Privacy Policy

Last updated: September 24, 2026

Mavilo ("we", "us") makes your writing into visual stories you can export as PDFs. This policy explains what we collect, why, and what you can do about it. It applies to getmavilo.com and every page and service that links to it.

1. What we collect

• Account details — when you sign in with Google, we receive your name, email address, and profile photo. We use Google Sign-In and never see or store your Google password.
• Content you create — the articles, notes, and prompts you paste in, plus the stories you build from them, are stored on our servers so you can return to them.
• Usage information — we count generations and exports per account to enforce free-tier limits, and we track basic, aggregated events (when a page opened, when a generation started or finished, when an export happened) to understand how the product is used.
• Technical data — server logs and standard web analytics may include your IP address, browser type, referring page, and rough location. We do not sell or enrich this.

2. How we use it

• To run the service: sign you in, store and sync your stories, generate and export your decks.
• To enforce limits and prevent abuse of the free beta.
• To improve the product and diagnose errors using aggregate analytics.
• To contact you about your account (we will not email you marketing unless you opt in).

3. AI processing

Stories are planned with an AI model (OpenAI). The text you provide is sent to that model to generate a story structure, outline, and slide text. We do not use your content to train models, and generated output is yours.

4. What we do NOT do

• We do not sell your personal data.
• We do not use your content for advertising.
• We do not read your private stories unless you share them with us (e.g. for support).

5. Storage, security, and retention

Stories and account data are stored in databases managed by our hosting provider (Render). Your session is an encrypted, signed cookie — we store no session database on the server. Access to the service is protected by standard security practices, and the OpenAI key is stored only in environment variables, never in the browser.

We keep your stories until you delete them or your account is closed. You can delete any story from your dashboard; the deletion is permanent.

6. Third parties

• Google — authentication (what you share is controlled by Google's consent screen).
• OpenAI — receives article/prompt text solely to generate story plans.
• Render — hosts the application, database, and logs.
• Google Fonts — serves typefaces; see Google's privacy policy.

7. Cookies

We use one essential cookie (`mavilo_session`) to keep you signed in. It is HttpOnly and SameSite=Lax. We do not use third-party advertising or tracking cookies.

8. Your rights

Depending on where you live (including under GDPR and similar laws), you may have the right to access, correct, export, or delete your data, and to withdraw consent. To exercise any of these, email vignesh@getmavilo.com and we'll respond within 30 days.

9. Children

Mavilo is not directed at children under 13 (or the applicable minimum age in your country) and we do not knowingly collect their data. Contact us if you believe a child has provided us data.

10. Changes

If we change this policy materially, we'll update the date above and, where required, notify you by email. Continued use after changes constitutes acceptance.

11. Contact

For privacy questions: vignesh@getmavilo.com · Mavilo, getmavilo.com