Noryva
01
Scope and responsibility
This Privacy Policy explains how Appcpi, which operates the Service under the Noryva name (“Noryva”, “we”, “us” or “our”), handles personal data when you visit noryva.ai, use the Noryva account console, contact us or access the model APIs and related services described in our Terms of Service (together, the “Service”). It does not govern a third-party site or service merely because we link to it.
Appcpi is responsible for the account, billing, security, website and related processing described here. If a signed agreement expressly appoints Noryva as a processor or service provider on a customer's behalf, that agreement governs the covered processing.
02
Data we collect
Depending on how you use the Service, we may collect:
- Account and identity data, such as username, display name, email address, authentication-provider identifiers, account status, preferences and information used to verify or secure an account;
- Billing and transaction data, such as the amount, payment method, payment provider, order or transaction reference, status, timestamps, Credits, tax information and records of adjustments, refunds or disputes;
- API and usage data, such as key or token name and identifier, selected model, token counts, quota and charge, timestamps, duration, streaming status, request identifiers, route information, errors and account activity;
- Inputs and Outputs, including text, code, images, audio, video, files, prompts, instructions and generated results processed through the Service;
- Device and network data received when you connect, such as IP address, browser or user-agent information, request method and path, response status, language and security events. The fields kept in a log depend on the service and purpose; and
- Communications, including support messages, attachments, feedback and the information you provide when asking us to investigate an account, billing or technical issue.
We also receive information from services you choose to use with Noryva, including identity providers, payment processors, model providers and integrations. The exact information depends on that service and your settings.
03
How we use data
We use personal data as reasonably necessary to:
- create and administer accounts, authenticate users and provide the Service;
- route model requests, return Outputs and operate requested features;
- measure usage, apply Credits, process payments and maintain financial records;
- monitor reliability, troubleshoot failures, support users and improve service performance;
- prevent fraud, abuse, credential compromise, prohibited activity and threats to the Service or others;
- enforce our agreements, protect legal claims and comply with law, lawful process and provider requirements; and
- communicate about accounts, transactions, security and material service changes.
Where a law requires a legal basis, we process account registration, authentication, model routing, Outputs, metering, Credits and billing as needed to enter into or perform our contract with you. We process security, fraud and abuse prevention, reliability, troubleshooting, support and legal claims for our legitimate interests in operating a dependable service and protecting Noryva, users and providers, after considering the interests affected. We process financial and other records, and respond to lawful authorities, where necessary to meet a legal obligation. We rely on consent only for an optional activity where consent is requested and may be withdrawn.
If information required for these purposes is not provided, some accounts, payments or features may be unavailable. We may aggregate or de-identify non-content operational and usage metadata for service planning, reliability, security and business analysis. We do not use complete Inputs or Outputs for unrelated analytics unless you separately agree or a written agreement permits it. We maintain measures intended to prevent de-identified information from being associated with an identifiable person and do not attempt to re-identify it except to test those measures or as permitted by law.
04
Model requests
To fulfil a model request, Noryva transmits the Input and necessary technical data to one or more model developers, hosting providers or route providers that process the selected model. Automatic routing, retries or failover may determine the qualified route used for the model and version you requested.
Provider practices differ. A provider may retain or use Inputs and Outputs for abuse prevention, legal compliance, service operation, evaluation or model improvement under its own terms and privacy materials. Available routes, regions and data controls may also change. Before sending personal, confidential or regulated data, review provider and route information made available in the account console or request the current information from support. A more restrictive provider data option applies only where the Service expressly identifies it as active for the relevant request or account.
Noryva's ordinary gateway and billing logs are designed to record operational and usage metadata rather than full prompt and completion content. Inputs and Outputs are nevertheless processed in transit and may be retained when reasonably needed for a feature you use, an asynchronous job or stored file, content-safety or abuse review, support you request, security, a billing dispute or legal compliance. Provider-side handling remains governed by the applicable provider's practices.
06
International processing
Noryva operates services and works with providers across several regions. Account systems, model routes, payment methods, identity providers and support services may process data in locations outside the place where you live. The privacy laws in those locations may differ from the laws that apply to you.
An international transfer will be made only as permitted by applicable law. Where a transfer mechanism is required, the mechanism depends on the origin, destination and recipient and may include an adequacy decision, contractual protections or another lawful basis. The route required to provide a model you select may involve the provider locations associated with that route. Contact support to request available information about safeguards relevant to your processing.
07
Retention and security
We retain personal data for as long as reasonably necessary for the purposes in this Policy. The period depends on the type of data, the feature and account status, our security and dispute needs, contractual requirements, provider dependencies and applicable financial, tax or other legal obligations. For example, account data is generally kept while an account is active; transaction and usage records may be kept after closure where needed for accounting, fraud prevention, audits or legal claims. Backups and records subject to a legal hold may remain for a limited period after deletion from active systems.
Provider retention is separate and varies by provider and route. Deleting data from Noryva does not necessarily delete a copy lawfully retained by a model provider, payment provider or other independent third party. Where required, we instruct processors to delete data covered by an approved request. An independent controller may retain data only under its own lawful basis and applicable law.
We use administrative, technical and organisational measures intended to protect personal data. For account and API gateways, limited access logs are configured to omit query strings, cookies, authorisation headers and request bodies. No system or transmission is completely secure, and we cannot guarantee that unauthorised access, loss or misuse will never occur. You are responsible for keeping account credentials and API keys confidential and revoking exposed keys promptly.
08
Your rights and choices
Depending on where you live and subject to applicable exceptions, you may have the right to request access to, correction of or deletion of personal data; receive a portable copy; object to or restrict certain processing; withdraw consent; appeal a decision; or complain to a competent data protection authority. We will not unlawfully discriminate against you for exercising an applicable privacy right.
Submit a request through Contact or email service@appcpi.com. Describe the account and request without sending a password, API key, full payment-card number or complete prompt and output content. We may verify your identity, authority and jurisdiction, and may retain information or decline part of a request where permitted or required for security, fraud prevention, another person's rights, transactions, legal claims or compliance. We will respond within the period required by applicable law.
Closing an account or deleting personal data does not create a refund right, erase amounts owed or prevent the retention of records that we or an independent provider may lawfully keep. The Refund Policy continues to govern any request concerning Credits or payments.
10
Children
The Service is not directed to anyone under 18, and we do not knowingly collect personal data from a person under 18 through the Service. If you believe a minor has provided personal data, contact us so we can review and take appropriate action.
11
Changes and contact
We may update this Policy as the Service, providers or law change. The “Last updated” date shows the current version. Where required by law, we will provide notice before a material change takes effect. We may also provide notice through the Service or the email address associated with your account where reasonably practicable.
Questions, privacy requests and complaints may be sent to service@appcpi.com. Appcpi is the responsible Noryva entity.