Privacy Policy

Version 1.0 · Effective 6 October 2026

Data Controller

Sevli at https://sevli.app is operated by YANG YANG as an individual operator based in China. Privacy questions and requests: support@sevli.app. We have not appointed a separate data protection officer.

Data We Process

• Account details: email, name, profile picture, sign-in provider and verification status; hashed password information where email/password sign-in is used.
• Creative content: prompts, reference images, generated images, conversations and your chosen generation settings.
• Transaction details: order and subscription references, plan, payment status, amount, currency, credit allocations and usage. Full card numbers are handled by payment processors, not stored by Sevli.
• Support and safety records: tickets, messages, attachments, relevant moderation results and reported abuse.
• Technical and security data: request time, IP address and browser/session information needed to operate the service, prevent fraud and diagnose failures.

Purposes and Processing Grounds

We process account, creative and purchase data to provide the service and perform the purchase contract. Billing records may also be retained for legal obligations. Security, fraud prevention, safety checks and necessary service diagnostics serve legitimate operational interests, subject to applicable law. Optional external sign-in uses the provider you choose. We do not currently send marketing campaigns or sell your personal information.

Cookies and Similar Storage

We use session cookies for sign-in and security, and cookies or local storage for language, theme, generation preferences and purchase attribution. You can clear them in your browser, which may sign you out or reset preferences. Optional third-party sign-in services apply their own privacy policies.

We use Google Analytics 4 to measure visits to public pages, traffic sources, browser/device information and approximate location. Analytics may use cookies. We exclude private conversations, account and administrator pages from page-view tracking, remove URL query strings and fragments, and do not send prompts, email addresses or uploaded/generated images to Analytics. Advertising personalization and Google signals are disabled. We respect browser Do Not Track and Global Privacy Control signals; you may also block analytics with your browser settings or Google's Analytics opt-out add-on.

Service Providers and Sharing

Requests use APIMART and its selected AI model providers. SeeAPI receives prompts, reference images and generated images for content safety checks. Cloudflare hosts application data, logs and image files and forwards incoming support email. Resend sends account and transactional emails. Google processes optional Google sign-in.

Payments are handled by the provider shown in checkout: Stripe or Waffo Pancake. For Waffo purchases, Waffo Pancake is the Merchant of Record and handles payment, tax and required billing data. Payment processors apply their own privacy and retention policies; full card information does not pass through Sevli's application server.

We share only information needed for these functions, legal requirements or protecting users and the service. Providers may process information in other countries; applicable transfer and privacy safeguards apply. We do not operate our own model-training program on uploaded content. External model processing is subject to the provider's terms; do not upload material you lack authority to share with these services.

Storage and Retention

Accounts, creative history and support records are retained while needed to provide your account and resolve related requests. Canceling a subscription does not delete your account or images. There is currently no automatic deletion timer merely because an account is inactive or a subscription was canceled.

To close your account or request deletion, email support. We normally respond to access and deletion requests within 30 calendar days, verifying account ownership first and explaining any lawful extension or retention requirement. Non-required account and creative information is removed or anonymized when the deletion request is fulfilled. Billing and safety records may be retained where needed for legal duties, fraud prevention or a live dispute; we explain the relevant purpose and retention period when handling your request. Verification credentials expire according to their configured validity, no longer than 24 hours for current email verification links. Infrastructure and email providers retain their own operational records under their policies.

Images and Sharing

Your account's gallery is not listed as a public community gallery. Image files use unique links; anyone who receives a file link may be able to view that file. Share pages you choose to publish can be publicly accessible. Only share content you intend others to receive, and avoid placing sensitive material in images or links you make public.

Security

We use HTTPS, server-side access controls and encrypted storage for configured provider secrets. No online system can guarantee absolute security. Report suspected incidents to support; we investigate and provide notifications where required by applicable law.

Your Rights

Depending on applicable law, you can request access, correction, an export, deletion, restriction or objection to processing, and withdraw consent where processing relies on it. Profile corrections are available in account settings; use support@sevli.app for other requests. You may also complain to the competent privacy authority. We may need to verify your identity before releasing account information.

Children

Sevli is intended for users aged 18 or older. We do not knowingly provide accounts to children or accept content exploiting them. If you believe a child has supplied personal data, contact support so we can investigate and remove it where appropriate.

Changes and Contact

We record policy changes with an updated effective date and notify users of material changes as required. Questions: support@sevli.app. See also our Terms of Service and Content Policy.