.

All AI providers process your content according to their respective privacy policies (see Section 11). Generated content (videos, images, music) is returned to your device and stored in your account. Loovie does not use your content to train AI models. We do not currently set provider-level data-sharing controls on every provider, so each provider's own terms also apply.

14.2 Content Ownership

You retain ownership of:

• All prompts and inputs you provide
• Images and content you upload
• AI-generated videos, images, and music you create
• Custom lyrics you provide for music generation

14.3 Content Moderation

We may use automated systems to detect and prevent generation of prohibited content (violence, adult content, etc.) as outlined in our Terms of Service. This processing is done to ensure safety and legal compliance.

14.4 Face Data and Biometric Information

14.5 AI Data Sharing

15. Region-Specific Privacy Rights

15.1 Australian Residents

Under the Privacy Act 1988 and Australian Privacy Principles:

• Access: Request access to your personal information (APP 12)
• Correction: Request correction of inaccurate information (APP 13)
• Complaints: Lodge a complaint with us or the Office of the Australian Information Commissioner (OAIC)
• Anonymity: Where practicable, option to deal with us anonymously
• Cross-border disclosure: We disclose personal information to service providers overseas, mainly in the United States, and for some AI features in other countries where our AI providers operate, which can include China (see sections 5 and 8). We take reasonable steps under APP 8 to ensure these recipients handle your information consistently with the Australian Privacy Principles.
• Complaints: We will acknowledge complaints within 7 days and respond within 30 days. If you are not satisfied, you can contact the OAIC.

OAIC Contact: www.oaic.gov.au | Phone: 1300 363 992

15.2 European Union Residents (GDPR)

Under the General Data Protection Regulation:

• Access: Obtain confirmation and copies of your data (Article 15)
• Rectification: Correct inaccurate data (Article 16)
• Erasure: Request deletion ("right to be forgotten") (Article 17)
• Restriction: Limit processing of your data (Article 18)
• Portability: Receive data in machine-readable format (Article 20)
• Object: Object to processing based on legitimate interests (Article 21)
• Automated decisions: Not be subject to automated decision-making (Article 22)
• Withdraw consent: Withdraw consent at any time
• Lodge complaint: File a complaint with your supervisory authority

15.3 California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to Know: Request disclosure of personal information collected
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt-out of sale/sharing (we do not sell your data)
• Right to Non-Discrimination: Equal service regardless of privacy choices
• Right to Correct: Request correction of inaccurate information
• Right to Limit: Limit use of sensitive personal information

Advertising measurement and CPRA "sharing": sending the website pixel data and the conversion events in section 5.5 to Meta, TikTok, Reddit and OpenAI may count as "sharing" for cross-context behavioural advertising, and possibly as a "sale", under California law. Ad measurement is on by default outside the regions listed in section 5.5, and you can opt out at any time with “Your privacy choices” in the website footer, in the app under Preferences, or by emailing privacy@loovie.app. We honour Global Privacy Control signals as an opt-out.

MCP authorisations and CPRA "sharing": authorising a third-party MCP client to access your Loovie account may constitute "sharing" of personal information under the California Privacy Rights Act (Cal. Civ. Code §1798.140(ah)). Loovie does not sell personal information. You may revoke any MCP authorisation at any time by disconnecting Loovie in that client or by emailing privacy@loovie.app, which functions as your "Do Not Share" mechanism for that client.

15.4 UK Residents

UK residents have similar rights to EU residents under the UK GDPR. You may contact the Information Commissioner's Office (ICO) at ico.org.uk.

15.5 Canadian Residents

Under PIPEDA, you have the right to access and correct your personal information. Contact the Privacy Commissioner of Canada at priv.gc.ca.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

The May 27, 2026 update materially changed this policy to describe disclosure pathways for our hosted MCP server and Bring-Your-Own (BYO) generation feature. The banner at the top of this page describes the change.

16.1 Notification of Changes

We will notify you of material changes by:

• Posting the updated Privacy Policy on our website and app
• Updating the "Last Updated" date at the top
• Sending an email notification for significant changes
• Displaying an in-app notice for material changes

16.2 Your Choices

If you disagree with a change, you may stop using the Service and request deletion of your account.

17. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: