Privacy Policy

1. Who we are

Geneverything ("Geneverything," "we," "us") is a generative-media platform operated by Bite Design & Technology Inc. (corporation number 1822394-7), a corporation incorporated under the Canada Business Corporations Act. Bite Design & Technology Inc. is the organization accountable for the personal information described here: the data controller for the purposes of the EU and UK GDPR, and the organization responsible under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Contact for privacy matters: privacy@geneverything.com. We have not yet appointed a representative in the EU or UK under GDPR Art. 27; until we do, people in the EU/EEA and the UK should use that address, which reaches the same people.

2. What we collect

• Account data — email, name, avatar/profile image, and how you sign in (Google, an email and password, or a one-time email link). Where you set a password we keep only a scrypt hash of it, never the password itself.
• Generation data — prompts, uploaded Inputs (photos, voice samples, reference tracks, lyrics, sketches, masks), selected model, generation parameters, and the resulting Outputs.
• Billing data — credit balance and ledger, purchase history, Stripe customer identifier.
• Support & legal — correspondence, DMCA notices, abuse reports, data-rights requests.
• Automatically collected — operational telemetry (error reports, latency, request metadata), security/abuse logs (IP address, timestamps, coarse device/browser info), and strictly-necessary session/auth cookies.

2.1 Face photos and voice samples

A photo of a face and a recording of a voice can be biometric data under the GDPR and under laws written specifically about biometrics, including Illinois' Biometric Information Privacy Act (BIPA), Texas' Capture or Use of Biometric Identifier Act, and Washington's HB 1493. The Service accepts both — you upload a face to put yourself in an image, and a voice sample to clone a voice — so this section says what we do with them, because those laws require us to say it in writing and to make the writing public.

• We collect a face photo or a voice sample only to perform the generation you asked for, and only when you supply it.
• We do not use either one to identify, recognize, verify or authenticate anyone, and we do not build a face template or a voiceprint for that purpose.
• We do not sell, lease, trade or otherwise profit from a face photo or a voice sample.
• We do not disclose either one except to the model providers that run the generations and other features you use (and any fallback provider listed in Section 4 if one of them cannot take a job), to the automated moderation and classification services listed in Section 4, to the infrastructure that stores and delivers it, or where the law compels us.
• Before we clone a voice, we require you to attest that the person speaking consented to it. A clone request without that attestation is refused.

Our retention and destruction schedule for this data, which BIPA section 15(a) requires us to publish: we permanently destroy a face photo or a voice sample when the purpose you gave it for has been satisfied — when you delete it, or when you close your account — or within three (3) years of your last interaction with us, whichever comes first. This is the one point where this schedule is stricter than the general retention rule in Section 6, and where they differ, this one governs for face photos and voice samples.

Analytics status. There is no active browser-side behavioral analytics wired in. If/when analytics goes live, a compliant cookie-consent mechanism (opt-in for EU/UK) will gate it and this section will be updated. We do not knowingly collect personal data from children under 18 (see Section 10).

3. How we use your data (and lawful bases under GDPR)

• Provide the Service (authenticate, run generations, route Inputs to the model provider you select, store Outputs) — lawful basis: Contract (Art. 6(1)(b)).
• Billing (charge credits, process payments, maintain the ledger) — Contract; legal obligation for tax/accounting.
• Security, abuse prevention, and enforcement — legitimate interests (Art. 6(1)(f)); legal obligation where applicable.
• Safety / Trust & Safety (screen for and act on prohibited content, report as legally required) — legal obligation; legitimate interests.
• Service improvement using aggregated, de-identified operational data — legitimate interests.
• Communications (service/transactional messages; marketing only with consent where required) — legitimate interests / consent.

We do not use your Inputs or Outputs to train, fine-tune, or develop AI foundation models. There is no opt-in and no setting that changes this. The one exception is a Muse: when you train one, the photos or clips you choose are sent to a model provider to train a private model that only your account can use. When you select a third-party model, your Inputs are transmitted to that provider and the provider's terms govern any retention or training on their side.

4. How we share your data (sub-processors and recipients)

We do not sell your personal data for money. We share it with service providers who process it on our behalf under contract, and with authorities where legally required. The list below is checked against a register kept beside the code that makes the requests, and a test fails if the two name different providers.

Infrastructure. These receive data on every request, whatever you generate:

• Vercel — application hosting and request routing (IP address, request metadata, server logs); US.
• Supabase — managed PostgreSQL database, and magic-link sign-in where enabled (your account record, prompts and generation history, credit and billing identifiers, legal acceptance records); US.
• Cloudflare R2 — object storage for uploaded Inputs and generated Outputs; global edge network.
• Upstash (QStash) — delivering scheduled and deferred jobs back to the application (job identifiers only; no prompt text and no Output content); US.
• Stripe — payment processing and subscription billing (email, billing identifiers, payment metadata; we never receive or store full card numbers); US.
• Google (Sign-in) — authentication when you sign in with Google (email, name and profile picture, Google account identifier); US.
• Google (YouTube Data API) — publishing a finished video to a channel, and only after you connect one (the video, its title and description, your channel identifier); US.

Model providers. Geneverything is a routing layer: your prompt, and any image, audio or video you attach to it, goes to the provider that runs the model chosen for that generation. If that provider cannot take the job, the job may be passed to a fallback provider listed below, which then receives the same prompt and attachments. Some features also send what you give them, or what they make for you, to a provider listed below for a task that supports the one you asked for, such as sorting a new element into a category, reading the text or style in an image, describing or transcribing a video, or checking a generated cover or still. Images you upload, import or attach, other images a generation takes as input, frames sampled from video clips you upload or attach, and the description you give a saved element may also be sent to OpenAI's automated moderation service, listed below, to be checked for prohibited content. None of them receives your payment details. Some features send parts of your account and history to one of them so that it can do the work you ask for: when you use the Gen AI tab, what it reads from your account to plan for you, which can include your plan and credit balance, your recent generations and what is saved in your library, is sent to its model at OpenAI or OpenRouter, and Auto-Video's planners can send the titles and measured performance of a channel's published videos to their model at OpenAI or OpenRouter.

• fal.ai — model inference, and training the private Muse models you ask for; US.
• Replicate — model inference, including speech to text for transcription, captions, dubbing and video analysis, which means audio or video you upload to be transcribed leaves the platform; US.
• OpenAI — image generation, text, vision and speech models (including checking generated stills and sorting an uploaded reference image into a category), and automated content moderation; US.
• Google (Gemini API) — image, video and text models, and prompt assistance; US.
• Google (Imagen) — image generation; US.
• ElevenLabs — text to speech, and speech to text for transcription and captions, which means audio you upload to be transcribed leaves the platform; US.
• Anthropic — writing the plan and script of a launch film, from the brief you give it and the screenshots and stills of your site; US.
• Black Forest Labs (FLUX) — image generation and editing; Germany (EU).
• Runway — video generation; US.
• OpenRouter — routing text and vision model requests, such as prompt assistance, lyric and scene planning, the Gen AI tab's answers, reading the text or style in an image, describing frames sampled from a video you add for analysis, checking generated covers and stills, and sorting an uploaded reference image into a category; US. OpenRouter is itself a router, so it passes each request, and any image attached to it, on to a company that serves the model chosen for that feature: the company that made the model, or another company that hosts it. The models our features can ask it for today include ones made by OpenAI, Google, Anthropic and Meta.
• NVIDIA — model inference; US.
• Lightricks (LTX) — video generation; Israel.
• Kling AI (Kuaishou) — video generation; Singapore.
• MiniMax — video, speech and music generation; Singapore.
• BytePlus Ark (ByteDance) — image and video generation (Seedream, Seedance); Singapore.
• Alibaba Cloud (DashScope) — image and video generation; Singapore.
• Suno — music generation; US.
• Udio — music generation; US.
• Recraft — image and vector generation, and vectorizing and upscaling images; US and EU.
• Midjourney, through a third-party API proxy — image generation, on deployments where the operator has configured one; the proxy sees your prompt, and its location depends on which proxy the operator chose.

We may disclose data to law enforcement or authorities where required by law or to protect safety (including Cybertip.ca for apparent CSAM under the Mandatory Reporting Act, and NCMEC where United States law is also engaged); to professional advisors; and to an acquirer in a merger, acquisition, or asset sale, subject to this policy.

5. International data transfers

We are based in Canada, and we process data in Canada, in the United States, and in our sub-processors' locations. If you are in the EU/EEA or the UK, sending your data to us does not itself need Standard Contractual Clauses: the European Commission has recognized Canada as providing adequate protection for commercial organizations subject to PIPEDA, and the UK recognizes the same. The safeguards below are about what happens after that, when data moves on from us. Some of those locations are outside Canada, the US and the EEA alike, and which ones you reach depends on the models you choose: Kling AI, MiniMax, BytePlus Ark and Alibaba Cloud process in Singapore, and Lightricks processes in Israel. Where an operator has configured the Midjourney proxy, your prompt also reaches whichever jurisdiction that proxy operates from. When personal data originating in the EU/EEA or the UK moves onward from us to a country without an adequacy decision, we rely on Standard Contractual Clauses (2021) and, for UK data, the UK International Data Transfer Addendum, together with supplementary measures where a transfer-impact assessment identifies a need. Under PIPEDA we remain accountable for your personal information while a sub-processor holds it, and we require comparable protection by contract. You may request information about these safeguards at privacy@geneverything.com.

6. Retention

• Account data — for the life of your account; deleted or anonymized after closure, subject to legal-hold and record-keeping needs.
• Outputs and uploaded Inputs — stored in your workspace until you delete them or close your account (then removed within a commercially reasonable period, subject to backups).
• Security/abuse logs — currently targeted at 90 days.
• Billing records — as required by tax and accounting law (typically several years).
• Legal-acceptance records — retained for the life of the account plus the applicable statute-of-limitations tail, on the GDPR Art. 17(3)(e) "establishment/defense of legal claims" basis; not deleted on account closure.
• CSAM-related evidence and legal-hold data — preserved as required by law.

7. Your rights and how to exercise them

Depending on where you live, you may have rights to access a copy of your data; correct inaccurate data; delete your data; port your data in a machine-readable format; restrict or object to certain processing; and opt out of "sale"/"sharing" and certain analytics. Geneverything provides a self-service data-export tool and honors deletion requests. To exercise rights, use the in-product export tool or email privacy@geneverything.com. PIPEDA: substantive response within 30 days, extendable in the limited circumstances the Act allows, and you may complain to the Office of the Privacy Commissioner of Canada. GDPR/UK GDPR: substantive response within 30 days (extendable +60). CCPA/CPRA: acknowledge within 10 business days, substantive response within 45 days (extendable +45). You may also lodge a complaint with your data-protection authority.

7.1 California (CCPA/CPRA)

Categories collected (last 12 months): identifiers (email, account ID), commercial information (credit/purchase history), internet activity (usage/telemetry), user content (prompts, uploads, Outputs), and — where you upload them — audio/visual and potentially sensitive data (face/voice). We do not sell personal information for money and run no cross-context behavioral advertising. You may limit our use of sensitive personal information to what is necessary to provide the Service. We will not discriminate against you for exercising your rights. Authorized agents may submit requests with proof of authorization.

7.2 EU/UK (GDPR)

Lawful bases are listed in Section 3. Where we rely on legitimate interests, you may object. Where we rely on consent (e.g., marketing, analytics), you may withdraw it at any time. You have the right not to be subject to solely automated decisions with legal or similarly significant effects; Geneverything does not make such decisions about you (content-safety enforcement includes human review for account-terminal actions).

8. Security

We protect personal data with encryption in transit (TLS) and at rest, access controls, secret management with rotation, and route-level authentication. No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach affecting your data, we will notify you and the relevant authorities as required by law. Under PIPEDA that means reporting to the Office of the Privacy Commissioner of Canada, and notifying you, as soon as feasible after we conclude the breach creates a real risk of significant harm; we also keep a record of every breach, whether or not it meets that threshold, for the two years PIPEDA requires. Under the GDPR and UK GDPR it means notifying the supervisory authority within 72 hours. US state breach-notification laws apply on their own terms where your data falls under them.

9. Children's privacy

The Service is not directed to children, and an account is available only to people aged eighteen or over. We do not knowingly collect personal data from anyone under eighteen. If we learn that we have, we will close the account and delete the data. A parent or guardian who believes their child has created an account can write to privacy@geneverything.com, and we will act on it.

10. Cookies

We use strictly necessary cookies for authentication and session management. Preference data (e.g., theme) may be stored in local storage. If and when non-essential analytics or advertising cookies are introduced, we will present a consent banner (opt-in for EU/UK) and publish a cookies notice.

11. Changes to this policy & Contact

We may update this policy. For material changes, we will provide notice (email, in-product, or via the acceptance flow) and, where required, seek renewed consent. The "Last Updated" date reflects the current version; prior versions are available on request. Contact: privacy@geneverything.com (privacy/data rights), security@geneverything.com (security). Business mailing address pending confirmation. No EU or UK representative has been appointed under GDPR Art. 27 yet; until one is, privacy@geneverything.com is the address to use.