Privacy Notice

Last updated: 27 October 2026 · Issued under Malaysia's Personal Data Protection Act 2010 (PDPA)

Treelion Enterprise ("we") runs Kravitas. This notice explains what personal data we process and why.

What we collect

Guest account data: a random account ID created by our authentication provider (Supabase), plus technical data such as IP address and browser information.
Your uploads: photos of people ("friends"), product photos and details, prompts and scripts you type.
Creations: images, videos and audio generated for you, and their settings.
Payments: the pack bought, amount and Stripe session ID. Card and bank details are handled by Stripe; we never see them.
Credit activity: a record of credits added and used.

Why we use it

To run the Service (generate your content, store your library and credits), process payments, prevent abuse and fraud, provide support, and meet legal obligations.

Faces and biometric-like data

Photos of faces are used only as references to generate content you ask for. We do not use them to identify people or build face databases, and we do not sell them. Only upload faces you have permission to use.

Who we share it with

fal.ai and the AI model providers it routes to, to generate content.
Supabase (database, file storage, authentication) and Railway (hosting).
Stripe for payments.

Some of these providers process data outside Malaysia. Generated media is stored at long, unguessable public links so the AI providers can read it; anyone with the exact link can open the file.

How long we keep it

Until you delete it in the app, or for as long as your account is active. Deleting a creation deletes its files. Payment and credit records are kept as long as required for accounting and tax.

Your rights

Under the PDPA you may request access to or correction of your personal data, or ask us to stop processing it. Contact us with your Account ID and we will respond within 21 days.