Privacy

1. Who is responsible

The Plyvel app is provided by Murtadha Damook, Baghdad, Iraq ("Plyvel"). Privacy questions and requests: hello@plyvel.com.

2. What Plyvel collects, and why

Plyvel does not collect: card numbers (the payment provider holds them), contacts, or anything from other apps on your device.

Photo metadata. Location and camera metadata (EXIF, XMP, IPTC, GPS) is removed from an uploaded image before it is stored. Only the image's orientation is kept, so it shows the right way up. A file stored before this was live keeps its metadata until it is deleted. Images a render makes do not get this step: they come from the render engine, not from your camera.

Education plan documents. A document you upload for the Education plan is kept in Plyvel's private storage, apart from your projects, and only to decide your check. Location and camera metadata is removed from a photo of it as from any upload; a PDF is kept as you sent it. Only Plyvel staff who decide checks can open it, in the admin console, signed in with a second factor, and each opening is recorded. It is never sent to an AI service, and it is never put in logs, Render Receipts or exports. You can withdraw a document before it is decided; it is then deleted at once.

Legal bases. Where the law asks for one (for example the GDPR, for people in the EU or the UK):

• To provide the service you signed up for (a contract): your account, workspaces, images, render requests, Vel's reviews and Render Receipts, credits, notices and the support you ask for; and, if you ask for the Education plan, its check.
• To meet a legal duty: payment and credit records, and answering lawful requests from authorities.
• Plyvel's legitimate interests, which must not outweigh your rights: keeping the service secure and running (sign-in records, technical records), stopping fraud and misuse of free credits (section 11), and measuring whether Plyvel works, under a pseudonym (product events), and counting the public site's page views in totals (section 5).
• Your consent, which you can withdraw at any time: anything beyond these, such as using your content for evaluation or model training (section 4), and the store app's notifications.

Automated decisions. Promotional credits are decided automatically by the rules in section 11. A held claim always goes to a person, and you can ask a person to look again at any decision (section 11, "Your choices"). The Education plan's school email check approves automatically when your address's domain is an educational institution's that Plyvel recognises; it never refuses anyone: otherwise a person looks at a document instead. Nothing else about you is decided automatically.

3. Who processes it for Plyvel

Sign in with Google, if you choose it. Continue with Google is on the sign-in page only once Plyvel turns it on; the email link works without it. If you use it, you sign in at Google, under Google's own terms and privacy policy, so Google learns that you signed in to Plyvel. Google then sends the sign-in service your name, email address, profile picture address and Google account id, which it keeps with your account (section 2). Plyvel asks Google only for that basic profile and email address: nothing from your Google account's contacts, files, mail or calendar, and nothing is sent to Google afterwards. It is not offered in the store app.

AI model providers: none is in use. Renders on the test service are made by stand-ins that send nothing anywhere. Before any AI provider is used, it is listed here with what it receives, where it runs and how long it keeps data. A provider that trains its models on what it is sent is not used.

4. AI and your content

• Plyvel does not use your images, requests or results to train AI models.
• Using your work for evaluation, research or case studies needs your separate, explicit permission, which you can withdraw. You choose on the Account page, under Research and data use: five separate questions, each off until you turn it on, and each can be turned off again (section 2, "Research and data-use choices").
• Results are AI-assisted visualisations. A Render Receipt records Plyvel's visual checks; it is not structural, engineering, building-code, construction or dimensional certification.

5. Your browser and the store app

• The app keeps any render request you have not sent yet in your browser's local storage, on your device only.
• It also keeps a few display choices there: the theme, Focus, and whether single-key shortcuts are on.
• When the free promotional credits are switched on, it keeps a device token there too (plyvel.device). Section 11 says what it is for and what Plyvel stores about it.
• One cookie, to keep you signed in. In a browser, Plyvel's server sets one cookie when you sign in. It holds your sign-in session's refresh token (the key that renews your sign-in), sealed so that only Plyvel's server can use it, so you are still signed in when you come back. It is HttpOnly: scripts on the page cannot read it. Your browser sends it only to the app's own address, over an encrypted connection, never to another site, and only the part of Plyvel's server that renews your sign-in reads it. It is removed when you sign out, or 30 days after you last used the app. It is strictly necessary for the sign-in you ask for, so the app does not ask for consent to it. The page itself holds only a short-lived sign-in token, in memory, gone when you close the page.
• The app sets no other cookie, and uses no analytics or advertising trackers. Cloudflare's check on a free-credits claim runs under Cloudflare's own terms (section 11).
• plyvel.com, the public site, counts page views; the app does not. The site uses Cloudflare Web Analytics, which Cloudflare runs. Cloudflare states that Web Analytics "does not use any client-side state, such as cookies or localStorage", and that it does not fingerprint visitors through their IP address, User Agent string or any other data (Cloudflare's Web Analytics page, https://www.cloudflare.com/web-analytics/, under "Privacy first"). That is Cloudflare's statement about its own service, not a promise of Plyvel's. For each page view, your browser sends Cloudflare the page's address, the address of the page you came from, your browser's name and version, and how quickly the page loaded; Cloudflare also sees your IP address, as it does for every page of the site. Plyvel sees only totals: views of each page, the sites that linked to them, countries, and kinds of device and browser. If your browser sends Global Privacy Control, the site does not load the counter. When you follow the site's link to apply for the beta, the link says it came from the site, and the app counts that arrival once as a product event (section 2), with the kind of device and nothing about you; then the app takes the mark out of the address.
• The store app (iPhone and Android; not in the App Store or Google Play yet) is the same app inside a shell. On the phone it keeps what the browser keeps, except that your sign-in session is kept in the app's own storage on the phone instead of a cookie; also a flag while the "render ready" notice is on, and a file only for the moment you share it (emptied before each share and at start). Android backups of the app are off. It contains no tracking, analytics or advertising library.
• Its push token. If you turn the notice on, Plyvel keeps your phone's push token in its private storage, with the phone's platform and the sign-in session that registered it, at most 10 phones a person. The token is removed when you sign out on that phone, after that sign-in session ends, and when your account deletion is done; an eleventh phone replaces the oldest. Plyvel never sends it back to the app. Sending is off today, and the app's Settings say so.

6. Who can see your work

• Your projects are private to your workspace. People you add to the workspace see its projects, according to their role.
• Plyvel staff look at your work only to answer a request from you, to investigate a fault or abuse, or where the law requires, and each staff action on credits or reports is logged.
• Sharing a receipt. When you share a version 4 receipt, you choose which kinds of words to hide: the request's words, notes, Vel's findings in words, evidence summaries, who accepted it and the acceptance note. The copy says "Hidden by the sender" for each, a hidden value cannot be read back from it, and its signature still checks.
• Moving a project into a team. The owner of a personal workspace can move a project into a team where they are an owner or admin. From then on the team's members see the project, its renders and its receipts, and the workspace it left no longer does. The move is recorded in both workspaces' history, with who moved it and when. Credits already spent stay with the workspace that paid.

7. Deleting

• A file: members can delete a source or reference that no render uses. Its stored file is erased by the next clean-up; its record and fingerprint stay.
• A project: it disappears for everyone in the workspace at once. Its files are erased after a recovery window of 30 days. At the same time, the words kept beside its version 4 receipts are erased; the receipts still check.
• Your account: you can ask for deletion on the Account page. It happens 14 days later unless you cancel. Then your personal projects, your memberships, your profile, your feedback, the text of your reports and any Education plan document still waiting for a decision are removed, and the store app's phones you registered are forgotten. Then the words kept beside the version 4 receipts of the renders you requested (what you asked for, your notes, and Vel's findings and evidence in words) and beside the acceptances you signed (who accepted, as your user id, and your note) are erased, in every workspace. The receipts still check. You cannot delete your account while you are the only owner of a workspace that has other members, and a legal hold on your account pauses the deletion.
• The sign-in account itself (your email address, your sessions and sign-in history). After it, Plyvel can delete it once your account deletion is done and no legal hold applies; the records that belong to it go with it (for example your consents, your sign-in records and the abuse records tied to your account). Staff run this last step by hand from the admin console (it is not on a schedule), within 30 days of your deletion, and it is recorded.
• What stays: Render Receipts and acceptances are signed and are never changed. A version 4 receipt keeps your user id and the salted fingerprints of your words, not the words; without the erased salt a fingerprint cannot be turned back into the words. Receipts of version 3 and earlier keep the request text: only test renders on Plyvel's test service have them, and the live service starts on version 4. The credit ledger keeps its entries, and the audit log keeps who did what, by user id (24 months, and an entry about money 10 years, like the payment records; then deleted by the clean-up, unless a legal hold applies.). After the sign-in account is deleted, these ids no longer lead to your email address.
• Copies of your words outside the receipt. The working copy of a render's request (what the render was asked to do, and Vel's findings in words) is erased from the render's own record by the clean-up once its project's files are erased.
• Backups: the database provider keeps daily backups for 7 days once Plyvel's production service is set up (the test service keeps none); deleted data leaves the backups when they expire. If Plyvel restores a backup, it re-applies every deletion recorded since from its deletion log, kept outside the database. The sign-in account's deletion is in that log too.

8. Your rights

You can see and export your projects (Export project gives you the files, the renders and their receipts), correct names, delete files, projects and your account, and ask Plyvel what it holds about you at hello@plyvel.com.

Iraq has no general data protection law yet, so Plyvel gives everyone, wherever they live, the rights the GDPR gives people in the EU: to see what Plyvel holds about you and get a copy; to correct it; to have it erased; to limit its use; to take it with you in a common format; and to object to what Plyvel does on the basis of its legitimate interests (section 2). Plyvel answers within one month. A complex request can take up to two months more; Plyvel then tells you why within the first month. Some records stay after a request, where the law requires them or a signed receipt depends on them (section 7). If you are in the EU or the UK, you can also complain to the data protection authority where you live or work.

9. Transfers

Your data is stored and processed outside Iraq, in Germany, the EU and on Cloudflare's network. Iraq has no law that limits these transfers. For people in the EU, the UK and Switzerland, the data processing agreements of Cloudflare, Supabase and Resend include the European Commission's standard contractual clauses, with the UK and Swiss additions; Cloudflare and Resend also take part in the EU-U.S. Data Privacy Framework. Plyvel, in Iraq, reaches your data through these providers. The support inbox is a Gmail account under Google's own terms.

10. Security

Connections are encrypted (HTTPS only); images are in private storage and opened through signed links that expire within 15 minutes; each workspace's data is separated by database rules; Render Receipts are signed so changes can be detected. Each version 4 receipt also gets a timestamp from an independent authority (section 3), so anyone can check when it existed, from a party other than Plyvel. No system is free of risk. If a breach affects your data, Plyvel tells you without undue delay, and tells the data protection authority where the law requires it (under the GDPR, within 72 hours of learning of it).

11. Fraud and abuse

Plyvel keeps a few records to stop misuse of free credits and of the service. They are kept apart from your projects, and used only for that.

Free credits and free renders. While paid plans are switched off, every workspace counts as free. So the free-render records below apply to every render and every upload. The free promotional credits are switched off today. While they are off, Plyvel hands out no device token and makes no promotional decision, grant or network link.

Cloudflare Turnstile. When you claim free promotional credits, the page may run Cloudflare Turnstile, a check that the claim comes from a person and not a bot. Most people see nothing; some see one checkbox. Turnstile runs in your browser and Cloudflare sees what it needs for that check (your browser and its signals, under Cloudflare's own privacy terms); Plyvel receives only the result (passed or not) and stores no Turnstile data. It does not run in the store app, and it is not used for advertising or tracking. A claim without it is not refused. If the rules ask for one more check before adding the credits (a step-up), the app shows Cloudflare's check and a "Do the check" button; doing it decides the claim again, and you can contact support instead.

Keyed hashes. Where a record needs your network address or a device token, Plyvel stores a keyed hash instead. A keyed hash is the first 32 hexadecimal characters of HMAC-SHA256, made with a secret key only Plyvel's server holds. The same input gives the same hash, so repeats can be counted. Plyvel treats keyed hashes as personal data, because Plyvel holds the key.

What Plyvel keeps

What these records never hold. Your network address, your device token itself, your email address, your images and the text of your requests are never stored in an abuse record. An upload fingerprint is a hash of the file and a 64-bit summary of the picture, not the file: at most a blurred pattern of light and dark could be drawn back from the summary, never the picture. Nothing finer than browser and system family is kept about your device: no hardware identifier and no device fingerprinting. Plyvel does not look up where a network is, so it keeps no location, precise or not.

Your email address. When you claim promotional credits, Plyvel compares your address, in a normalised form, with other accounts' addresses. It also checks the address's domain against a short list of throwaway mail services, and counts recent claims from the same domain (never for the big public mail services). The address is read from your account at that moment and is not copied into any abuse record.

How they are used.

• Only to protect free credits and the service: the free limits, the promotional decision, alerts, and staff review of suspected abuse.
• No single signal decides anything. Declining the promotional credits needs a link to an account that already received them and a pattern of its own, and declining is switched off today.
• A payment-method link or a chargeback history only holds a promotional claim for a person to look at. It never declines it, and it never touches a paid plan or credits you paid for.
• Networks that many people share (offices, campuses, mobile carriers, hotels) are never a reason to decline on their own.
• A flag on free use never deletes your projects and never removes credits you paid for.
• The app shows your promotional state in neutral words, not the codes behind it. You can ask what these records hold about you (section 8). Plyvel tells you, but may hold back details that would help someone get round the checks, as far as the law allows.
• Staff look at these records in the admin console, signed in with a second factor. Each staff decision is logged with who made it, the reason and the time.
• Never used for advertising or marketing.
• Never used to train or evaluate AI models. The evaluation export reads none of these records.
• Never used to guess anything sensitive about you.

When they are deleted.

• Each record has an expiry date, set when it is written. A network or device link gets a new one each time it is seen again; an appeal gets one when it is resolved. A clean-up every 5 minutes deletes records past their date.
• The three periods (30, 90 and 365 days) are settings Plyvel can change. They apply, and the clean-up runs. Each is no longer than its check needs, and stopping fraud and misuse is the legal basis for keeping them (section 2, Plyvel's legitimate interests).
• The payment-method hash is part of its payment record, not an abuse record: it has no expiry of its own and is kept as long as that record.
• Records tied to an account also go when its sign-in account is erased (section 7).
• During a security incident under review, Plyvel can pause these deletions until a set date. The pause is set by hand and logged.

Your choices. You can appeal a promotional decision through support: a support report in the app, or hello@plyvel.com. A person looks at it, and a granted appeal gives the credits through the normal credit records. You can also object to these records at hello@plyvel.com. Plyvel then stops using them for you, unless it has strong reasons that outweigh yours, such as misuse it has already seen; without them, it cannot offer you free credits.

12. Children

The app is for professional use, and for study and teaching on the Education plan, and not for anyone under 18 (Terms, sections 2 and 17).

13. Changes

When this policy changes, the date below changes and the app shows a notice. A change that lets Plyvel use your data in a new way, or that reduces your rights, is also sent to your email address at least 30 days before it applies.

This site

This site counts page views with Cloudflare Web Analytics; the Plyvel app does not. Cloudflare states that Web Analytics “does not use any client-side state, such as cookies or localStorage” and that it does not fingerprint visitors (Cloudflare’s statement, under “Privacy first”): those are Cloudflare’s words, not my promise. I see totals only: views of each page, the sites that linked to them, countries, and kinds of device and browser, never who you are. Section 5 above says what your browser sends.

This site sets no cookies, and the fonts are served from the same place as the page. A link here to apply for the beta says it came from this site: the Plyvel app counts that arrival once, with the kind of device and nothing about you, then takes the mark out of the address.

Cloudflare, which runs this site, sees your IP address to deliver each page and to limit how often the contact form can be sent, and your browser may send Cloudflare a report if a page fails to load. I do not receive these.

The contact form sends your name, your email address and your message to Plyvel when you press Send, and nothing else. It travels by email through Cloudflare, which runs this site, to Plyvel’s Gmail inbox; nothing is stored on this site.

A hand-run CHECK

For a hand-run CHECK, you share the two images through a link you control. They are processed on the founder’s computer in Iraq. Notes about the job travel by email (Cloudflare forwarding to a Gmail inbox, with no attachments). The AI assistants that run Plyvel’s scripts, Claude and Codex, are instructed never to open your images; that is an instruction, not a technical lock. CHECK sends the images to no AI model provider.