Privacy Policy

Operator: PRAIVON (praivon.com), a technology service providing identity protection worldwide, with data stored in the European Union.

Contact for all privacy matters: privacy@praivon.com

Services we provide: monitoring for identity leaks, impersonation and deepfakes, management of your reference photos and voice samples, expert-handled takedown requests, and alerts when we find something.

This Privacy Policy explains what personal data we collect, for what purposes, how we use and protect it, and the rights you have under the General Data Protection Regulation (GDPR) and other applicable laws.

(a) Information you provide directly

• Account: full name, email address, password (never stored in readable form), preferred language
• Identity protection profile: your legal name, aliases, usernames on platforms to be monitored, brand keywords you want tracked
• Reference photos and voice samples (required for face and voice protection): used, with your explicit consent, only to recognize you in content found online and to protect you
• Payment information: processed by our secure payment provider; we receive a customer reference ID, subscription tier, billing status, payment amounts and invoices, and the last four digits of the card, never your full card number or banking details
• Support communications: messages and attachments you send to privacy@praivon.com

(b) Information collected automatically

• Technical metadata: IP address, browser type, device type, operating system, language setting, and connection timestamps
• Log and usage data: pages visited, dashboard actions taken, errors encountered, used for service operation, debugging, and security monitoring
• Cookies: essential session cookies are always active; analytics and marketing cookies only with your explicit consent (see our Cookie Policy)

(c) Information from third parties

• Google OAuth (if you choose to sign in with Google): name, email address, Google profile picture, only what is necessary for account creation and sign-in
• Detection sources: when our monitoring identifies a potential match in publicly available content, we store the URL, platform name, detection type, and surrounding context as evidence to support any takedown request

(d) Free check

When you run a free check we keep your email address, your language, whether you asked for tips and offers, and a short summary of the result (the number of results per category and masked previews; never the name or username you searched). We use them to send you the result and, only if you ticked the box, three emails with tips and offers, each with an unsubscribe link. The link to your result expires after 24 hours. The result summary is deleted after 30 days. If you did not tick the box, your email address is deleted after 30 days too; if you did, it is kept until you unsubscribe or create an account.

• We process reference photos and voice samples ONLY with your explicit, informed consent, given during onboarding
• We keep a record of your consent, as GDPR Articles 7 and 9 require
• They are used, with your explicit consent, to recognize you in content found online and to protect you, never sold, never used for anyone else's purposes, and never used to train AI models
• You can permanently delete your reference photos and voice sample at any time from Settings → 'Delete biometric data'; they are erased immediately
• When you delete your account, your reference photos and voice sample are permanently erased
• Your data is encrypted and access to it is strictly limited
• During the live selfie we also check that you are an adult. We don't keep the selfie, and we keep the result only as yes/no.

Voice data (voice protection)

• Purpose: on plans with voice protection (Premium, Signature and Custom), your voice sample is used only to recognize copies and clones of your voice in content found online, so that we can have them removed. It is never used for anything else, never sold and never used to train AI models
• Legal basis: your explicit consent (GDPR Article 9(2)(a)), given with its own unticked box before you record or upload a sample. We keep a record of your consent with its date and the version of the text you agreed to
• Where it is processed: our voice-recognition service provider creates a voice profile from your sample and compares voices found online with it. It does this in the United States, under the European Commission's Standard Contractual Clauses (GDPR Article 46), only on our instructions and under a data-processing agreement
• How long we keep it: your voice sample and voice profile are kept only while your consent and your plan are active. They are deleted, by us and at our provider, as soon as you withdraw your consent or delete your voice data or your account, and 30 days after your plan ends. They are gone from our backups within 7 days
• How to withdraw: Settings → 'Withdraw voice consent' (or 'Delete biometric data'). Your voice sample and voice profile are deleted at once and voice checks stop. Withdrawing does not affect what was done before, and you can agree again later

• Provide and maintain the service: scanning, detection, takedown coordination, dashboard access, and alert delivery
• Account management: authentication, identity verification, billing processing, and account-related communications
• Security and fraud prevention: detecting abuse, rate limiting, and protecting against unauthorized access or account takeovers
• Legal compliance: processing DMCA notices, handling GDPR/CCPA data subject requests, complying with court orders, and maintaining tax records
• Service improvement: aggregated and anonymized analytics (no individual behavioral profiling) about how features are used, to prioritize product development
• Marketing communications: only with your explicit consent, with one-click unsubscribe available in every email we send

• Performance of contract (GDPR Article 6(1)(b)): providing the identity protection service you signed up and paid for, including all monitoring, detection, and takedown coordination
• Consent (GDPR Article 9(2)(a) and Article 6(1)(a)): biometric data processing: explicit consent required at onboarding; marketing communications: opt-in only; optional analytics cookies: consent via cookie banner
• Legitimate interests (GDPR Article 6(1)(f)): service security, fraud prevention, and improving service performance, always balanced against your rights and freedoms, and never overriding them
• Legal obligation (GDPR Article 6(1)(c)): tax record-keeping, responding to court orders, processing mandatory regulatory requests, and DMCA compliance

• We use your data, including your reference photos and voice sample, only to find content that may concern you and to protect you
• Takedown requests are sent only under the authorization you give us. Clear cases (re-uploads of content already removed, your own content, fake accounts using your photo) are sent automatically; every other request is reviewed by a person on our team first. This is not an automated decision with legal or similarly significant effects on you within the meaning of GDPR Article 22, and you can ask for human review at any time.
• We never use your personal data, reference photos or voice sample to train AI models, for us or for anyone else
• Where the EU AI Act applies to our service, we meet its requirements
• You have the right to ask for human review and a meaningful explanation of any automated result; contact privacy@praivon.com

We work with a limited number of service providers who process data on our behalf, only on our instructions and under data-processing agreements (for example hosting, payments, email delivery and customer support). Payments are handled by our secure payment provider. We never sell your data.

• We may also share information when legally compelled to do so (court orders, regulatory requests, law enforcement with a valid legal basis); we will attempt to notify you unless legally prohibited from doing so
• We may share data with your explicit, specific consent for purposes not listed above
• In the event of a business transfer (sale, merger, acquisition, or restructuring), your data may be transferred to the successor entity; you will be notified in advance and given meaningful choices about your data

We never sell your personal data. Full stop.

• Your data is stored in the EU. If a service provider processes data outside the EU/EEA, the transfer is protected by the European Commission's Standard Contractual Clauses or an adequacy decision.
• Voice data (voice protection) is processed by our voice-recognition service provider in the United States, under the European Commission's Standard Contractual Clauses (see section 3)
• For business clients on the Custom plan: we offer signed Data Processing Agreements (DPA) and, upon request, supplementary SCC arrangements tailored to your compliance requirements

• Active account: all data retained while your account is active and subscription is in good standing
• When you delete your account: everything is deleted from our live systems immediately and disappears from our backups within 35 days. We keep a record that the deletion happened. We keep, without your name or email address, the payment, refund, withdrawal and consent records that tax and consumer law require (they carry the payment provider's reference numbers).
• Reference photos and voice sample: deleted immediately when you delete them (Settings) or your account, and gone from our backups within 7 days. If your plan ends and you don't renew, they are deleted 30 days later; we email you 7 days before. One reference photo is sent for each whole-web face search to our face-search provider, which deletes it within 30 days.
• Accounts that never had an active plan are deleted automatically 30 days after sign-up, together with everything entered. When a plan ends, we delete your photos, selfie, voice sample and scan data after 30 days. Your account stays so you can come back, until you delete it or it has been inactive for 2 years. Aggregated, fully anonymous statistics may be kept longer
• Security log (sign-ins, with IP addresses stored encrypted): 12 months, then deleted automatically
• Backups: deleted data disappears from our backups within 35 days (reference photos and voice sample within 7 days)
• Legal hold: if Praivon becomes subject to litigation, a regulatory investigation, or a court-ordered data preservation request, specific data may be retained beyond standard periods until the matter is fully resolved

• Your data is encrypted and access to it is strictly limited
• Two-factor authentication: available for all accounts, strongly recommended; enable it in Settings
• We use an anti-abuse check on sign-in and sign-up to block automated attacks.
• If a breach ever affects your data, we tell you within 72 hours
• We protect your data with encryption, strict access controls and storage in the EU. No system connected to the internet is completely immune to attack, so we also ask that you use a strong, unique password and enable 2FA on your account

Security log

• For security, fraud prevention and payment disputes, we keep a record of your sign-ins and of your acceptance of our Terms (time, version, IP address and browser), based on our legitimate interest. The address and browser are removed when you delete your account.
• Purpose: the security of your account and preventing abuse of Praivon, for example someone else signing in to your account or face photos used without the person's consent
• Legal basis: our legitimate interest in keeping accounts and the service secure (GDPR Art. 6(1)(f))
• How long: sign-ins 12 months, then deleted automatically; the evidence of your Terms acceptance while your account exists (its address and browser are removed when you delete your account).
• Access: strictly restricted and recorded. We disclose it only when the law requires it, for example on a court order. In Settings → Account activity you see your own devices and recent sign-ins, and we email you when a new device signs in

Under GDPR (and equivalent protections under UK GDPR, Swiss FADP, Brazil LGPD, and similar frameworks worldwide), you have the right to:

• Access: obtain a copy of all personal data we hold about you (GDPR Article 15)
• Rectification: correct inaccurate or incomplete personal data (GDPR Article 16)
• Erasure: delete your account or specific data, 'the right to be forgotten' (GDPR Article 17), available directly in your dashboard
• Restriction: limit how we process your data in certain circumstances (GDPR Article 18)
• Data portability: receive your personal data in a structured, machine-readable format; ZIP export available in Settings → Data (GDPR Article 20)
• Object: object to processing based on legitimate interests at any time (GDPR Article 21)
• Withdraw consent: at any time for biometric data and marketing emails; this does not affect the lawfulness of processing carried out before withdrawal
• Not be subject to automated decisions: request human review of any AI-assisted detection or classification (GDPR Article 22)
• Lodge a complaint: in Romania: ANSPDCP (dataprotection.ro); in other EU countries: your national Data Protection Authority; in the UK: ICO (ico.org.uk)

To exercise any of these rights, contact privacy@praivon.com. We will respond within 30 days. We may need to verify your identity before processing the request.

• Know: understand what categories of personal information we collect, the sources, the purposes, and who we share it with
• Delete: request deletion of personal information we have collected
• Correct: request correction of inaccurate personal information
• Opt out of sale or sharing: Praivon does not sell or share personal information for cross-context behavioral advertising; this right is not applicable
• Non-discrimination: we will not discriminate against you for exercising your CCPA rights
• Limit use of sensitive personal information: we already limit biometric data use to the minimum necessary for the service

Categories of personal information collected in the past 12 months: Identifiers (email, name); Commercial information (subscription history); Internet and network activity (usage logs); Biometric information (face references on every plan; voice references on Premium, Signature and Custom plans); Professional information (only if voluntarily provided); Inferences drawn from the above.

To submit a California privacy rights request, email privacy@praivon.com with the subject line 'CCPA Request'.

• UK residents: Your rights mirror those under EU GDPR, extended by the UK GDPR. Supervisory authority: Information Commissioner's Office (ICO) at ico.org.uk
• Switzerland: The revised Swiss Federal Act on Data Protection (revFADP) applies. Supervisory authority: Federal Data Protection and Information Commissioner (FDPIC)
• Brazil: The Lei Geral de Proteção de Dados (LGPD) applies. Authority: Autoridade Nacional de Proteção de Dados (ANPD)
• Other regions: We work to honor equivalent privacy rights in all jurisdictions where we operate. If your local law provides stronger rights than those listed above, those stronger rights apply to you
• For any region-specific privacy question, contact privacy@praivon.com

• Praivon is designed for adults aged 18 or older and is not directed at children under 18
• We do not knowingly collect personal information from anyone under 18
• If you believe a child under 18 has created an account or provided personal information to Praivon, contact privacy@praivon.com immediately; we will promptly delete the account and all associated data
• If age verification becomes necessary in specific circumstances, we reserve the right to request supporting documentation

• In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it (GDPR Article 33)
• If the breach is likely to result in high risk to your rights and freedoms, we will notify you directly without undue delay, describing the nature of the breach and the steps taken (GDPR Article 34)
• Our security incident response process includes: immediate containment, detailed assessment, regulatory notification, direct notification to affected individuals, and full remediation
• Notification will be sent to the email address associated with your Praivon account

• We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or privacy best practices
• The 'Last updated' date at the top of this page reflects the version currently in effect
• For material changes (those that significantly affect your rights or how we use your data), we will notify active users by email at least 30 days before the change takes effect
• We will also display a prominent notice on the Praivon website and in the dashboard for material changes
• Continued use of Praivon after the effective date of any update constitutes your acceptance of the revised Privacy Policy

• Praivon uses essential cookies for session management (keeping you signed in) and language preference
• Analytics cookies (if and when enabled): set only with your explicit consent, to help us understand how the service is used in aggregate, no individual profiling
• We do not set advertising or marketing cookies
• Cookie consent is managed through the banner that appears on first visit; you can update preferences anytime via 'Cookie preferences' in the site footer
• For full details on every cookie we use, see our Cookie Policy

View Cookie Policy

For any privacy-related question, data subject request, or concern, we are here to help:

• Email: privacy@praivon.com, the only contact needed for all privacy matters
• Response time: We aim to respond within 30 days, and often much sooner for straightforward requests

You also have the right to lodge a complaint directly with your national data protection supervisory authority (see Section 11 for authority details). We are always willing to work with you to resolve any concern before escalation.