Legal

Privacy Policy

Effective date: August 16, 2026  ·  Last updated: August 16, 2026

This Privacy Policy explains how Ruwana Studio SRL collects, uses, stores, shares and protects personal data when you use Ruwana Studio, Ruwana Chat, creative production tools, support services, websites and authorized third-party integrations such as ChatGPT.

Part I

Controller & Scope

1. Data Controller

For the personal data processing described in this Privacy Policy, the controller is:

For privacy requests, please use the subject line Privacy Request where practical.

2. Scope of This Policy

This Privacy Policy applies to personal data processed through:

• ruwana.studio;
• the Ruwana Studio application;
• Ruwana Chat;
• Ruwana creative-production modules;
• Ruwana PRO;
• image, video, motion and avatar workflows;
• production History and Assets;
• Favorites and public-sharing functions;
• Ruwana Help and Nora — Ruwana Support;
• billing and subscription functions;
• authorized APIs and integrations;
• the Ruwana integration for ChatGPT; and
• other Ruwana services that link to this Policy.

A third-party service used to access Ruwana may separately process personal data under its own privacy policy.

Part II

Personal Data We Process

3. Account and Identity Data

Depending on how you create and use an Account, we may process:

• name;
• email address;
• account and user identifiers;
• authentication provider identifiers;
• profile information;
• account role and status;
• subscription plan and entitlement information;
• account creation and update timestamps; and
• security and authentication events.

If you use an authorized identity provider such as Google to sign in, Ruwana may receive the account identifiers and basic profile information made available within the authorized sign-in scope, such as your email address and profile identity.

4. Billing and Transaction Data

When you purchase a subscription or Credits, we may process:

• purchased plan or Credit pack;
• price and billing interval;
• transaction identifiers;
• payment status;
• subscription status;
• renewal and cancellation status;
• payment-provider customer and transaction references;
• billing name and address;
• company name, where supplied;
• CUI, CIF or VAT information, where supplied;
• invoice information;
• credit grants and consumption records; and
• records of checkout consents where applicable.

Ruwana currently uses Stripe for supported online payment processing and SmartBill for applicable invoicing and fiscal-document workflows.

5. Creative Inputs and Production Data

When you create with Ruwana, you may provide content that can contain personal data, including:

• prompts and creative instructions;
• photographs;
• product images;
• reference images;
• video;
• audio and voice recordings;
• documents;
• logos and visual assets;
• uploaded files;
• production settings;
• camera and creative-direction information;
• generation requests;
• production-job identifiers;
• generated Outputs;
• technical metadata associated with media; and
• information required to maintain production continuity.

6. Images, Voice and Information About Real People

Photographs, videos and audio supplied by users may contain personal data about the user or another person.

Depending on the content provided, this may include a person’s:

• face or likeness;
• appearance;
• voice;
• performance;
• location visible in media;
• personal surroundings;
• clothing or possessions;
• other identifiable characteristics; or
• information incidentally visible or audible in uploaded content.

Ruwana processes such media in order to perform the creative action requested by the user.

Ruwana does not use face or voice media for biometric identification or authentication unless a future feature expressly states otherwise and provides any additional legally required information.

Users are responsible for having the rights, permissions and lawful basis required to submit personal material relating to another person.

7. Ruwana Chat and Memory Data

When you use Ruwana Chat, we may process:

• your messages;
• conversation history;
• uploaded or attached media;
• production requests;
• tool and module selections;
• conversation metadata;
• user preferences;
• project context;
• facts explicitly stored in User Memory;
• facts explicitly stored in Project Memory;
• memory update and deletion events; and
• technical usage and cost information necessary to operate the service.

Ruwana Chat may use relevant recent context and stored memory to provide continuity between conversations and production tasks.

Where Ruwana provides controls to remove stored memory or conversation data, the user may use those controls subject to legal and technical retention requirements described below.

8. History, Assets and Favorites

Ruwana may store production information necessary to provide History, Assets and Favorites.

This may include:

• generated images, video and audio;
• source media retained for the applicable production;
• production identifiers;
• module and production-engine information;
• timestamps;
• resolution and media metadata;
• result status;
• thumbnail or poster references;
• Favorite status;
• public/private status; and
• other information necessary to display and manage the production.

History, Assets and Favorites may have different retention characteristics.

9. Support and Communications

When you contact Ruwana Help or use Nora — Ruwana Support, we may process:

• your email address;
• authenticated Account information where available;
• support messages;
• problem descriptions;
• screenshots;
• video or other attachments;
• technical information relevant to the issue;
• ticket number;
• ticket status;
• AI-generated support summaries;
• support decisions and routing information;
• email correspondence associated with the ticket; and
• human support notes where escalation is required.

Nora may use AI to conduct initial support triage, collect the information required to understand the issue, summarize the request and create or update the relevant support ticket.

Support may be escalated to a human where appropriate.

10. Device, Security and Usage Data

When you access the Service, Ruwana systems and service providers may process technical information such as:

• IP address;
• date and time of requests;
• browser and device information;
• operating-system information;
• request and response metadata;
• authentication events;
• security events;
• error and diagnostic information;
• feature usage;
• Credit consumption;
• production status;
• fraud and abuse signals; and
• service-performance information.

11. Data Received From Other Sources

Ruwana may receive personal data from sources other than directly from you, including:

• authentication providers you choose to use;
• payment processors;
• billing and invoicing providers;
• authorized third-party platforms such as ChatGPT;
• email and support communications;
• fraud and security systems;
• service providers acting for Ruwana; and
• public authorities where legally required.

Part III

Purposes & Legal Bases

12. Why We Process Personal Data

Ruwana processes personal data to:

• create and maintain Accounts;
• authenticate users;
• provide the Service;
• process creative-production requests;
• deliver and retain Outputs;
• provide History, Assets and Favorites;
• operate Ruwana Chat and user-requested memory functions;
• provide subscriptions and Credits;
• process payments and invoices;
• maintain billing and accounting records;
• provide customer support;
• operate authorized integrations;
• protect Accounts and infrastructure;
• prevent fraud, abuse and unauthorized use;
• diagnose errors and improve reliability;
• enforce contractual rights;
• protect users and third parties;
• comply with tax, accounting and other legal obligations;
• respond to valid legal requests; and
• establish, exercise or defend legal claims.

13. Legal Bases Under the GDPR

Purpose	Main legal basis
Account creation, authentication and Service delivery	Performance of a contract or steps requested before entering a contract
Creative production, Ruwana Chat, History, Assets and Favorites	Performance of a contract
Payments, subscriptions and Credit management	Performance of a contract
Invoices, fiscal records and legally required accounting	Legal obligation
Security, fraud prevention and abuse prevention	Legitimate interests and, where applicable, legal obligation
Reliability, debugging and protection of the Service	Legitimate interests
Support requested by the user	Performance of a contract and legitimate interests
Non-essential analytics or similar optional technologies	Consent where consent is legally required
Public sharing explicitly requested by the user	Performance of the requested Service and legitimate interests
Legal claims, investigations and enforcement	Legitimate interests and legal obligation where applicable

14. Legitimate Interests

Where Ruwana relies on legitimate interests, those interests may include:

• keeping the Service secure;
• preventing fraud and abuse;
• protecting user Accounts;
• protecting Ruwana intellectual property;
• protecting Ruwana Virtual Models from unauthorized extraction or misuse;
• maintaining reliable infrastructure;
• diagnosing errors;
• preventing duplicate billing or Credit charges;
• responding to support and rights complaints;
• maintaining business records; and
• establishing, exercising or defending legal claims.

15. When Data Is Required

Some personal data is required to enter into or perform the contract with Ruwana.

For example, Ruwana generally cannot provide an authenticated paid Account without required account and billing information.

Certain creative features cannot operate without the media or instructions necessary for the requested production.

You are not required to provide optional data where the Service identifies it as optional, although the related optional feature may then be unavailable.

Part IV

Creative Production & AI Processing

16. Processing Required to Generate Content

To perform a creative-production request, Ruwana may transmit the necessary Inputs, production instructions and technical parameters to infrastructure and AI or media-processing providers used for the selected production workflow.

Ruwana seeks to transmit only the information reasonably necessary to perform that production.

Different Ruwana modules may use different processing systems and providers.

17. Private Customer Content and Model Development

Ruwana does not treat a customer’s private media as a public Ruwana Virtual Model merely because that media was uploaded to the Service.

If Ruwana ever wishes to use private customer material for a materially different purpose that requires separate consent or another legal basis, Ruwana will provide the required notice and obtain consent where required.

18. Special Categories of Personal Data

Ruwana does not require users to provide special-category personal data merely to use ordinary creative-production functions.

User-supplied media may, however, incidentally reveal information such as health information, racial or ethnic origin, religious beliefs or other information that may receive special legal protection.

You should not intentionally submit sensitive personal data unless it is necessary for your requested use and you have a lawful basis to do so.

Where processing of special-category data requires an additional legal condition under applicable law, that condition must also be satisfied.

19. Automated Processing

Ruwana uses automated and AI systems for creative generation, production assistance, support triage, technical routing, security and service operation.

These systems may make automated technical or creative decisions such as generating an image, selecting production parameters, determining a job status, detecting duplicate processing or assisting with support categorization.

Ruwana does not currently use AI to make solely automated decisions about users that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.

If Ruwana introduces such processing in the future, we will provide the additional information and safeguards required by applicable law.

Part V

ChatGPT & Authorized Integrations

20. Ruwana in ChatGPT

Ruwana may be connected to ChatGPT through an authorized Ruwana integration using OAuth and the Model Context Protocol (MCP).

When you connect Ruwana to ChatGPT, you authorize the integration to access only the Ruwana capabilities and Account permissions presented through the applicable connection flow.

Depending on the action you request, the integration may allow ChatGPT to request Ruwana to:

• start an authorized production;
• use media that you deliberately provide for a production;
• check a production job;
• retrieve permitted recent results;
• retrieve Favorites;
• set or remove Favorite status; or
• perform other supported Account-bound Ruwana actions.

21. Data Ruwana Receives Through ChatGPT

Ruwana receives the information contained in the authorized application request sent to Ruwana for the action being performed.

This may include:

• the Ruwana Account identity associated with the authorized connection;
• OAuth authorization information and granted permissions;
• tool or production parameters;
• creative instructions;
• media or file references deliberately supplied for the requested action;
• result or production identifiers;
• requested History or Favorite actions; and
• technical information required to authenticate and process the request.

22. Data Returned to ChatGPT

When you request a Ruwana action through ChatGPT, Ruwana may return information necessary to complete that request, including:

• production status;
• result identifiers;
• generated media;
• permitted History information;
• Favorite status;
• Credit consumption associated with an action; and
• errors or other operational responses.

Information returned to ChatGPT is also subject to the privacy and data practices applicable to the user’s relationship with OpenAI.

23. OpenAI and Ruwana Are Separate Services

Ruwana Studio and OpenAI each operate their respective services and process personal data according to their applicable terms and privacy policies.

OpenAI does not become the operator of Ruwana merely because you access Ruwana through ChatGPT.

Likewise, Ruwana does not control how OpenAI processes your ChatGPT conversation outside the Ruwana app requests and responses governed by the applicable OpenAI terms.

Information about OpenAI’s privacy practices is available through OpenAI’s own privacy documentation.

24. Disconnecting Ruwana From ChatGPT

You may disconnect Ruwana through the applicable ChatGPT or OpenAI connection controls.

Disconnecting stops future access through that connection.

Disconnecting does not automatically erase information already stored in your Ruwana Account, such as completed production History, Favorites, billing records or support records.

Those records remain subject to Ruwana’s deletion controls, retention rules and legal obligations.

25. Payment and Sensitive Data Through ChatGPT

The Ruwana ChatGPT integration is not designed to receive payment-card numbers or other payment-card authentication data.

Purchases of Ruwana subscriptions or Credit packs are completed through Ruwana’s authorized payment flow rather than by transmitting payment-card information through the Ruwana ChatGPT tools.

Do not send protected health information, payment-card information or personal information relating to children below the applicable minimum age of digital consent through the Ruwana ChatGPT integration.

Part VI

Service Providers, Sharing & Transfers

26. Service Providers

Ruwana may share personal data with service providers only where reasonably necessary to operate the Service or meet legal obligations.

Provider categories may include:

• cloud hosting and infrastructure;
• media storage and content-delivery services;
• AI and creative-production providers;
• video, image, audio and media-processing providers;
• authentication providers;
• payment processors;
• billing and invoicing providers;
• email-delivery providers;
• support infrastructure;
• security and fraud-prevention providers;
• analytics providers where enabled and lawful;
• professional advisers; and
• authorized conversational platforms such as OpenAI where the user chooses the integration.

Ruwana requires service providers to process personal data only for authorized purposes and subject to applicable data-protection requirements.

27. Current Major Service Relationships

Depending on the feature used, current Ruwana service relationships may include:

• Stripe — payment processing and subscription-related payment services;
• SmartBill — applicable invoicing and fiscal-document processing;
• Google — supported authentication functions where chosen by the user;
• OpenAI — authorized ChatGPT integration and certain AI-related services used by Ruwana;
• cloud, storage and content-delivery infrastructure;
• AI and media-processing services required for the selected Ruwana production workflow; and
• email and communication infrastructure used for Account and support communications.

Providers and underlying technologies may change as Ruwana evolves. Where a change materially affects privacy information that must be disclosed, this Policy will be updated as required.

28. Legal Disclosures

Ruwana may disclose personal data where reasonably necessary to:

• comply with applicable law;
• respond to valid court orders or legal process;
• respond to competent regulatory or law-enforcement authorities;
• protect the rights or safety of users or third parties;
• investigate fraud or security incidents;
• enforce Ruwana contracts and intellectual-property rights; or
• establish, exercise or defend legal claims.

29. Business Transfers

If Ruwana undergoes a merger, acquisition, restructuring, financing, sale of assets or transfer of all or part of the Service, relevant personal data may be transferred as part of that transaction subject to applicable law.

30. We Do Not Sell Personal Data

31. International Data Transfers

Some providers used by Ruwana may process personal data outside Romania or outside the European Economic Area.

Where applicable data-protection law requires safeguards for an international transfer, Ruwana relies on an appropriate lawful transfer mechanism, which may include:

• an adequacy decision of the European Commission;
• Standard Contractual Clauses;
• another safeguard permitted under Article 46 GDPR; or
• another lawful transfer mechanism applicable to the particular transfer.

You may contact Ruwana for information about the safeguards applicable to relevant transfers where the GDPR provides that right.

Part VII

Retention, Public Content & Security

32. Data Retention

Ruwana retains personal data only for as long as reasonably necessary for the purposes described in this Policy, subject to legal, contractual, security and technical requirements.

Retention criteria include:

Data category	Typical retention approach
Account data	While the Account remains active and afterwards where required for legal, security or dispute purposes.
Billing and invoices	For the periods required by applicable tax, accounting and commercial law.
Credit ledger and transaction records	As necessary to operate the Account, prevent duplicate charging, resolve disputes and meet legal obligations.
Production History and media	According to applicable Ruwana storage and retention rules, user actions and the status of the production.
Favorites	Retained according to the Favorite feature and Account lifecycle until removed or otherwise lawfully deleted.
Temporary production media	May be deleted after processing, migration to retained storage or expiration of the applicable technical lifecycle.
Chat conversations and memory	As necessary to provide conversation continuity and user-requested memory until deleted or subject to applicable retention requirements.
Support tickets and attachments	As necessary to resolve and document support cases, prevent abuse and address legal or operational claims.
Security logs	For a period proportionate to security, fraud prevention, debugging and legal requirements.
Public content	While intentionally published and afterwards where limited retention is necessary for legal, security or backup purposes.

33. History, Favorites and Deletion

History may be subject to product storage and retention limits.

Favorites are designed to preserve selected results differently from ordinary History, but they should not be treated as the user’s only permanent archival backup.

Where Ruwana provides an explicit deletion function, Ruwana will process the deletion request according to the applicable product and legal rules.

Some limited records may need to be retained even after Account or content deletion where required for:

• tax and accounting obligations;
• fraud prevention;
• security;
• legal claims;
• contract enforcement; or
• other mandatory legal requirements.

34. Public Content

Private History, Assets and Favorites are not public merely because they exist in a Ruwana Account.

If you intentionally publish an Output through a public Ruwana function, the published content and information deliberately associated with it may become accessible to other users or the public.

Public pages and links can potentially be copied, shared, cached or indexed by third parties or search engines.

You should therefore not publish personal or confidential material unless you intend it to be public and have the required rights.

35. Security

Ruwana uses reasonable technical and organizational safeguards designed to protect personal data against unauthorized access, loss, alteration or disclosure.

Measures may include:

• authenticated Account access;
• access controls;
• secure session mechanisms;
• encrypted transport;
• user-bound production and History controls;
• security logging;
• rate limiting and abuse controls;
• restricted production permissions;
• provider access controls; and
• backup and recovery procedures where applicable.

No internet-connected system can guarantee absolute security.

If Ruwana identifies a personal-data breach requiring notification under applicable law, Ruwana will make the required regulatory and individual notifications.

36. Cookies and Similar Technologies

Ruwana websites and Studio may use cookies or similar technologies for:

• authentication;
• security;
• session continuity;
• preferences;
• consent choices;
• service operation; and
• analytics where enabled and legally permitted.

The Ruwana Studio application uses an essential authenticated session mechanism to keep signed-in users connected securely.

Non-essential analytics or similar cookies are used only where an applicable legal basis exists, including consent where required.

Cookie choices may be managed through the available Ruwana cookie controls:

Cookie Settings

Cookie names and technical implementation may change as the Service evolves.

Part VIII

Your Privacy Rights

37. GDPR Rights

Where the GDPR applies, you may have the right to:

• Access personal data Ruwana processes about you;
• Rectify inaccurate or incomplete personal data;
• Erase personal data in circumstances provided by law;
• Restrict processing in circumstances provided by law;
• Object to processing based on legitimate interests in applicable circumstances;
• Data portability for eligible data processed by automated means on the basis of consent or contract;
• Withdraw consent where processing is based on consent, without affecting prior lawful processing;
• receive information about relevant international-transfer safeguards;
• exercise applicable rights relating to solely automated decision-making; and
• lodge a complaint with a competent supervisory authority.

38. Exercising Your Rights

To exercise a privacy right, contact:

Ruwana may need to verify your identity before fulfilling a request, particularly where the request concerns Account or private production data.

Verification information will be limited to what is reasonably necessary to protect the Account and the personal data concerned.

Rights are subject to the conditions and exceptions provided by applicable law.

39. Right to Object

Where Ruwana processes personal data on the basis of legitimate interests, you may have the right to object on grounds relating to your particular situation.

Ruwana will stop the relevant processing where required by law unless there are compelling legitimate grounds to continue or processing is necessary for the establishment, exercise or defence of legal claims.

40. Withdrawal of Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

Some optional functionality may no longer be available after consent is withdrawn.

41. Supervisory Authority

You have the right to lodge a complaint with a competent data-protection supervisory authority.

Ruwana Studio SRL is established in Romania.

The Romanian supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Website: dataprotection.ro

If you reside elsewhere in the European Economic Area, you may also have the right to contact the competent supervisory authority in your jurisdiction.

42. Children and Young Users

Ruwana is not designed to collect personal data from children who are below the minimum age at which they may independently consent to the applicable digital service under applicable law.

Where a young person may lawfully use Ruwana only with authorization from a parent or legal guardian, that authorization is required.

Ruwana does not permit sexual or exploitative content involving minors.

Do not use the Ruwana ChatGPT integration to transmit personal information relating to children below the applicable minimum age of digital consent.

If you believe that Ruwana has unlawfully received personal data relating to a child, contact hello@ruwana.studio so that we can investigate and take appropriate action.

43. Changes to This Privacy Policy

Ruwana may update this Privacy Policy as the Service, our providers, technical architecture or applicable law changes.

The current version will be published on this page with an updated “Last updated” date.

Where applicable law requires additional notice or consent for a material change, Ruwana will provide it.

44. Contact

45. Related Links

• Terms of Use
• Licensing
• Pricing Plans
• Virtual Models
• Help Center
• Cookie Settings

© Ruwana Studio SRL · Privacy Policy · Last updated August 16, 2026