Privacy Policy

Hiversal is operated by Alemkhan Sagitov (Sagitov Alemkhan Sagituly), an individual based in Karaganda, Republic of Kazakhstan. Service and personal-data inquiries: info@hiversal.com.

Public pages can be viewed without an account. This Policy covers visitors’ technical data, guest and existing accounts, and use of the tools. Reading this Policy does not itself replace consent where consent is legally required.

For guest access by invitation: nickname, unique account identifier, language, account-creation and invitation-use timestamps, the link between the invitation and the account, and plan details. A consent receipt is saved when you confirm the terms. No email or password is requested, but the account and related records are stored on the server.

• Email registration: email and your chosen name. Supabase Auth processes the password and stores its hash.
• Google sign-in: email, account identifier, name and profile photo, if provided by Google. Your Google password is not shared with the Platform.
• Profile: the name, avatar, cover, background and other saved profile information you add, and interface preferences.
• Uploaded files: formatting samples, source documents and project materials.
• Creation data: prompts, topics, build settings, operations and credit usage.
• Generated materials: completed files are stored temporarily in protected storage.
• Technical data: IP addresses and browser information may appear in infrastructure logs for security and diagnostics.

Payments are not accepted yet; the Platform does not request bank card details.

Avatars, profile covers and custom backgrounds are stored in public file storage: anyone with a direct link can open an image without signing in. Profile visibility settings do not restrict direct-link access. Do not upload confidential images here.

By checking the confirmation during registration or before starting work, or clicking the Google sign-in button beside the corresponding notice, I confirm that I am at least 18, accept the Terms of Use, and consent to collection and processing of the data listed in section 2 to provide the service, authenticate my account, store materials, carry out my requests, account for usage, protect the service and provide operational support. Registration and sign-in confirmations are recorded after account verification.

I consent to necessary data transfers to the providers in section 4, including cross-border transfers described in section 5. This consent does not authorize public publication of my source files or prompts. Visibility depends on the action: avatars, covers and custom backgrounds are accessible by direct link (section 2); access to community materials depends on the settings and members of the relevant space. Do not post confidential information there. Sections 6 and 7 describe retention and security. Marketing and advertising profiling are excluded.

Consent lasts until the stated purposes are achieved, account deletion or withdrawal, subject to lawful further retention and the periods in section 6. I may withdraw it using data controls in my profile or by contacting info@hiversal.com. Withdrawal prevents new tasks and uploads until fresh confirmation; reading, downloading available materials and account deletion remain available. Withdrawal cannot undo a completed transfer to an external service and does not instantly erase backups.

The confirmation records the account identifier and name, server date and time, language, version and checksum of the accepted texts. Reading this page alone does not constitute consent.

Depending on the feature used, data needed to provide it is sent to the following services:

• OpenRouter and the model providers selected through it — processing prompts and content submitted to create or edit materials;
• Exa — web search through OpenRouter, when enabled; disabled by default. Search uses a formulated query. Do not include personal data, secrets or confidential document excerpts in that query;
• Pexels — queries to search for stock photos;
• Supabase — account data, database and file storage;
• Railway, Vercel, Cloudflare — data needed for server-side processing, hosting and delivery.

Requests to models through OpenRouter specify data collection restrictions and require zero data retention (ZDR) by the model provider. These restrictions do not automatically cover third-party tools, including web search, and do not replace external services’ policies.

Payments are not accepted yet. The payment provider and the terms for sharing data with it will be identified before payments are enabled.

These services process data under their own policies. Do not enter or upload information that must not leave your organisation.

As of 10 October 2026, the primary Supabase database is hosted in Australia (ap-southeast-2), and the Railway application server is in the United States (us-west2). For other providers, processing locations depend on the service and selected model route. This describes the actual configuration and does not establish compliance with all data localisation requirements.

You can request information about data locations and cross-border processing at info@hiversal.com. Consent to this Policy does not override mandatory legal requirements for storing and transferring personal data.

Configured retention for generated files and project sources: Free — 7 days; Starter and Beta — 30 days; Pro — 90 days; Premium — 365 days; Cancelled status — 90 days. The recorded expiry applies to each file. Access is restricted after expiry; physical deletion occurs on a subsequent cleanup run. Legacy records without an expiry and paused cleanup require separate handling; immediate deletion is not promised.

Operation and credit history, profiles and consent receipts have no single configured automatic deletion period. Guest accounts do not disappear when you close a tab, sign out or clear your browser. Ready community materials remain until explicitly deleted or removed during account cleanup. Account deletion starts removal of related working data; remaining files may be removed by subsequent cleanup.

Infrastructure logs, queues, caches and backups have separate retention and cleanup mechanisms. A single retention period for all providers’ copies has not been verified. Contact info@hiversal.com for information or deletion requests. Account deletion does not remove downloaded files or copies in other browsers; see section 9.

Immediate deletion of every copy from every system is not guaranteed.

The Platform uses authentication and account-based access controls. Supabase Auth handles passwords, which are stored in hashed form. HTTPS transmission is protected by TLS, but this does not establish encryption of all storage and backups.

The security of external infrastructure depends on the settings of the relevant services. The Service runs in beta. Despite the measures taken, absolute security and freedom from data loss are not guaranteed. Keep your own copies of important materials.

You can submit a request about your personal data, including to:

• obtain information about processing and a copy of your data;
• request correction of inaccurate data;
• request deletion of your account and related data — deletion can be started in your profile, with details in sections 6 and 9;
• submit a request to withdraw consent;
• request blocking or termination of processing.

Send requests to info@hiversal.com. They are considered subject to applicable legal requirements. Simply stopping use of the Service does not delete your account or stored data.

To support the Platform, your browser may store:

• authentication data to maintain your session;
• language, theme and other interface settings;
• local copies of projects, presentations and drafts, and information about unfinished actions needed to recover your work.

This data may remain between visits and after signing out. After confirmed account deletion, the Platform attempts to clear known local records belonging to that account in the current browser. Older records without an account association and copies in other browsers or on other devices are not automatically cleared.

If needed, remove Hiversal site data in the browser settings on each device. This also removes local copies for other Hiversal accounts in that browser; save important materials separately first.

The Platform does not use advertising trackers. Using third-party services involves the connections described in section 4. If analytics is added later, this Policy will be updated.

The Service is not designed for persons under 18. We do not knowingly collect data of minors. If such data was submitted by mistake, contact info@hiversal.com for deletion.

This Policy may be updated. The current revision is published on this page with its date.

For material changes, including new data recipients, the Operator gives notice by email or through the interface at least fourteen days before they take effect. Continued use alone does not replace separate consent where required by law. Changes requiring explicit confirmation are not treated as automatically accepted.

For privacy and personal data questions:

Email: info@hiversal.com Karaganda, Republic of Kazakhstan

We aim to respond within 5 business days.