Privacy Policy

1. Who is responsible

Navaro Ltd (company number 06938486, registered office Highdown House, 11 Highdown Road, Leamington Spa, Warwickshire, CV31 1XT, England) is the data controller for GenDeck. Contact: support@gendeck.io.

2. What we collect

• Account data — your email address and optional display name.
• Your content — canvases, uploads, prompts and the media you generate.
• Usage records — generation history, credit transactions, the referral or campaign code you signed up with, and technical logs (such as IP addresses in server logs) needed to run and secure the service.
• Payment data — handled by Paddle, our payment provider. We never see your card details; we receive confirmation of what was purchased.
• Support messages — emails you send us.

3. Why we use it

To provide the service you asked for (running generations, storing your work, managing credits — contract); to keep the service secure and prevent abuse, and to understand usage so we can improve it (legitimate interests); and to meet legal obligations such as tax record-keeping. We do not sell personal data, and we do not use your content to train AI models.

4. Who processes it for us

• Supabase — database, authentication and media storage.
• Vercel — application hosting.
• AI model providers(kie.ai, and Anthropic for structured “Build” content) — receive your prompts and reference images to perform the generation you requested.
• Resend — sends sign-in and service emails.
• Paddle — payment processing, as merchant of record (Paddle acts as its own controller for the transaction).

Some providers process data outside the UK. Where they do, transfers are protected by recognised safeguards such as adequacy decisions or standard contractual clauses.

5. Cookies

GenDeck uses essential cookies only — the ones that keep you signed in. There are no advertising or cross-site tracking cookies. If we add product analytics later, we will update this policy first.

6. How long we keep things

Account data and your content: for as long as your account exists (delete your account and we delete them, subject to short backup windows). Purchase and credit records: kept as required by UK tax law (generally six years). Server logs: rotated on a short cycle.

7. Your rights

Under UK data-protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict certain processing, and take your data elsewhere. Email support@gendeck.io and we will respond within a month. You can also complain to the Information Commissioner’s Office (ico.org.uk).

8. Changes

If this policy changes materially we will tell you before the change takes effect. The “last updated” date at the top always reflects the current version.