1. Controller and contact
PKL Labs operates Datlivo and is the data controller. Send access, correction, deletion, restriction, account deletion, or incident inquiries to [email protected]. Minimal identity or authority verification may be required.
2. Information processed
- Account data: Google provider ID, email, name or nickname, profile image URL, provider, and login and account timestamps
- Security and usage data: session cookies, anonymous visitor ID, IP address, user agent, request, error, audit, access, and feature-use logs
- Files and analysis: filenames, formats, MIME types, sizes, file contents, selected sheets, settings, statistics, findings, questions, and outputs
- Projects: type, title, stored content, size, format, favorite status, version, and creation, update, access, and deletion timestamps
- AI data: prompts, reference images, generation settings, provider task IDs and status, results, and credit consumption or restoration records
- Billing data: Paddle customer, subscription, transaction, product and price IDs; status, cycle, amount, currency, tax, discount, and event timestamps. Datlivo does not store card numbers or CVCs.
- Support data: email, message, attachments, and handling history
3. Sources and purposes
Information is provided or generated through Google sign-in, uploads, project storage, tool and AI execution, Paddle checkout and webhooks, and support. It is used for authentication, processing and delivering results, synchronization, credits and subscriptions, fraud prevention, troubleshooting, disputes, and legal obligations.
If files contain third-party personal data, you are responsible for a lawful basis, authority, and data minimization.
4. Retention and deletion
- Account and project data is kept while the account is used. After an account deletion request, it remains for a seven-day cancellation period and is then deleted subject to operational, security, backup, and legal retention needs.
- Inputs for ordinary server file tools are deleted after processing, and download results after download or operational cleanup. Analysis files and records may remain for the lifecycle needed to deliver and recover the analysis.
- Browser-only files are not sent to Datlivo. Drafts and task state in localStorage, sessionStorage, or IndexedDB may remain until the browser or feature clears them.
- The anonymous visitor cookie may persist for up to 400 days.
- Transaction and supply records may be retained for 5 years, complaints and disputes for 3 years, and advertising records for 6 months as required by Korean law.
5. Processors and international transfers
- Google processes identity information for sign-in.
- Paddle and entities shown on the transaction process checkout data, identifiers, amounts, taxes, receipts, and refunds across their applicable processing locations.
- Gabia AI Hub and connected model providers may process prompts, limited file or document context, and settings needed for AI image generation or explanations.
- BytePlus Seedance may process prompts, reference images, generation settings, task status, and outputs on overseas infrastructure for AI video generation.
- Information directly collected by providers is governed by their policies. Datlivo limits transfers to what is needed for the requested feature.
6. AI and automated decisions
AI execution may send prompts, reference files, limited document context, and settings to an external model. Do not submit passwords, payment data, sensitive information, or unnecessary third-party data.
AI outputs assist creation and explanation and are not used for fully automated decisions with legal or similarly significant effects. Datlivo does not use private files or projects to train its own general-purpose foundation model or sell data products without separate consent.
7. Cookies, browser storage, and rights
Essential session cookies maintain login and security; an anonymous visitor cookie may distinguish free-feature usage. Browser storage may hold return paths, recent AI task state, video drafts, and editing data. Blocking essential cookies can prevent login or server features.
Subject to applicable law, you may request access, a copy, correction, deletion, restriction, withdrawal, or objection. Projects can be deleted in the service; signed-in users can schedule account deletion for seven days later and cancel before the deadline on the Delete Account page. Broader privacy requests go through support.
8. Security, children, and changes
Datlivo uses transport encryption, HttpOnly session cookies, access controls, webhook verification, file validation, secret separation, and security logging. The service is not directed to children under 14.
Material changes to data, purpose, processors, transfers, retention, or rights are generally announced 30 days in advance, with separate consent where required.