Privacy Policy

Who we are

GO AIAV operates GO AIAV and is responsible for your personal data — the "controller" under laws such as the EU's GDPR and Brazil's LGPD, and the business handling your personal information under Japan's APPI. For anything about your data, use this contact channel: Contact us.

What we collect

You can browse public content without giving us your email. What else we process depends on how you use GO AIAV:

• Account: your email address, whether it's verified, which version of the rules you agreed to, a salted hash of your password (never the password itself), security and rate-limit records, your sign-in sessions, and the profile you fill in (name, handle, bio, avatar).
• Shared with Day Work: GO AIAV and Day Work use one account service. Day Work receives your verified account ID, email and display name to match you to its workspace members; each site checks its own sign-in cookie and permissions. Your personal credit balance, orders and credit history are kept by that shared service, and authorized staff can look up the records they need.
• What you make: your prompts, the images, videos and audio you upload, the results, and what you publish, comment on, like, save and follow.
• Direct messages: the messages and works you send and receive.
• Credits and purchases: your balance, how you use credits in GO AIAV and Day Work, and your orders (amount, currency, status). The payment provider handles your payment details; we don't collect card numbers or payment passwords.
• Reports and requests: what you send us through the report form, such as your description, links and contact email.
• Technical data: IP address, request times, browser details, pages visited and error logs, used to serve pages, fix problems and prevent abuse. Where we count visits or limit abuse, we keep a hashed value instead of your IP address.
• Partner links: if you came through a partner's link, which partner it was.
• Approximate region: if you came through a partner's link, we infer an approximate region from your IP address (the country, or the province in China), only to count the visits and sign-ups partner links bring by region. We don't keep the IP address itself, and the counts never show where any one person is.

Why we use it

We use your data for these purposes, each with a legal basis:

• Running GO AIAV: your account, generations, posts, messages and credits — to perform our contract with you.
• Safety and moderation: checking prompts, uploads and messages for prohibited content, handling reports, and stopping fraud and abuse — our legitimate interest in a safe service, and our legal obligations.
• Payments and accounting: processing purchases, preventing payment fraud and keeping the records the law requires — contract and legal obligation.
• Emails: verification codes and important messages about your account or our policies — contract. We only send you marketing emails if you've agreed to them.
• Partner attribution: counting which partner links bring visitors and sign-ups — our legitimate interest.
• Legal reasons: complying with the law, answering lawful requests from authorities, and establishing or defending legal claims.

Automated filters check prompts, uploads and messages and may block a generation or a message that breaks the rules. If a decision like that affects you, you can ask for a person to review it. We don't sell your personal data, and we don't share it for targeted advertising.

Prompts, uploads and posts

To create a result, we send your prompt and the files you use to the AI model providers that run the generation for us. Private account data and stored files are protected by access controls; what you publish can be seen by anyone who visits GO AIAV.

Please don't upload photos of other people without their consent, or anyone's sensitive information or personal details they haven't agreed to share.

Direct messages

Your messages can be read by you and the person you're talking to. They aren't end-to-end encrypted: automated checks screen them for prohibited content, such as sexual content involving minors. If someone in a conversation reports it, a copy goes to our moderators, and a message you withdraw stays available to them for up to 7 days for that purpose only.

Who we share it with

We share data only as far as each recipient needs it:

• Hosting: Google Cloud (servers and file storage) and Cloudflare (domain and network services).
• Fonts: web fonts may load from Google Fonts, which receives the network details it needs, such as your IP address.
• Email: Resend sends our verification codes and processes your email address and delivery records.
• AI model providers: they receive prompts and files to generate results.
• Payment provider: Waffo processes purchases and payment details under its own privacy policy. For now it runs only as a sandbox test, with no real charges. For each order we give it the order number, product description, amount, currency and return address, and we keep the payment result. Test orders pass through Day Work's confirmation page; a payment link only covers that one order and never signs you in to anyone's Day Work account.
• Day Work: it uses the same account service and credit balance, and receives your verified account ID, email and display name (see above).
• Other people on GO AIAV: your public profile, posts and comments, and the messages you send them.
• Authorities: when the law requires it or to protect someone's safety, including reports of child sexual abuse material.
• A new owner: if GO AIAV is sold or merged, your data passes to the new owner, who must keep to this policy.

International transfers

Our providers may process data in countries other than yours, including the United States, so it may be handled somewhere other than where you are. Where the law requires it — for example under the GDPR, the LGPD or the APPI — we use recognized safeguards such as the European Commission's standard contractual clauses. You can ask us for a copy of those safeguards, and for information about the countries involved and their data protection rules.

Cookies and local storage

We use these cookies:

• Sign-in: keeps you signed in (up to 30 days).
• Language: remembers the language you chose (1 year).
• Age confirmation: remembers that you confirmed you're 18 or older, so we don't ask again (1 year).
• Partner link: remembers which partner link brought you here (30 days).

Your browser's local storage keeps things like your likes, saves, follows and display settings. We don't use advertising or analytics cookies. You can clear all of this in your browser; you may be signed out or lose what's stored locally.

How long we keep it

We keep data only as long as we need it to provide the service, keep it safe and meet our legal obligations. In practice:

• Account and profile data: until your account is deleted.
• Creations, posts, comments and messages: until they or your account are deleted.
• Verification codes expire after 10 minutes; we only store a fingerprint (hash) of each code, never the code itself. Passwords are stored only as a salted hash. Sign-in sessions last up to 30 days, and resetting your password ends the old ones.
• Purchase records: as long as tax and accounting laws require.
• Reports and moderation records: as long as we need them to handle the case and any related claims, or longer where the law requires, for example to preserve evidence of a crime.

Security

We protect data with access controls, encrypted connections, and by storing only hashes of passwords, verification codes and sessions. No service is perfectly secure; if you notice a problem, tell us through this contact channel: Contact us. If a breach puts your rights at risk, we inform you and the authorities as the law requires.

Your rights

Depending on where you live, you can ask us what data we hold about you and for a copy of it, and to correct it, delete it, transfer it to another service, restrict or object to how we use it, or withdraw consent you've given. Using these rights won't count against you.

• EU and EEA (GDPR): you can also object to processing based on our legitimate interests, and complain to a data protection authority — for example the one where you live.
• Brazil (LGPD): you can also ask us to confirm whether we process your data, to anonymize, block or delete data that's unnecessary, and who we share it with; and you can complain to the ANPD.
• Japan (APPI): you can ask for disclosure of the personal data we hold and of the records of providing it to third parties, and for correction, suspension of use, deletion, or an end to third-party provision.
• United States: depending on your state (California, for example), you can ask to know, correct and delete your data. We don't sell personal data or share it for targeted advertising, so there's nothing to opt out of.

To make a request, use Report a problem (choose the privacy option) or this contact channel: Contact us. We may ask you to confirm it's you, usually through your account email, and we answer within the time the law sets — for example one month under the GDPR. We keep what you send us — your description, links to works and contact email — to verify and handle the request. Please don't put privacy requests in public posts or prompts.

You can also stop using the service, clear local storage and cookies, and use your browser's privacy settings at any time.

Adults only

GO AIAV is only for people 18 and over. We don't knowingly collect data from minors. If we learn that an account belongs to a minor, we close it and delete its data, unless the law requires us to keep it.

Changes to this policy

When we update this policy, we change the date at the bottom of the page. If a change affects you, we tell you on the site (and by email where appropriate) before it takes effect.