Your privacy matters.

The short version

Your work belongs to you. We store and process it to provide the creative tools, storage and sharing features you choose. We do not sell your artwork or use it, privately or publicly, to train generative AI models. We do not authorise our service providers to do that for us.

We use trusted technical providers to run NIVA. We do not pretend everything lives only on your computer. If you save to Storehouse or use online features, content and account information may be stored on our systems.

Your portfolio is private until you choose to publish it. Marketing is optional. You can ask what information we have about you and request deletion where your legal rights allow.

Who looks after your information

NIVA Studio and Storehouse by NIVA are operated by STUART SEMPLE STUDIO LTD, company number 11988049, registered at London Studio, 20 Wenlock Road, London, N1 7GU, United Kingdom. We are the controller when we decide why and how your personal information is used.

This policy covers NIVA Studio, Storehouse, accounts, public portfolios, shared links, payments, support and our websites. Use the contact form for privacy, access, deletion or complaints.

What we collect

Account and sign-in information: email address, account ID, username, login links, authentication events and session records. NIVA uses email-based sign-in rather than asking you to create a NIVA password.

Profile information: the name, biography, profile photo, username, links and portfolio material you choose to provide, along with your privacy and publication settings.

Creative content: files, documents, designs, uploaded images, thumbnails, previews, backups, metadata and sharing permissions needed to deliver online editing and Storehouse features. Your files may contain personal information about you or others.

Purchase and billing records: which plan or product you bought, amount, date, currency, taxes where relevant, invoice and transaction identifiers, billing status, refunds and Day Pass credits. Our payment provider handles payment card details; we do not need to store your full card number.

Sharing and contact information: email addresses you provide for invitations, access requests, messages sent using sharing tools and records needed to deliver or troubleshoot them.

Support and safety information: reports, questions, feedback, correspondence, attachments you choose to send, moderation decisions and appeals.

We use an external AI classification service to help sort support and feedback messages, and to hold back abusive ones before a person has to read them. Only the message you wrote and the type you chose are sent to it. Your name, your email address, your account and your artwork are not. The provider is contractually prohibited from training models on what we send. A person reviews anything that matters, and you can always ask for a human to look again.

Technical information: IP address, device and browser information, logs, errors, security and performance signals, and basic product activity needed to operate and improve the service. Technical information is not necessarily anonymous.

Marketing choices and optional tracking: email marketing preferences, consent records, and optional analytics or advertising identifiers if you agree to those tools.

What we use it for and our lawful reasons

To open an account, sign you in, save and edit your work, provide storage, run sharing features, deliver purchases and manage paid plans. Our main lawful basis is performance of our contract with you.

To answer support requests, improve reliability, prevent abuse and secure NIVA. We rely as appropriate on our legitimate interests in operating a safe, dependable creative service, balanced against your rights, and sometimes on contract or legal obligations.

To issue receipts, maintain financial records, comply with tax and accounting rules, respond to valid legal demands and handle disputes. Our bases include legal obligation and legitimate interests where appropriate.

To email product news or offers when you separately choose to receive them, using consent where required. You can unsubscribe at any time. Essential messages, such as sign-in links, receipts, sharing notifications, security alerts or material terms changes, are not marketing.

To run optional website analytics and advertising measurement tools only where the relevant permission has been given or another legal exemption applies. We do not make marketing or tracking consent a condition of using the free service.

If you decline optional marketing or tracking, you can still use NIVA. Information needed for an account or paid transaction may be required to provide that service.

Your artwork and the AI promise

We do not use your stored, edited, uploaded or publicly shared artwork to train generative AI models. We do not sell it or licence it to advertising or AI-training companies. We instruct the providers acting for us not to use creator content for AI training on our behalf.

We process creative content for the features you ask for, such as saving, opening, previewing, searching within your own files, exporting, backing up, publishing or sharing. We may review reported or public content and use necessary security measures to investigate suspected misuse or comply with the law.

If you choose to put your work on a public portfolio or share a public link, other people may view or copy what you make public. We cannot control how an independent visitor or search engine later uses a copy it obtained.

When content is public

Your profile and portfolio are not public by default. You choose what to publish. Published pages may be visible internationally, indexed by search engines and saved by visitors. Turning publication off stops new authorised public display through NIVA, but search engines and recipients may keep cached or downloaded copies.

Links you share may be accessible to anyone who receives them, depending on your link settings. Do not share a private link with someone you do not trust.

Who receives information

We use specialist services to operate NIVA, including Supabase for accounts and databases, Cloudflare and Cloudflare R2 for delivery and file storage, Stripe and its Sold through Link service for payment, merchant-of-record, tax, refund and order management, Mailchimp for opted-in email marketing (limited to contact details and list tags), and our transactional email provider for sign-in, account notifications and invitations. These suppliers have different legal roles. Stripe/Link may act as an independent controller for its payment and compliance functions and makes its own privacy notice available at checkout and on receipts. Other vendors may act as processors on our instructions. We receive transaction information needed to activate purchases and manage customer accounts, but not full card numbers.

If you give us permission for optional measurement, Google Analytics and Meta may receive website interaction and device information through their analytics and advertising tools. Their own privacy information may also apply.

We may disclose limited information to professional advisers, authorities or relevant parties when lawfully necessary to protect people, enforce rights, respond to legitimate requests or resolve legal claims. We do not sell personal information as a business model.

When you send a share link, invitation or publish a portfolio, the recipients you choose or the public can receive the information you intentionally share.

Where information is processed

NIVA serves people around the world and uses providers that may process information in the UK, Europe, the United States and other places. Where UK or EU transfer rules apply, we use an applicable adequacy arrangement, approved contractual safeguards, or another lawful transfer mechanism as appropriate to the transfer. You can ask us through the contact form for information about the safeguards applying to your data.

We do not promise that every file remains in one country unless a particular service or plan explicitly says that it does.

Cookies and similar technologies

Essential cookies and local storage keep NIVA working, including login sessions, security, remembering your preferences and saving work in your browser. Some storage may be necessary for a feature you request.

Google Analytics and Meta advertising measurement are optional. Where consent is required, we ask before these technologies are used. You can accept or reject optional tracking and change your choice through the cookie settings available on the site. Saying no does not stop you using NIVA.

You can also manage cookies using your browser, but blocking essential storage may stop login or editing features from working properly. The exact providers and settings shown in our cookie controls describe the optional technologies in use.

How long we keep information and account closure

We retain information only for a genuine operational, legal or security purpose. There is no single retention period for everything. We review records and remove or anonymise them when their purpose ends, except where a lawful retention obligation applies.

Deleted Storehouse files stay in the recovery bin for 30 days, then are removed from active storage by a nightly job.

If you close your account, we disable sign-in, end any live session and stop your public profile and share links working. Your files are kept, not deleted, so that you can ask us to reopen the account if you change your mind.

Erasing a closed account is done on request rather than automatically. Ask us and a person will erase your profile, your files and your sign-in credentials from our active systems. We normally do this within one month, as UK data protection law requires, and we will not treat the fact that a request needs a human as a reason to put it off. If something must be kept, for tax, legal claims or fraud prevention, we will tell you what and why.

We would rather say that plainly than claim an automatic deletion we do not yet perform.

Payment and accounting records, security events, support correspondence, moderation records, marketing consent and suppression data all have different retention needs. We keep the minimum necessary for the applicable purpose and legal requirements. You can request current category-specific retention information through the contact form.

Your choices and privacy rights

Depending on the law where you live, you can request a copy of your personal information, correct inaccurate data, ask us to delete it, restrict how we use it, receive portable data, or object to particular uses. You can withdraw consent for marketing and optional tracking whenever you like.

Get in touch through the contact form. We may need to verify that the request really came from you, but we will not ask for unnecessary documents. Under UK data protection law, we normally respond within one month, subject to lawful extensions and exceptions.

You can complain to us first. If you remain unhappy, you may complain to the UK Information Commissioner’s Office at ico.org.uk, or to an applicable privacy authority where you live. Your right to object to processing based on legitimate interests includes the right to object to direct marketing.

Keeping information safe

We use technical and organisational safeguards suited to the risks, including secure service providers and access controls. No internet service can promise perfect security. Please secure your email account, since NIVA sign-in links may arrive there.

Where law requires it, we will notify regulators or affected people about qualifying personal data breaches.

Age and international users

NIVA accounts are for people aged 16 or older, subject to stricter requirements where local law applies. We do not intentionally provide accounts to younger children. If we learn that an account was created contrary to those rules, we may restrict it and take appropriate steps concerning the information.

We make NIVA available internationally. Local privacy, consumer and child-safety protections may give you additional rights. Where legally required, our European representative’s contact information will be made available through this policy or a linked contact notice.

Changes and contact

We may update this policy when our products, suppliers or legal duties change. We will show the date of the latest update and tell you about material changes where appropriate. We will not use a privacy policy update to authorise AI training on your creative work.

For privacy questions, access and deletion requests, complaints, or to ask about international transfers, use the contact form.

STUART SEMPLE STUDIO LTD, company number 11988049. Registered office: London Studio, 20 Wenlock Road, London, N1 7GU, United Kingdom.