Privacy Policy

1. Scope and who we are

Orvyno LLC, a Wyoming limited liability company, operates the MixVio AI product (“MixVio,” “we,” “us,” or “our”), including its website, creative workspace, and related services (the “Service”). This policy applies to personal information processed through the Service unless a separate workspace agreement says otherwise.

Product, privacy, security, abuse, and legal questions can be sent to support@mixvio.ai or mailed to Orvyno LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States.

2. Information we process

• Account and authentication information: name, email address, profile image, verification status, sign-in provider, session information, IP address, user agent, locale, and security credentials or tokens managed for authentication. Profile images may be served through a short-lived public URL so the Service can show your avatar; they are not listed in a public directory.
• Workspace information: workspace name, membership, role, preferences, and audit events. If team workspaces are later enabled for your account, this can also include invitations, comments, and review status shared with other members.
• Customer Content: prompts, generation settings, uploaded reference images or other media, filenames, generated results, project data, and information you include in feedback or support requests.
• Generation and asset records: selected model, capability, task state, Provider job identifiers, errors, timestamps, output metadata, download activity, and private storage records.
• Billing and credit information: plan, credit balance and ledger entries, order and subscription status, payment-provider customer and invoice identifiers, billing address, tax status, refunds, disputes, and related support records. Payment card details are collected through hosted checkout; MixVio does not store full card numbers.
• Technical, analytics, and security information: page path, device and browser details, approximate location, product events, pseudonymous analytics identifiers, rate-limit signals, logs, and error diagnostics.

We receive information directly from you, from authentication and payment providers, from your device and browser, and from AI Providers that return task status and results. If a team workspace is enabled for your account, we may also receive information from other members of that workspace. Some information is required to create an account, secure the Service, complete a generation, or process a purchase. If you do not provide it, the relevant feature may not work.

3. Why we process information

• Provide the Service: authenticate users, operate workspaces, process generations, store private assets, maintain history, deliver downloads, and provide support.
• Billing and credits: quote and reserve credits, process purchases, reconcile payments, issue refunds, maintain the ledger, and meet accounting, tax, and dispute obligations.
• Safety and reliability: moderate requests, prevent abuse and fraud, enforce limits, debug failures, secure accounts, and recover interrupted tasks.
• Product improvement: understand aggregate feature usage and performance through analytics.
• Communications: send account, billing, security, and support messages. We may also send product emails such as welcome, unused-credit reminders, first-result, and low-balance notices. You can turn those product emails off through the unsubscribe link in the message. Account, billing, and security messages stay on.

Depending on applicable law, we rely on performance of our contract with you, our legitimate interests in securing and improving the Service, consent where we ask for it, and legal obligations such as payment and accounting requirements. You may withdraw consent where applicable without affecting earlier processing.

4. AI generation and Customer Content

To complete a request, we send the selected AI Provider the prompt, settings, and minimum media required for that generation. We do not send your account email or full MixVio account profile as part of the generation payload. A selected model may be delivered through an API Provider and the model’s operator, so more than one service provider may participate in the request.

For Free Plan image outputs, MixVio also sends the generated image to Cloudflare Images so a visible MixVio watermark can be applied before the file is stored. The unwatermarked Provider file is not kept in MixVio storage.

MixVio does not use Customer Content to train a model owned by MixVio. MixVio pages do not currently label routes as “no-training.” Third-party Provider retention and training practices may differ by route and contract. Do not submit confidential or sensitive personal information unless the selected workflow and Provider terms are appropriate for it.

Uploaded media may contain faces or voices. MixVio uses that media to perform the creative request and does not use it to identify a person or create a biometric identity template. Providers and safety classifiers may still analyze faces or voices to complete or moderate a request. You must have permission to use another person’s face, voice, or other personal information. Requests may be checked or rejected for safety and abuse prevention. To perform those checks, we may send prompts and short-lived access to uploaded or generated media to content-moderation providers, currently including OpenAI and WaveSpeed when those checks are enabled.

5. Service providers and other disclosures

We share limited information with service providers that help us operate the Service, including the following categories:

• Authentication and account providers that support sign-in, account security, and session management.
• Payment and billing providers that process hosted checkout, subscriptions, tax, refunds, and payment-fraud controls.
• Cloud infrastructure providers that provide hosting, databases, private storage, network delivery, and operational security.
• AI processing providers that operate the API or model selected for image, video, or audio generation.
• Content-moderation providers that classify prompts and media for safety, currently including OpenAI and WaveSpeed when those checks are enabled.
• Image-processing providers that apply the Free Plan watermark, currently Cloudflare Images.
• Email, analytics, and security providers that deliver service and product messages, measure product usage, monitor errors, and prevent abuse.
• Referral and affiliate partners that receive a referring-partner cookie, checkout attribution, and a signup or conversion signal—which may include your account email—only when a referral program is enabled and you allow Partner attribution. The current public integrations are Affonso or PromoteKit when that program is turned on.

We may also disclose limited information when required by law, to protect users or the Service, to investigate abuse, or as part of a corporate transaction subject to appropriate confidentiality and notice. We do not sell personal information, and we do not use Customer Content for targeted advertising.

6. Workspaces and data requests

The current public Service gives each account a personal workspace. Team workspaces, member invitations, comments, and shared review are not generally available. If those features are later enabled for your account, active members will see shared content according to their role.

The workspace owner may request a structured JSON export of selected workspace records, or a deletion review. The export excludes media files, Provider payloads, secrets, signed URLs, internal cost strategy, and some billing, security, and operational records. If team workspaces are enabled, an export can include information contributed by other members and must be handled as confidential workspace data.

7. Cookies and analytics

Necessary cookies, session storage, and local storage support sign-in, account security, fraud prevention, temporary drafts, feature state, and your privacy preference. They operate without an optional-cookie choice because the requested Service cannot work reliably without them.

The Google Analytics browser library is not downloaded until you allow Analytics & ad measurement. Before that choice, after you reject it, or when a recognized Global Privacy Control signal is on, MixVio does not load gtag.js. A tiny on-page consent stub stays in the document so a later Allow choice can start measurement.

If you enable Analytics & ad measurement, Google Analytics, MixVio product events, and sampled web-performance metrics may process page paths, device and browser information, approximate location, usage events, and a pseudonymous identifier. Google analytics, advertising measurement storage, and ad-user-data consent are then enabled for measurement; ad personalization, Google Signals, and personalized advertising remain disabled. MixVio does not send email addresses or other user-provided personal information for enhanced conversions. Google Analytics cookies expire no later than 90 days after they are first set and are not refreshed to extend that period.

After a confirmed payment or full refund, MixVio may send Google a server-side purchase or refund event containing the order number, product, currency, and amount. When Analytics & ad measurement was enabled at checkout, the initial purchase may also use the pseudonymous Google client and session identifiers captured for that checkout. Those browser identifiers are not copied into ongoing subscription or invoice metadata; renewals and refunds use limited cookieless measurement without them.

Referral-attribution storage is also optional. If a referral program is enabled and you allow Partner attribution, its cookie remembers the referring partner for up to 365 days and may send that partner a signup or conversion signal, including your account email. We do not use analytics or referral choices for targeted advertising.

You can reject optional storage without losing core Service access and can change or withdraw your choice through “Privacy choices” in the site footer, unless a recognized Global Privacy Control signal keeps optional storage off. These Privacy choices do not change account, billing, security, or product emails. Withdrawing analytics permission stops new browser analytics on later page views and removes MixVio-readable Google Analytics identifiers. The Google Analytics library is not loaded again unless you re-enable Analytics & ad measurement. Withdrawing attribution permission removes supported referral cookies. Your privacy preference remains in local storage until you change it, clear browser storage, or MixVio replaces the preference version.

If your browser sends a recognized Global Privacy Control signal, MixVio keeps optional analytics and referral attribution off on that browser. You can still open Privacy choices, but you cannot turn those options on. MixVio does not sell or share personal information for targeted advertising, so the current Service has no advertising preference to turn off.

We do not intentionally send prompts, reference media, generated results, email addresses, private asset identifiers, Provider payloads, or signed asset URLs to product analytics or error monitoring. Error details are filtered before optional external error reporting.

8. Storage and retention

Uploads and generated results are stored in private object storage. Provider output URLs are treated as temporary and successful results are archived before the Service presents them as completed. Private assets are delivered through short-lived authorized URLs.

• Account and workspace records: kept while the account or workspace remains active and while needed to provide history. After we approve a deletion request, we delete or de-identify personal information that can be removed from active systems within 30 days. Some billing, security, and legal records cannot be removed immediately. Encrypted backup copies may remain for up to 90 days after active-system deletion before they are overwritten through normal rotation.
• Paid generated media: results settled with subscription or purchased credit-pack lots stay accessible after subscription cancellation while the account remains active, subject to plan storage limits, user-initiated workspace deletion review, and legal or safety requirements. Exceeding a storage limit after a downgrade blocks new uploads and generations; it does not delete existing paid results.
• Free generated media: results settled only with non-paid credit lots are retained for 7 days from creation, then scheduled for automatic deletion.
• Older generated media: outputs created before MixVio applied separate Free and paid retention rules remain available and are not deleted only because those rules started.
• Uploads (reference inputs): kept in private storage until you delete a completed upload or an approved workspace-deletion request is completed. Incomplete uploads older than 30 minutes are treated as abandoned and scheduled for cleanup. A user-deleted completed upload normally enters physical deletion after a 15-minute safety window, unless an active generation still needs it.
• Plan active storage: each plan includes a configured allowance for private uploads plus generated outputs. Current allowances are shown in Credits & usage after you sign in. Over-limit workspaces cannot start new uploads or generations until space is freed or the plan increases.
• Authentication and security records: sessions remain until they expire or are revoked. Routine security, fraud, abuse-prevention, and audit records are retained for up to 12 months after creation. Records connected to an incident, dispute, legal hold, or repeat-abuse investigation may be kept longer while needed.
• Billing and credit records: invoices, ledger entries, refunds, and related transaction records are normally retained for seven years after the relevant transaction for reconciliation, accounting, tax, fraud prevention, and legal obligations. Applicable law may require a different period, and these records may outlast account or workspace deletion.
• Analytics, support, and diagnostics: optional browser analytics follows the periods described in the Cookies section, and identifiable analytics event data is deleted or de-identified within 14 months after collection. Routine service logs and diagnostics are retained for up to 90 days after creation. Support messages and related email-delivery records are retained for up to 24 months after the last interaction. Aggregated or de-identified data may be retained longer because it no longer identifies you.
• AI Provider copies: retained according to the selected route, Provider configuration, and Provider terms. MixVio treats Provider output URLs as temporary and archives successful results to private MixVio storage. Contact support for the current boundary of a specific route before submitting sensitive information.

Account or workspace deletion is a reviewed process rather than an immediate automated purge, because a workspace can contain shared assets and billing records that law or accounting rules require us to keep. See Section 6 for workspace export and deletion review. After approval, we delete or de-identify personal information that can be removed and retain only the limited records required for security, disputes, accounting, or law.

9. Security and international processing

Private assets use short-lived, authorized URLs. Provider and infrastructure secrets stay on the server, access is checked against workspace membership, and payment pages are hosted by payment providers. No internet service is risk-free.

Our providers may process information in countries other than where you live. Where applicable law requires a transfer mechanism, we use an applicable contractual or other lawful safeguard. Contact us for information relevant to a specific transfer.

10. Your privacy rights

Depending on where you live, you may request access to, correction of, export of, or deletion of personal information that applicable law lets you control. You may also have rights to restrict or object to processing, withdraw consent, appeal a decision, receive portable data, or complain to a privacy regulator. We do not discriminate against users for exercising applicable privacy rights.

Use the in-product workspace export or deletion review where available for selected workspace records, email support@mixvio.ai, or use the Contact form by choosing Privacy request. We may verify your identity and authority over the relevant account or workspace. Some billing, ledger, security, and legal records cannot be deleted immediately.

We will acknowledge a privacy request within seven calendar days and respond to a verified request within 30 calendar days. If a request is complex or numerous, we may extend that period where applicable law permits; we will notify you within the initial 30 days and explain the reason. The storage and backup deletion periods in Section 8 apply after a deletion request is approved.

11. Children

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal information from children. If you believe a child has provided information to the Service, contact support@mixvio.ai.

12. Changes to this policy

We may update this policy as the Service, Providers, or applicable requirements change. We will post the updated date here and provide additional notice through the Service or by email when a change is material.