Privacy Policy

1. Data controller

This Privacy Policy complements our Terms of Service and Legal Notices.

The data controller responsible for the processing of your personal data is:

• Trade name: Gencara
• Owner: Evan Navega
• Email: evan.navega@gencara.ai
• Website: https://gencara.ai

Gencara acts as the data controller within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the French Data Protection Act (Loi Informatique et Libertés). For all privacy-related inquiries, please contact us at evan.navega@gencara.ai.

2. Data we collect

We collect and process the following categories of personal data:

Identity & account data

• Name, email address, password (hashed)
• Profile picture (if provided via Google OAuth)
• Account role (user or admin)

Billing & payment data

• Stripe customer ID and subscription ID
• Subscription plan, status, and billing period
• Credit balance and transaction history (amount, type, date)
• Payment card data is processed exclusively by Stripe — Gencara never stores your card information

Usage & generated content data

• Videos, images, and audio generated through the platform
• Prompts, scripts, and settings used for generations
• Avatar configurations and voice settings
• Course progress (modules completed, last module accessed)
• Project data and organization

Technical & session data

• IP address (recorded at session creation only)
• Browser user agent
• Session tokens and expiry dates

Third-party API keys

• Third-party voice synthesis API key (if you choose to provide your own) — stored encrypted using industry-standard authenticated encryption

Pay-per-view payout data (if you participate)

• Screenshots of your platform analytics that you submit as proof of views
• Payout coordinates — your PayPal email, or your IBAN and account holder name — stored encrypted at rest using industry-standard authenticated encryption, and never shown back to you in full
• A record of each withdrawal (amount, method, and a copy of the encrypted coordinates used) is retained after payment to meet our accounting and legal obligations

3. Purposes and legal bases

We process your data for the following purposes, each grounded in a specific legal basis under the GDPR:

4. Recipients and sub-processors

Your data may be accessed by authorized Gencara staff and shared with the following categories of sub-processors, strictly for the purposes described above:

The complete list of sub-processors, including their specific names, is available upon request by emailing evan.navega@gencara.ai.

We do not sell, rent, or trade your personal data to any third party.

5. International data transfers

Some of our sub-processors are located outside the European Economic Area (EEA), particularly in the United States. These transfers are governed by:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• EU-US Data Privacy Framework for certified providers
• Appropriate technical and organizational measures (encryption in transit and at rest, access controls, data minimization)

6. Data retention

When you delete your account, all associated data is permanently removed (including generated content, avatars, projects, and credit history), except for billing data retained under legal obligation.

7. Cookies and tracking

Gencara uses essential cookies required for the Service to function, as well as optional analytics cookies to improve your experience. Analytics cookies are only activated after you give your explicit consent via our cookie banner.

Essential cookies

These cookies are strictly necessary for the Service to operate. They do not require consent under the ePrivacy Directive.

Analytics & marketing cookies (consent required)

The following cookies are set only after you accept analytics via our cookie consent banner. You can change your preference at any time by clearing your browser storage and revisiting the site.

What data is collected by analytics & marketing tools

• Google Analytics (GA4): Pages visited, session duration, referral source, device type, country (IP anonymized). Data retained for 14 months.
• Microsoft Clarity: Session recordings (mouse movements, clicks, scrolls), heatmaps, and interaction patterns. IP addresses are anonymized. Sensitive content is masked. Data retained for 13 months.
• TikTok Pixel & Events API: With your consent, page views, clicks, button interactions, and time spent (plus page content such as meta tags via enhanced data postback) are shared with TikTok (ByteDance) to measure advertising conversions and build campaign audiences; a first-party cookie is set. For completed purchases, and only when you accepted marketing cookies, we additionally send a server-side conversion event containing the purchase amount and a hashed (SHA-256, non-reversible) version of your email, used solely to match the conversion — never your raw email. Automatic Advanced Matching is not enabled, so we do not scan form fields.

We use the TikTok Pixel, a third-party marketing pixel, to measure advertising conversions and reach relevant audiences for our campaigns on TikTok. It is activated only after you accept analytics and marketing cookies via our consent banner. Automatic Advanced Matching (which would scan form fields for personal data such as email or phone number) is not enabled. We never sell your personal data to any third party.

The legal basis for analytics and marketing processing is your consent (GDPR Art. 6.1.a). You may withdraw your consent at any time by clearing your browser local storage for this site. The legal basis for essential cookies is contract performance (GDPR Art. 6.1.b).

8. Security measures

Gencara implements appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit: All data transmitted via HTTPS/TLS
• Encryption at rest: Sensitive data encrypted using industry-standard authenticated encryption
• Password hashing: Passwords hashed using a modern, memory-hard hashing algorithm
• Session security: HttpOnly, Secure, and SameSite cookie attributes
• Payment security: PCI DSS Level 1 certified payment processor — card data never touches our servers
• File storage: Private cloud storage with time-limited signed URLs (no public access)
• Webhook verification: Third-party webhooks verified by cryptographic signature
• Access control: User files accessible only by the account owner

9. Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Gencara will:

• Notify the CNIL within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33
• Notify affected users without undue delay if the breach is likely to result in a high risk, in accordance with GDPR Article 34
• Document the breach, its effects, and the remedial action taken

10. Your rights

Under the GDPR (Articles 15 to 22), you have the following rights regarding your personal data:

• Right of access — Request a copy of the personal data we hold about you
• Right to rectification — Correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — Request deletion of your data. You can delete your account from Settings → Account → Delete Account. This permanently removes all associated data (profile, generated content, avatars, projects, credit history), except billing data retained under legal obligation
• Right to restrict processing — Request temporary or permanent restriction of processing
• Right to data portability — Receive your data in a structured, machine-readable format and transfer it to another provider
• Right to object — Object to processing based on legitimate interest, particularly for marketing purposes
• Right to withdraw consent — Withdraw your consent at any time for processing based on consent, without affecting the lawfulness of prior processing

Post-mortem data directives (French law)

Under Article 85 of the French Loi Informatique et Libertés, you have the right to define general or specific directives regarding the storage, erasure, and communication of your personal data after your death. You may exercise this right by contacting us at evan.navega@gencara.ai.

How to exercise your rights

Send your request to evan.navega@gencara.ai. We may request proof of identity in case of reasonable doubt about the requester's identity. We will respond within one month, which may be extended by two additional months for complex requests, in accordance with GDPR Article 12.

Right to lodge a complaint

If you believe that our processing of your data violates the GDPR, you have the right to lodge a complaint with the French data protection authority:

• CNIL (Commission Nationale de l'Informatique et des Libertés)
• Website: www.cnil.fr
• Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

11. Marketing communications

Gencara does not send marketing or promotional emails. All emails we send are transactional in nature (account creation confirmations, password resets, billing notifications, generation completion alerts). We do not operate a newsletter or mailing list.

If this changes in the future, we will update this policy and obtain your explicit consent before sending any marketing communications. You will always have the ability to opt out.

12. Automated decision-making

Gencara does not use automated decision-making or profiling that produces legal effects or significantly affects you. AI generation features produce content based on your prompts and settings but do not involve decisions about your account, access, or rights.

13. Children's data

The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you become aware that a child under 16 has provided us with personal data, please contact us at evan.navega@gencara.ai and we will promptly delete such data.

14. California residents

If you are a California resident, please note that Gencara does not sell, share, or rent personal information as defined under the California Consumer Privacy Act (CCPA/CPRA). The data subject rights described in Section 10 above are available to all users regardless of location.

15. Changes to this policy

Gencara may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. In the event of a substantial change, we will notify you by email or via a notice on the platform at least 30 days before the change takes effect.

16. Contact

For any questions about this Privacy Policy or to exercise your data protection rights:

• Email: evan.navega@gencara.ai