// Legal

Privacy Policy

Effective and last updated: August 27, 2026

Operator and contact details

Legal operator
Aiviko Team
Service name
Aiviko
Privacy and legal email
support@aiviko.app

1. Scope

This Privacy Policy applies to Aiviko websites, localized pages, browser tools, and related support communications that link to it. It explains the operator's processing as a controller or equivalent responsible business under applicable privacy law.

It does not govern third-party websites, browser extensions, operating systems, or services reached through links. Their own notices apply. This policy is intended for a worldwide audience and is supplemented by mandatory local law.

2. Who is responsible

Aiviko Team, identified above, operates Aiviko and is the contact point responsible for this policy. Use the listed email for privacy requests. If Aiviko Team is a brand or informal team rather than the legal name of the responsible individual or registered entity, the operator must replace it with that legal identity wherever applicable law requires before public launch.

Some providers may act as processors or service providers for Aiviko, while others—particularly advertising providers—may act as independent or separate controllers for their own purposes, as described in their notices and contracts.

3. Local processing of tool content

Aiviko's QR generation, OCR, file conversion, speech-to-text, text-to-speech, subtitle generation, and portrait background-removal tools are designed to run in your browser using JavaScript, Web Workers, WebAssembly, and on-device AI models. The operator does not intentionally receive or retain the files, images, audio, video, QR payloads, or text you place in those tools.

Your browser may download software runtimes and model files before local processing begins. Those asset requests expose ordinary network information to the relevant host, but they do not intentionally include your tool input. Results you download remain on your device unless you choose to share them elsewhere.

A selected landing-page image may be copied temporarily into this tab's session storage solely to hand it to the selected tool. It is removed when consumed or invalid and normally disappears when the tab session ends.

4. Information collected through use of the site

Even where content processing is local, loading and using a website creates network and operational data. The categories below may be collected by Aiviko or its providers.

  • Request and security data: IP address, request time, requested URL and response status, referrer where supplied, user-agent, browser or device characteristics, and security or diagnostic events. Approximate location may be inferred from an IP address.
  • Documentation search data: words submitted to Aiviko's same-origin documentation search endpoint, together with ordinary request data. Do not put confidential or personal information into search queries.
  • Support and rights-request data: name or identifier you provide, contact details, message contents, attachments you choose to send, and records needed to answer or document the request.
  • Asset delivery data: when the browser downloads the logo, AI models, WebAssembly, FFmpeg, or other runtimes, Vercel, Cloudflare, jsDelivr, or Hugging Face may receive IP address, headers, requested asset URL, and technical logs.
  • Measurement or advertising data: page and interaction information, consent state, cookie or device identifiers where permitted, approximate geography, and advertising or measurement events, as further described below. Analytics remains consent-based; advertising processing depends on the mode allowed by your Google choices, signals, and applicable law.

5. Data stored in your browser

Aiviko uses the following first-party browser storage for requested functions. You can remove it through browser site-data controls, although doing so may reset preferences or require assets to be downloaded again.

  • "theme" in local storage remembers light or dark appearance until you clear it.
  • "aiviko.consent.v2" in local storage records the optional Analytics choice for up to 180 days, after which Aiviko asks again. The obsolete v1 record is removed when encountered.
  • "aiviko.landingHandoff" in session storage can hold one selected image, currently limited to about 3.5 MB, until the destination tool consumes it, it becomes invalid, or the tab session ends.
  • Cache Storage named "aiviko-runtime-assets-v2" and normal browser HTTP caches can retain tool runtimes and AI model assets until the browser evicts them, the cache version changes, or you clear site data.
  • Google and its partners may use cookies, local storage, or similar technologies only to the extent allowed by the Google-certified consent message, the signals it records, and applicable regional law.

6. Purposes and legal bases

The exact legal basis depends on the law that applies. Where the GDPR, UK GDPR, or a similar framework applies, Aiviko relies on the bases below. Aiviko does not use site data to make decisions that produce legal or similarly significant effects about you.

  • Provide the website and requested tools, respond to your actions, and remember functional choices: performance of a contract or steps at your request, and legitimate interests in delivering the service.
  • Protect, debug, and maintain the service; enforce terms; prevent fraud, attacks, and misuse: legitimate interests in a secure and reliable service and, where relevant, compliance with legal obligations.
  • Answer support, privacy, and legal requests: steps at your request, legitimate interests in communication and recordkeeping, and compliance with legal obligations.
  • Google Analytics measurement: your consent. Analytics remains off until you opt in and you may withdraw consent at any time.
  • Ad delivery, security, and fraud prevention: the operator's legitimate interests where applicable law permits identifier-free limited or contextual advertising without consent. Consent is used where law requires it for device storage or access, measurement, vendor processing, or other advertising operations. Personalized or targeted advertising and non-essential identifiers require the applicable choice or consent. The Google-certified consent platform determines the permitted advertising mode for the visitor and region.
  • Establish, exercise, or defend legal claims and complete a lawful corporate transaction: legitimate interests or legal obligations, subject to safeguards.

7. Google Analytics and Google AdSense

If you allow Analytics, Aiviko loads Google Analytics 4. Google may receive page URLs, interaction events, technical identifiers, IP-derived information, device/browser information, and consent state. Aiviko configures Google Signals and ad-personalization signals off in the site tag, but production account settings must also be verified.

After the operator confirms the production compliance gate, Aiviko loads Google AdSense on ordinary content pages independently of your Analytics choice. Google's certified consent platform determines whether personalized, non-personalized, limited, or contextual ads may be served for your region and choices. Even limited ads use an IP address to transmit the ad and may cache creatives; if the operator enables programmatic limited ads, Google says fraud-only cookies, local storage, or Shared Storage may also be used where legally permitted.

Aiviko's Privacy choices panel controls optional Analytics, not the presence of ad space. Use Manage Google advertising choices to open Google's certified choice flow. Before that platform communicates a valid choice, Aiviko sets Google advertising-consent signals to denied. A recognized Global Privacy Control signal is treated as an opt-out of personalized or targeted advertising, although limited or contextual ads may still appear where lawful.

Aiviko does not load the Analytics or AdSense tags on Privacy, Cookie, Terms, or third-party-notice pages. In regions where Google requires a certified consent platform or additional regional choices, the production service must display and honor that Google-certified message; Aiviko's preference panel does not replace that account-level requirement.

8. Recipients and disclosures

Aiviko does not rent personal information or sell it for money. Information may be disclosed to the categories below only as needed for the stated purposes.

  • Vercel for application hosting, delivery, logs, performance, and security.
  • Cloudflare for the aiviko.app content-delivery network, asset delivery, caching, and security features that the operator enables.
  • Google for consent-based Analytics and for AdSense in the advertising mode permitted by the Google-certified consent platform, applicable signals, and regional law, including associated delivery, security, fraud prevention, and measurement where allowed.
  • Hugging Face and jsDelivr when your browser directly requests certain AI model or runtime assets.
  • Professional advisers, auditors, insurers, and vendors bound by appropriate confidentiality or data-protection duties.
  • Authorities or other parties where reasonably necessary to comply with law, protect rights and safety, investigate abuse, or establish and defend legal claims.
  • A buyer, successor, or transaction adviser in a merger, financing, reorganization, or sale, subject to appropriate safeguards and notice where required.

9. International transfers

Aiviko serves users globally and providers may process information in the United States, the European Economic Area, South Korea, and other countries whose laws may differ from yours.

Where required, the operator will use an available lawful transfer mechanism—such as an adequacy decision, applicable data-privacy framework, standard contractual clauses, or another recognized safeguard—and assess supplementary measures. Contact the operator for information about safeguards relevant to your request.

10. Retention

Aiviko does not retain tool inputs that remain in your browser. Browser-stored data lasts as described above and is under your control.

Operational and security logs are kept only for the period configured with the relevant hosting or delivery provider and as reasonably needed for security, debugging, abuse prevention, and legal obligations. Documentation search terms may appear in those logs. The operator must document and periodically review the production retention settings.

Google Analytics event-level retention will be configured for no more than 14 months; standard aggregated reports may remain available longer under Google's product rules. Google advertising data follows Google's and participating partners' retention settings. Support and rights-request records are generally kept for up to 24 months after closure, longer only where necessary for law or claims.

11. Security

Aiviko uses data minimization, local processing, transport encryption, access controls, dependency review, and hosting or network security appropriate to the service. No Internet transmission, browser environment, or storage system is completely secure, so absolute security cannot be promised.

You are responsible for securing your device, browser, local downloads, and any output you later share. Avoid processing highly sensitive content on a device or network you do not trust.

12. Your privacy rights

Depending on your location, you may have rights to know or access, correct, delete, restrict or object to processing, receive portable data, withdraw consent without affecting earlier lawful processing, and complain to a regulator. You may also have the right not to be discriminated against for exercising a privacy right.

Send a request to the operator email above and describe the right and jurisdiction involved. Aiviko may request proportionate information to verify identity and authority. An authorized agent may submit a request where local law permits. If Aiviko denies a request, you may have a right to appeal by replying to the decision.

Because Aiviko has no user accounts and intentionally does not receive local tool content, it may hold little or no data that can be linked to you. Browser data can be cleared locally. You can withdraw optional consent at any time using the fixed Privacy choices control.

13. United States state privacy disclosures

For laws that require category disclosures, Aiviko may collect the identifiers, Internet/network activity, approximate geolocation, and communications described above. Sources are you, your browser or device, and service providers. Business purposes and recipients are listed in Sections 6 and 8.

Aiviko does not knowingly sell personal information for money. Personalized or targeted AdSense activity may nevertheless be defined as "sale," "sharing," or targeted advertising under some state laws. Use Manage Google advertising choices or send a recognized Global Privacy Control signal to opt out where applicable. An opt-out changes the permitted advertising mode and does not necessarily remove limited or contextual ads. Aiviko will not knowingly use or disclose sensitive personal information for purposes that trigger a right to limit.

Where applicable, residents may request access, correction, deletion, portability, opt out of sale/sharing/targeted advertising, limit certain sensitive-data uses, or appeal a decision. Aiviko will honor rights required for your jurisdiction even if a local threshold or exemption changes.

14. Children

Aiviko is a general-audience service and is not directed to children under 16. Do not use the service if you are below 16 or the higher digital-consent age required where you live unless a parent or guardian has provided valid authorization. Aiviko does not knowingly collect children's personal information or knowingly sell or share it for targeted advertising. Contact the operator if you believe a child provided information so it can be investigated and deleted where appropriate.

15. Changes to this policy

Aiviko may update this policy to reflect service, provider, or legal changes. The date at the top will change, and material changes will receive additional notice or renewed consent where required. Earlier versions should be archived so changes can be reviewed.

16. Contact and complaints

Use the operator contact details above for questions, requests, or complaints. If you are in the EEA or UK, you may complain to the data-protection authority where you live or work, or where you believe an infringement occurred. Other jurisdictions may provide a similar regulator or attorney-general complaint route.

If local law requires an EU, UK, or other representative or a data-protection officer, the operator must appoint and publish that contact before offering the service in the affected circumstances.