Privacy Policy

1. Who is responsible

Navaro Ltd (company number 06938486, registered office Highdown House, 11 Highdown Road, Leamington Spa, Warwickshire, CV31 1XT, England) is the data controller for GenDeck. Contact: support@gendeck.io.

2. What we collect

• Account data — your email address and optional display name.
• Your content — canvases, uploads, prompts and the media you generate.
• Usage records — generation history, credit transactions, the referral or campaign code you signed up with, and technical logs (such as IP addresses in server logs) needed to run and secure the service.
• Payment data — handled by Paddle, our payment provider. We never see your card details; we receive confirmation of what was purchased.
• Support messages — emails you send us.

3. Why we use it

To provide the service you asked for (running generations, storing your work, managing credits — contract); to keep the service secure and prevent abuse, and to understand usage so we can improve it (legitimate interests); and to meet legal obligations such as tax record-keeping. We do not sell personal data, and we do not use your content to train AI models.

4. Who processes it for us

• Supabase — database, authentication and media storage.
• Vercel — application hosting.
• AI model providers(kie.ai, and Anthropic for structured “Build” content) — receive your prompts and reference images to perform the generation you requested.
• Resend — sends sign-in and service emails.
• Paddle — payment processing, as merchant of record (Paddle acts as its own controller for the transaction).

Some providers process data outside the UK. Where they do, transfers are protected by recognised safeguards such as adequacy decisions or standard contractual clauses.

5. Cookies

GenDeck sets essential cookies only — the ones that keep you signed in. We set no advertising or cross-site tracking cookies, and if we add product analytics later we will update this policy first. Note that embedded social posts are served by those platforms directly and may set their own cookies — see section 6.

6. Embedded social posts

GenDeck lets you place posts from YouTube, Instagram, TikTok, X and Vimeo onto a canvas. These are embedded live from the platform — we do not copy or store the post or its media.

This means that when a canvas containing an embed is opened — including by anyone viewing a board you have shared publicly — that person’s browser connects directly to the platform concerned. The platform will receive their IP address and request details, and may set its own cookies or use other tracking technologies, exactly as if they had visited the post on that platform. This happens under the platform’s own privacy policy and cookie practices, which we do not control and are not responsible for.

Only these five platforms can be embedded. If you would rather not load third-party content, remove the embed from the canvas — the rest of the board is unaffected.

7. How long we keep things

Account data and your content: for as long as your account exists (delete your account and we delete them, subject to short backup windows). Purchase and credit records: kept as required by UK tax law (generally six years). Server logs: rotated on a short cycle.

8. Your rights

Under UK data-protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict certain processing, and take your data elsewhere. Email support@gendeck.io and we will respond within a month. You can also complain to the Information Commissioner’s Office (ico.org.uk).

9. Changes

If this policy changes materially we will tell you before the change takes effect. The “last updated” date at the top always reflects the current version.