Privacy Policy & Security Terms | Stuv AI
Chat with us
Legal & Compliance

Privacy Policy & Security Terms

Comprehensive disclosure of our data collection, Google OAuth user data compliance, and enterprise security safeguards.

Last updated: October 8, 2026 • Effective Date: October 8, 2026

Quick Navigation

1. Overview & Scope2. Information We Collect3. How We Use Information4. Google API & OAuth Compliance5. Data Sharing & Third Parties6. Data Retention & Deletion7. Enterprise Security Safeguards8. Your Privacy Rights9. Cookies & Tracking10. Contact Us

1. Overview & Scope

Stuv AI ("Stuv", "stuv.ai", "we", "our", or "us") provides an AI-powered commerce and visual generation platform, including automated product photography, room visualization, virtual try-on, catalog creation, and digital marketing agents (collectively, the "Service").

This document serves as our official Privacy Policy and Security Terms. It details our transparent practices regarding the collection, use, processing, storage, sharing, and protection of your personal information, as well as our strict adherence to the Google API Services User Data Policy for Google OAuth authentication.

2. Information We Collect

We collect only the information necessary to provide, secure, and enhance our Service. We collect information in the following categories:

2.1 Google Account Data (via Google OAuth 2.0)

When you sign up or log in to Stuv.ai using "Sign in with Google", Google requests your permission to share certain account information with us. With your authorization, we receive and store:

  • Full Name: To personalize your account and display your profile.
  • Email Address: To uniquely identify your account, send transaction confirmations, and communicate essential service notices.
  • Google Account Identifier (ID): To authenticate your identity securely across sessions.
  • Profile Picture URL: To display your user avatar within the application interface.

We request only basic authentication scopes (openid, email, profile). We do not request access to your Google Drive, Gmail, Google Contacts, or other private Google services.

2.2 Account & Profile Information

When you register manually or configure your workspace, we collect your business name, company website, phone number, industry type, and brand configuration preferences.

2.3 User Content & Uploads

To deliver our AI visual generation services, we process the media files, product photographs, design references, prompts, and brand assets that you upload to the platform.

2.4 Payment & Billing Data

When you purchase credits or subscription plans, payments are handled directly by PCI-DSS compliant payment gateways (such as Razorpay or Stripe). Stuv.ai does not store or process complete credit card numbers, debit card numbers, or CVVs. We receive only transaction confirmations, subscription statuses, and invoice identifiers.

2.5 Technical & Diagnostic Usage Data

When you access the Service, our servers automatically log technical information, including your IP address, browser type and version, device information, operating system, referring URL, pages accessed, timestamps, and error diagnostic logs.

3. How We Use Your Information

We use collected information solely for legitimate business operations and delivering the features you request:

  • Authentication & Account Management: Authenticating your identity via Google OAuth or credentials, maintaining active sessions, and managing role-based access permissions.
  • Service Delivery: Processing your product imagery, executing AI generation requests (such as background generation, multi-angle staging, virtual try-ons, and upscaling), and maintaining your generated catalog.
  • Brand Identity Preservation: Tailoring generation results to your specific brand identity, color palettes, and stylistic rules.
  • Account & Billing Administration: Processing credit balances, plan renewals, invoicing, and transactional receipts.
  • Customer Support & Communication: Responding to inquiries, resolving technical issues, and dispatching critical notifications (e.g. security alerts, policy changes, system status).
  • Platform Security & Fraud Prevention: Protecting against malicious activity, unauthorized account access, DDoS attacks, and violations of our Acceptable Use policy.
  • Legal Compliance: Satisfying applicable legal, accounting, tax, and regulatory requirements.

4. Google API Services User Data Policy Compliance

Stuv.ai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Our Limited Use Commitments:

✓
Minimal Scope Access: We strictly request only the minimal Google OAuth scopes (openid, email, and profile) required to verify your identity and instantiate your account.
✓
No Advertising or Marketing: Google user data is NEVER used or transferred to serve advertisements, including personalized, retargeted, or interest-based ads.
✓
No Sale of Google User Data: We do NOT sell, rent, license, or trade Google user data to data brokers or third parties under any circumstances.
✓
No Generalized AI/ML Model Training: We do NOT use data obtained through Google APIs to train, retrain, or improve generalized or foundation artificial intelligence or machine learning models.
✓
Strict Human Access Controls: No humans at Stuv are permitted to read Google user data, unless:
  • We have obtained your explicit affirmative consent for specific support or technical investigations;
  • It is strictly necessary for security purposes (such as diagnosing malicious system abuse);
  • It is required to comply with applicable law or legal process; or
  • The data has been aggregated and de-identified for internal performance metrics.
✓
Revocation of Google Access: You can revoke Stuv.ai's access to your Google account at any time by visiting your Google Account Security Settings. Upon revocation, Stuv will no longer be able to access your Google profile data.

5. Data Sharing & Third Parties

We believe your data belongs to you. Stuv.ai does not sell, trade, or rent personal data to third parties. We share data only under the following limited conditions:

  • Cloud Infrastructure (AWS): We host our application, encrypted databases, and media storage on Amazon Web Services (AWS) data centers with enterprise-grade access control, KMS encryption, and isolation.
  • AI Processing Services: To render image enhancements and visual transformations, media is processed through trusted AI compute engines. These providers act exclusively as data processors under strict contractual safeguards, do not retain customer data, and are prohibited from conducting analytics or training models on your content.
  • Payment Processors: We partner with trusted, PCI-compliant payment gateways (Razorpay, Stripe) to process billing. Payment partners operate under their own privacy and compliance standards.
  • Legal Requirements: We may disclose information if required by subpoena, court order, or applicable law, or when necessary to protect the safety, property, or legal rights of our users or Stuv.

6. Data Retention & Deletion Policy

We retain your account data and generated content only for as long as your account is active or as necessary to provide you with the Service and fulfill legal obligations.

6.1 Data Portability & Export

You may request a complete export of your user data, generated media, and catalog records at any time in standard formats (such as CSV, JSON, or ZIP archive) by submitting a request to support@stuv.ai.

6.2 Account & Data Deletion Requests

You have the right to request permanent deletion of your account and all associated personal information, Google OAuth profile data, and uploaded assets.

To initiate an account or data deletion request:

  1. Email our privacy team at privacy@stuv.ai or support@stuv.ai with the subject line "Account Data Deletion Request" from the email address linked to your Stuv account; or
  2. Use the account deletion option within your user profile settings in the Stuv dashboard.

Upon verification, your personal data, profile information, and uploaded content will be permanently purged from active production systems within 30 days, and securely overwritten from rolling backups in accordance with standard disaster-recovery cycles.

7. Enterprise Security Safeguards

Security is foundational to Stuv.ai. We employ defense-in-depth architecture, rigorous operational procedures, and automated testing to safeguard all customer data.

7.1 Access Control & User Authentication

Stuv provides secure access to the platform through username-and-password credentials and industry-standard OAuth 2.0 (Google Sign-In).

We enforce Role-Based Access Control (RBAC) to ensure that users can access only the features and data permitted based on their assigned roles. All internal administrative access rights follow least-privilege principles and require multi-factor authentication (MFA).

7.2 Secure Software Development Lifecycle (SDLC)

Stuv adheres to secure SDLC best practices throughout development. All code changes are created, peer-reviewed, and merged via GitHub with automated controls:

  • Automated dependency vulnerability scanning
  • Static application security testing (SAST) and code scanning
  • Continuous Dependabot vulnerability alerts
  • Immutable audit logging and version control history

7.3 Change & Configuration Management

All infrastructure and software modifications are reviewed, documented, and verified through CI/CD pipelines before deployment. Complete audit trails and change histories are preserved to ensure accountability and integrity.

7.4 Data Storage & Residency

Stuv operates on a country-specific data residency model. Customer data is stored within certified AWS cloud data centers located in the customer's region of operation.

We currently support customers across India, United Arab Emirates, Singapore, Indonesia, the United States, and the European Union, complying with regional data residency guidelines.

7.5 Encryption & Cryptographic Controls

Encryption at Rest: All customer data, user content, and database volumes are encrypted using industry-standard AES-256 encryption. Cryptographic keys are managed via AWS Key Management Service (KMS) with automated hardware-backed rotation and strict IAM controls.

Encryption in Transit: All data transmitted between user devices, Google APIs, and Stuv servers is encrypted using Transport Layer Security (TLS 1.2 and TLS 1.3) with strong cipher suites.

7.6 Infrastructure & Network Hardening

Our cloud infrastructure is hardened following AWS Well-Architected Security best practices:

  • Isolated Virtual Private Clouds (VPCs) with private subnets
  • Restricted Security Groups and zero-trust IAM role policies
  • Automated operating system security patching and vulnerability monitoring
  • Web Application Firewall (WAF) and distributed denial-of-service (DDoS) protection

7.7 Continuous Monitoring, Audit Logs & Incident Response

We monitor infrastructure in real time using AWS CloudWatch (metrics, alarms, anomaly detection) and AWS CloudTrail (tamper-evident audit logging of all administrative actions).

Our Incident Response team maintains an incident response protocol. In the event of a confirmed security breach affecting personal data, affected customers and regulatory authorities will be notified promptly in accordance with applicable legal requirements.

7.8 Availability & Disaster Recovery

Stuv maintains automated continuous backups, multi-zone database replication, and health monitoring to ensure high availability and rapid disaster recovery in the event of hardware or data center failure.

8. Your Privacy Rights

Depending on your geographic location (including the European Union under GDPR, California under CCPA/CPRA, and India under the Digital Personal Data Protection Act), you have important privacy rights regarding your personal data:

  • Right of Access: You have the right to request confirmation of data processing and obtain a copy of your personal data.
  • Right to Rectification: You may update or correct inaccurate or incomplete profile details at any time.
  • Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your personal data.
  • Right to Restrict or Object: You may object to or restrict certain types of data processing.
  • Right to Data Portability: You may receive your data in a structured, machine-readable format.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting lawful processing prior to withdrawal.
  • Non-Discrimination: We will never discriminate against you for exercising any of your legal privacy rights.

9. Cookies & Local Storage

We use strictly necessary session cookies and browser local storage tokens to keep you securely signed in, protect against cross-site request forgery, and store your workspace UI preferences. We do not use third-party tracking cookies for behavioral advertising. You can control or clear cookies through your browser settings.

10. Children's Privacy

Stuv.ai is a business tool designed for commercial enterprises and creators. It is not directed to individuals under 18 years of age (or under 13/16 where defined by local law). We do not knowingly solicit or collect personal information from children. If we learn that a minor has provided us with personal information, we will delete that data immediately.

11. Changes to This Policy

We may periodically update this Privacy Policy & Security Terms to reflect enhancements to our features, third-party integrations, or applicable laws. Material changes will be communicated via email or through prominent platform notices prior to taking effect. Your continued use of Stuv.ai following updates signifies your acceptance of the revised terms.

12. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy, your Google OAuth data, or our security practices, please contact us:

← Terms & ConditionsBack to Home →