Privacy Policy

This Privacy Policy explains what personal information Tavira Creator Academy ("we", "us") collects from you, how we use it, and the choices you have. By using the Service you agree to this Policy. If you do not agree, do not use the Service.

1. Information We Collect

• Email address — when you claim a model or subscribe to drop notifications.
• Identity verification files — a government-issued photo ID and a selfie, submitted for KYC.
• Age attestation — your confirmation that you are 18 or older, with a timestamp.
• Technical data — IP address, browser type, device type, and standard server logs.
• Communications — emails you send to us and our responses.

2. How We Use Your Information

• To verify your identity and age before delivering your claim.
• To send you the model images and playbook PDF you've claimed.
• To send transactional emails (claim received, approved, rejected).
• To detect, prevent, and respond to fraud or abuse.
• To comply with legal obligations, including the TAKE IT DOWN Act.

3. Where Your Data Lives

We process your data through the following service providers:

• Supabase — database and encrypted file storage (US region).
• Vercel — application hosting.
• Resend — transactional email delivery.

All providers are bound by data-processing agreements. We never sell or rent your personal information.

4. KYC File Handling

• Your ID and selfie are stored in a private, access-controlled bucket. They are not publicly accessible and not indexed.
• Approved-claim files are retained for audit and fraud-prevention purposes for up to 24 months, then deleted.
• Rejected-claim files are deleted immediately when the claim is rejected.
• You may request earlier deletion of your verification files at any time by emailing taviralabs@gmail.com.

5. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (subject to legal retention).
• Object to certain processing.
• Lodge a complaint with your data-protection regulator.

To exercise any of these rights, email taviralabs@gmail.com.

6. Children

The Service is for adults 18+ only. We do not knowingly collect information from anyone under 18. If we learn we have collected data from a minor, we will delete it immediately.

7. Security

We use industry-standard encryption in transit (TLS) and at rest. Identity files are stored in a private bucket accessible only to our service-role key. Access is logged. No system is perfectly secure — if you believe your account has been compromised, contact us immediately.

8. International Transfers

Your data is processed in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S.

9. Changes

We may update this Policy from time to time. The "Effective" date above reflects the current version. Material changes will be announced by email or on the Service.

10. Contact

Privacy questions: taviralabs@gmail.com.