L▲
Sign in

Privacy Policy

Last updated: October 10, 2026

1. Introduction

Gravital Digital LLC ("we", "us", or "our") operates Lorvara (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Email address and username, and either a password (encrypted) or, if you sign in with Google, the details described in section 2.4
  • Profile Information: Display name, bio, avatar, social media links
  • Content: Prompts, projects, and other content you create
  • Communications: Messages sent through our contact forms or support

Important Notice: Lorvara has no public gallery and no public profile. What you create is visible only to you unless you work in a team. When you join a team, its other members can see your name or username and your profile picture, the content in projects assigned to that team, and any brief or Custom Skill you share with the team. The team owner can also see your email address and the credits you spend from the team's balance; if you own a team, its members can see your email address. See section 4.2.

2.2 Information Collected Automatically

  • Usage Data: Pages visited, features used, time spent on the Service
  • Device Information: Browser type, operating system, IP address
  • Cookies: Session cookies and authentication tokens
  • Analytics: Pages visited, the referring site, browser, operating system, device type, approximate location and scroll depth, counted without cookies by Plausible (see section 4.3)

2.3 Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers or other sensitive payment information. Stripe's privacy policy governs their collection and use of payment data.

2.4 Signing in with Google

You can create a Lorvara account, or sign in to one, with your Google account. When you do, we ask Google for two permissions and no others: userinfo.profile and userinfo.email, which let us read your basic profile and your email address.

What Google sends us. Google sends these details to our authentication service, PocketBase, which runs on Fly.io:

  • your Google account ID, an identifier for your Google account
  • your name
  • your email address, which we use only if Google reports it as verified
  • a link to your Google profile picture

Google also issues an access token for the sign-in. We use it only to read the details above, and we do not store it.

What we do with it. Your email address becomes your account's email address, your name becomes your account name, and your Google account ID is saved with your account so that you can sign in with Google again. We save a copy of your profile picture with your account, and we keep the link to it so that it can be shown as your profile picture; when it is shown, your browser loads it from Google. We use these details to run your account and to send you Lorvara news and updates, which you agree to receive when you create your account.

Where it is stored. All of it, including the copy of your profile picture, is stored in Lorvara's database, which Gravital Digital LLC operates on Fly.io. When we add your email address to our mailing list, our website host, Netlify, records it in its server logs.

Who it is shared with. When you create an account on our sign-up page, we send your email address, your name, the date you signed up and whether you signed up with an email address or with Google (and, with Google, your Lorvara account ID) to MailerLite, which sends our product and marketing email. You agree to receive that email when you create your account, and you can unsubscribe at any time using the link in any message. Signing in never sends anything to MailerLite, and deleting your account deletes your address from MailerLite. If you buy credits or a plan, we send your email address and name to Stripe to create your customer record. If you join a team, its other members can see your name and profile picture, and the team owner can see your email address. We do not share your Google account information with anyone else, except where the law requires it or as part of a sale or merger of the business.

Deleting it. You can close your account at any time from your account settings. When you do, we replace the name and email address on your account, delete the stored copy of your profile picture and the profile that holds the link to it, and remove the link between your Google account and your Lorvara account. Billing and credit records are kept as a financial record, without your name or email address, and some information may persist in backups for a limited period. If you joined our mailing list, closing your account does not remove you from it: use the unsubscribe link in any email from us, or write to us at feedback@lorvara.com to ask for your address to be removed. If you have bought from us, Stripe keeps its own customer record. You can also remove Lorvara's access in your Google Account settings; that does not close your Lorvara account or delete what we hold.

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain our Service
  • Create and manage your account
  • Process transactions and send billing information
  • Send administrative information and service updates
  • Respond to your comments and questions
  • Improve our Service and develop new features
  • Monitor and analyze usage patterns
  • Detect and prevent fraud or abuse
  • Comply with legal obligations

4. How We Share Your Information

We may share your information in the following situations:

4.1 With Your Consent

We share information when you explicitly authorize us to do so.

4.2 Content Shared With Your Team

Lorvara has no public gallery, and nothing you create is published to other users, website visitors or search engines. Content is shared only within a team you belong to. The other members of that team can see:

  • Your name or username and your profile picture
  • Prompts, references and generations in projects assigned to the team
  • Briefs and Custom Skills you share with the team

The team owner can also see your email address, and the credits you spend from the team's balance, by person and by media type. A team's members can see its owner's email address. You control what is shared by choosing which projects are assigned to a team and which briefs and Custom Skills are shared with it.

4.3 Service Providers

We share information with third-party service providers that help us operate our Service:

  • Stripe: Payment processing
  • Anthropic: AI language models that power the Prompt Agent and brief composition. Receives the text of your briefs, prompts and agent conversations, and reference images you attach to them. Also receives the image of a character before it is registered, for the age check described in section 9.
  • fal.ai: Image and video generation. Receives the prompts you generate from and any reference images or videos attached to them.
  • AnyFast: Video generation for certain models. Receives the prompts you generate from and any reference images or videos attached to them. The images of a registered character are also stored by AnyFast, on Volcengine, until they are deleted. See section 9 for where this processing and storage take place, and for what is registered.
  • Amazon Web Services (S3 and CloudFront): Storage and delivery of the images and videos you upload or generate. These are stored in the United States (AWS region us-east-1) and delivered worldwide through CloudFront's edge network.
  • Fly.io: Hosting for our database and authentication service (PocketBase)
  • Netlify: Website hosting and form processing
  • Resend: Transactional email, such as account verification and password resets
  • Google: Sign-in with Google, described in section 2.4. Receives your sign-in request and, when your profile picture is shown, your browser's request for it. Also serves the fonts our pages use, so your browser requests them from Google when our pages load.
  • MailerLite: Product and marketing email, which you agree to receive when you create an account on our sign-up page. Every such account is recorded there, and your address is deleted from it when you delete your account. Receives your email address, your name (for an account created with an email address and password, the part of your email address before the @), the date you signed up and whether you signed up with an email address or with Google, and, if you signed up with Google, your Lorvara account ID.
  • Plausible: Website analytics, without cookies. Receives the address of each page you visit, the referring site, your IP address and your browser's user agent, and records pages visited, browser, operating system, device type and approximate location. Plausible does not store IP addresses or user agents. See Plausible's data policy.

4.4 Legal Requirements

We may disclose information if required by law, court order, or government request, or if we believe disclosure is necessary to protect rights, property, or safety.

4.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, user information may be transferred to the new owner.

5. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

  • Encryption of data in transit using HTTPS
  • Encrypted password storage
  • Regular security assessments
  • Limited access to personal information
  • Secure data centers for our service providers

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your information.

6. Data Retention

We retain your information for as long as necessary to provide our Service and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

  • Account Information: Retained while your account is active
  • Content: Retained until you delete it or close your account
  • Registered character images held by AnyFast: These do not expire. They are kept until they are deleted, a deletion is permanent, and most of what you remove in Lorvara does not delete them. See section 9 for the one case that does and for how to ask.
  • Billing Records: Retained as required for tax and accounting purposes
  • Analytics Data: Retained in anonymized form for up to 2 years

7. Your Rights and Choices

7.1 Access and Update

You can access and update your account information through your account settings.

7.2 Delete Your Account

You can delete your account at any time from your account settings. This deletes your content — prompts, projects, workspaces, Custom Skills, ratings and team memberships — and removes your personal information, including your name, email address and profile, from our active databases. Your login is closed permanently.

We retain your billing and credit history as a financial record, with your personal details removed from it, so those records no longer identify you. Some information may also persist in backups for a limited period, or be retained where the law requires it.

7.3 Export Your Data

You can export your prompts and projects through the Service interface.

7.4 Opt-Out of Communications

You can opt-out of marketing emails by clicking the unsubscribe link. Note that you cannot opt-out of service-related communications.

7.5 Cookie Preferences

Most browsers allow you to refuse cookies. However, this may limit your ability to use certain features of our Service.

8. Children's Privacy

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If we discover that a child under 18 has provided us with personal information, we will delete such information from our systems.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from your country. By using our Service, you consent to such transfers.

Where your files are stored. The images and videos you upload or generate are stored on Amazon Web Services in the United States (region us-east-1), and delivered through CloudFront's global edge network, which may cache them closer to whoever is viewing. Our database and authentication service are hosted on Fly.io. If you are outside the United States, using Lorvara therefore involves transferring your content to the United States.

Video generation through AnyFast. Certain video models are provided through AnyFast. Processing and storage for these models run across an overseas southeast pool and a mainland pool in China, allocated by availability. There is no primary location and no way to pin a request or a file to one of them: either pool may handle any request, and the prompt and any reference images or videos submitted with it are processed wherever it runs. AnyFast's documentation states that it keeps the record of a generation task for 7 days, and the link to a generated video for 24 hours or 100 downloads.

Registered characters. These models decline a reference image that shows a face when it is sent in the ordinary way. So that a character you have generated can appear in your videos, Lorvara registers the character's images with AnyFast: each image is uploaded once to AnyFast's asset library, and your generations then refer to it instead of sending the picture again. AnyFast runs on Volcengine, the cloud platform of ByteDance, and that is where a registered image is held, under the pool allocation described above. We cannot tell you which of the two pools holds a particular file.

What is registered, and when. Lorvara registers only images generated within Lorvara. An image you uploaded, or one made from an upload, is not registered. This is Lorvara's own rule. Nothing is registered until you have confirmed, once for your account, that you hold the rights to the characters you register. After that, a character's images are registered when they are added to a project whose video model is served through AnyFast.

The checks are Lorvara's. AnyFast does not apply its content screening to a registered image, so the checks made before an image is registered are our own. We check the record of how the image was made. And we refuse any character that reads as under 18, from the words that describe the character and from the image itself, which is sent to Anthropic for that one judgement. A character is refused when the check cannot tell. The check is automated and is not a guarantee.

How long an image is kept. A registered image does not expire: AnyFast keeps it until it is deleted. A deletion at AnyFast is permanent and cannot be reversed. The copy we hold is separate and is governed by the rest of this notice. Videos already generated from a registered character are not withdrawn when its image is deleted.

When a registered image is deleted. There is one case. When an image leaves a character that is still in your brief, because you removed that image or replaced it, Lorvara asks AnyFast to delete the registered copy the next time that character's images are registered or used in a generation. If AnyFast does not confirm the deletion, we do not record the image as deleted, and we ask again the next time.

When it is not. In every other case the registered copy stays at AnyFast until you ask us to remove it. In particular, none of these deletes it today: removing a whole character from a brief, deleting a brief or a project, and closing your account. To have registered images deleted, write to us at feedback@lorvara.com from the address on your account and say which characters, or that you mean all of them.

Shared infrastructure. AnyFast holds registered images in infrastructure shared across its customers, not in a space set apart for Lorvara or for you. AnyFast states that each of its customers' credentials sees only its own assets. Lorvara does not send the identifier of a registered image to your browser.

Models served through AnyFast are identified in the model selector. If you prefer that your content not be processed or stored in mainland China, choose a model that is not served through AnyFast. A character's images are not registered unless you have given the rights confirmation and the project's video model is one served through AnyFast.

10. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your information, and the right to opt-out of the sale of personal information (which we do not do).

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

12. Contact Us

For privacy-specific inquiries, please use our contact form and select "Privacy Inquiry" from the subject dropdown.