Privacy Policy
This statement describes the nature, scope and purpose of processing personal data in our service Kova pursuant to Art. 13 and 14 GDPR.
1. Controller
Alessio Marini
Schobersmühlenweg 4
99089 Erfurt
datenschutz@kova.video
2. Your Rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). You can export your data and delete your account directly in your profile. Complaints can be filed with your competent supervisory authority.
3. Processing and legal bases
We process account data (email, name, avatar) to perform the contract (Art. 6(1)(b) GDPR), payment data to handle billing, and technical log data (IP hash, browser) on the basis of our legitimate interest in security and operations (Art. 6(1)(f) GDPR).
4. Services and recipients
| Service | Purpose | Country | Legal basis |
|---|---|---|---|
| Supabase | Auth, database, storage | USA/EU | Art. 6(1)(b) + SCC |
| Stripe | Payments, invoicing | USA | Art. 6(1)(b), EU-US DPF |
| Vercel | Hosting, delivery | USA | Art. 6(1)(f), EU-US DPF |
| OpenAI | AI generation (text, images) | USA | Art. 6(1)(b), SCC |
| ElevenLabs | Text-to-speech | USA | Art. 6(1)(b), SCC |
| Google (OAuth) | OAuth login | USA | Art. 6(1)(a) |
| YouTube API | Upload feature | USA | Art. 6(1)(b) |
5. Retention periods
Generated videos are deleted immediately upon account cancellation. Account metadata (email, name, avatar) is anonymized 6 months after cancellation. Invoice data is kept for 10 years in accordance with § 147 AO.
6. International data transfers
Some services process data in the USA. Transfers occur under the EU-US Data Privacy Framework (Vercel, Stripe) or EU Standard Contractual Clauses (Supabase, OpenAI, ElevenLabs).
7. AI-assisted processing
To generate your videos, your input is sent to OpenAI and ElevenLabs. They process it to generate responses and store it according to their own policies. Generated outputs are labelled as AI-produced (EU AI Act Art. 50).
8. Cookies
Kova uses only strictly necessary cookies for the auth session. No analytics, tracking or advertising cookies are used. Legal basis: § 25 (2) no. 2 TDDDG.
Last updated: 2026-04-15