Short version: this website uses no cookies and no third-party scripts. The DiwAI app counts anonymous visits without cookies. We do not sell personal data. Photos you upload are temporary working files and are deleted automatically about 24 hours after you upload them, including photos from orders that are never paid for. We start making pictures before you pay. Finished gift pictures and notes are deleted after 30 days. Some order records are kept longer, as section 6 explains.
1. Who we are
NowVector Ltd, trading as DiwAI, a company registered in Scotland (company number SC900740), registered office: Office 576, 18 Young Street, Unit LGE, Edinburgh, EH2 4JB, is the controller of the personal data described here. Contact: support@nowvector.world.
2. This website
This website sets no cookies and uses no advertising or other third-party tracking. It loads no third-party scripts, fonts or images. The separate DiwAI app, where you create your gifts, counts anonymous visits (pages viewed and country) without cookies, and we do not link those counts to your photos, orders or email. The app also keeps your gift drafts in your browser’s own storage, as section 3 explains. This website is hosted by Cloudflare (Cloudflare Pages), which, like any web host, may keep short-term technical logs such as IP addresses to deliver the site and keep it secure.
3. What we collect
- When you contact us: your email address and what you tell us in your message.
- When you buy: payment is handled by Stripe, which collects your payment details. We receive confirmation of your order (what you bought, the amount and whether it succeeded) and your email address. We do not see or store your full card details.
- When you create gifts: the photos you upload, the optional short note you write, the ready-made note you choose, the optional “From” line (for example a person or a family name) you use to sign the gift, the card design you choose, the name of each recipient (which you enter), and the finished pictures created from your photos.
- If you choose to email a gift link: the email address you give, whether it is your own or a recipient’s. We send a gift email only when you ask us to, and only once the gift is ready. We use a recipient’s address once to send the link, then clear it straight away. We also keep your own email address to send your order confirmation and any link you ask us to send you.
- When a gift is opened: we note the time it is first opened, so the person who sent it can see that it arrived. We do not record who opened it, and we do not store their IP address or device details with that event.
- In your browser: the DiwAI app saves your gift drafts in your browser’s own storage (the names you entered, notes, From lines, your email, your choices and private link codes) so you can continue. Photos are not kept there. It stays on your device until you clear your browser data. The app sets no advertising cookies, and the anonymous visit counts use no cookies.
- To run the Service: records of your order, your gifts and their private links, the dates they were created and expire, the choices you made (such as who the gift is for, the tone, the kind of picture, the scene or style and the card design), your consent records and the version of the terms you accepted, simple face counts and outcomes, error and delivery records, and a hashed IP address used to limit abuse.
4. How we use it
- To create your pictures and deliver them to you by private link.
- To check uploads with an automated moderation service before they are used.
- To take payment, provide refunds and keep the accounting records the law requires.
- To answer your messages and support you.
- To keep the Service secure and prevent misuse.
- To learn what is working. If you arrive from a link or code we use, we note which one, for example a social post, so we know what is working; this holds no personal details.
Our legal bases under UK GDPR are performing our contract with you, our legitimate interests in running a safe service, legal obligations, and your consent where we ask for it. Where the law of India applies, we process personal data on the basis of your consent and the other lawful uses that law allows.
5. Faces and photos of other people
When you choose a photo, the DiwAI app checks it on your own device to find the faces in it, so that the finished picture keeps people looking like themselves and so that we know whether it is a single-person or group photo. The detailed face measurements this needs are worked out temporarily in your browser and are not sent to us. We do not use faces to identify anyone, we do not keep face-recognition templates, we do not sell your photos, and we do not use them to train AI models. We keep only simple counts and outcomes with your order, such as how many faces were found and whether the check passed. Your photo is sent to our storage and to our AI service (see section 7) only to make your picture, and it is deleted automatically about 24 hours after you upload it, including photos from orders that are never paid for.
If you appear in a photo uploaded by someone else, we use it only to make that person’s gift. We delete it shortly after, do not use it to train AI or to identify you, and give any concern about a child priority. To ask for removal or to object, email support@nowvector.world.
If you upload a photo of another person, you confirm that you have their permission. Please do not upload photos of anyone under 18 unless you are their parent or guardian, or have a parent or guardian’s agreement.
6. How long we keep it
| What | How long |
|---|---|
| Photos you upload | Temporary working files, deleted automatically about 24 hours after you upload them, including photos from orders that are never paid for |
| Finished gift pictures, cards and personal notes | 30 days from creation, then deleted |
| Picture reference code, picture type and date | 30 days, the same as the picture, then deleted |
| Gifts you buy | Unused gifts do not expire, and we keep your email address while any are unused. If none of your gifts has been used for 3 years, we email you and offer a refund of the unused gifts; if you don’t reply within 30 days, the unused gifts end and we delete your email address. Each finished gift's private link works for 30 days |
| Your email address as a buyer | Kept while you have unused gifts. Once all your gifts are used, deleted 30 days after the last private link expires. Order records below are kept |
| Order and purchase records: your email address, the choices you made, consent records, face counts and outcomes, and a hashed IP address | Kept as long as needed for accounting, support and security, then deleted or anonymised. You can ask us to delete them |
| Gift drafts kept in your own browser (names, notes, From lines, email and private link codes; never photos) | On your device until you clear your browser data |
| Recipient email address (only if you choose to email a gift) | Cleared straight after the one delivery email is sent |
| Time a gift was first opened | 30 days, the same as the gift, then deleted |
| Service logs and payment confirmation records | Up to 90 days, then deleted |
| Payment and order records | For as long as tax and accounting law requires |
| Emails you send us | For as long as needed to deal with your request, and up to 12 months after |
| Website host logs | A short period, set by the host |
7. Who we share data with
We use these providers to run the Service. They act as our data processors, on our instructions:
- Stripe for taking payments. For your payment details Stripe acts as an independent controller under its own privacy policy.
- OpenAI for creating the AI pictures and for checking uploads with automated moderation. We send OpenAI your photo and instructions about the look of the picture, not your name, note or From line. OpenAI states that it does not train on API data by default and may keep API inputs and outputs for a limited period, up to 30 days, for abuse monitoring.
- Supabase and Lovable Cloud for our database and file storage.
- Resend for sending service emails, such as your order confirmation and the gift links you ask us to send.
- Our hosting providers for this website and for the Service itself. This website is hosted by Cloudflare.
We do not sell personal data. We do not use advertising cookies, and our anonymous visit counts use no cookies and are not linked to you. We may share data if the law requires it, or to protect people’s safety and our rights.
8. Private links and reference codes
Each finished gift has a private link. Anyone who has that link can open the gift until it is deleted after 30 days. Please share links only with the person they are meant for.
Each finished picture carries a reference code. We keep the code, the picture type and the date only for as long as the picture itself, 30 days, and then delete them. If you send us a code within that time, we may look up the picture linked to it, only to check whether it was made in DiwAI.
9. Where data is stored and international transfers
Our database and file storage are hosted in the United States (US East, N. Virginia). Some of our other providers, such as our AI service, our payment provider and our website host, may process data in other countries, including the United States, the United Kingdom, the European Union and India. Where we send personal data abroad, we rely on appropriate safeguards, such as approved standard contractual terms, or on the legal routes your country allows.
10. Your rights
Depending on where you live, you can ask us to show you your data, correct it, delete it, restrict or object to our use of it, or move it. You can also withdraw consent you have provided. Email support@nowvector.world and we will reply within 7 working days and complete your request within one month. To ask for deletion, write “Deletion request” in the subject line and tell us the email address you used. If you are in the UK, you can complain to the Information Commissioner’s Office (ico.org.uk). If you are in India, you can also contact us to raise a concern about how we handle your data, and we will respond.
11. Children
Gifts and Gift Packs can be bought only by adults. We do not knowingly collect personal data from children, other than photos that an adult uploads with a parent or guardian’s agreement as described above. If you think a child’s data has been provided without permission, email us and we will delete it.
12. Security
We use reasonable technical and organisational measures to protect personal data, and we limit who can reach it. No system is perfectly secure, so please tell us at once if you think something has gone wrong.
13. Notes for your country
United Kingdom and Europe: your rights are in section 10. In the UK you can complain to the Information Commissioner’s Office.
India: Grievance Officer: Apeksha Kulkarni, Director, NowVector Ltd, Office 576, 18 Young Street, Unit LGE, Edinburgh, EH2 4JB, United Kingdom. Email: apeksha@nowvector.world. We acknowledge within 48 hours and aim to resolve within 30 days.
United States: we do not sell your personal information. We do not respond to browser do-not-track signals because we do not track you across sites.
Canada: we collect your information to make your gift, using service providers in the United States whose local authorities may be able to access it. We keep photos only briefly and do not use them to train AI. To ask a question, withdraw consent or complain, email support@nowvector.world. You may also contact the Office of the Privacy Commissioner of Canada.
Australia: we use your photo only to make your gift and delete it shortly afterwards. Our service providers are in the United States and their authorities may be able to access it. To ask a question, ask for removal or complain, email support@nowvector.world.
Singapore: our Data Protection Officer is Apeksha Kulkarni, Director, NowVector Ltd. Contact: apeksha@nowvector.world. For people shown in a photo, we rely on our legitimate interests in making the gift. We send your photo to service providers in the United States, and our contracts with them require protection comparable to Singapore’s Personal Data Protection Act.
New Zealand: we use your photo only to make your gift and delete it shortly afterwards. Our service providers are in the United States and are contractually required to protect it in a comparable way. To ask a question, ask for removal or complain, email support@nowvector.world. You may also contact the Office of the Privacy Commissioner.
Malaysia: our Data Protection Officer is Apeksha Kulkarni, Director, NowVector Ltd. Contact: apeksha@nowvector.world. We send your photo to service providers in the United States under contracts requiring comparable protection.
South Africa: we use your photo only to make your gift and delete it shortly afterwards. Our service providers are in the United States. To ask a question, ask for removal or complain, email support@nowvector.world. You may also contact the Information Regulator.
14. Changes
If we change this policy in a way that matters, we will update the date at the top of this page.