Feedova Privacy Policy

Last updated: 22 October 2026

This policy explains how Feedova processes the personal data of people who visit its website, use its application, its browser extension and its emails, or whose public content is analyzed. It applies worldwide; section 15 explains what changes depending on your region.

1. Who we are

Feedova is provided by Nabta LLC, a limited liability company organized under the laws of the State of Wyoming (United States), entity number 2026-002022285, 30 N Gould St Ste R, Sheridan, WY 82801, United States ("Feedova", "we", "us").

Contact for your data: privacy@feedova.ai
Representative in the European Union (GDPR Article 27): appointment in progress. In the meantime, write to privacy@feedova.ai. The representative's contact details will be published here and in the legal notice.
Representative in the United Kingdom (UK GDPR Article 27): appointment in progress; same address in the meantime.
Data protection officer: we have not appointed one, as this is not mandatory for our business at this time.

2. Controller or processor

We are the controller for account, security, billing, support, direct marketing and website data, for the improvement of our models and services (section 5), and for the public data we collect on our own behalf.
We are a processor when we process, on behalf of a customer brand, the data contained in its content (for example reviews and messages from its customers, photos of its models, data from its campaigns) or data we collect at its request. The brand is then the controller and our data processing agreement (DPA) applies. If you are a customer of a brand that uses Feedova, please contact that brand first; if your request reaches us, we will forward it to the brand.
Stripe is an independent controller for payment and Link account data: it sells and collects our payments as merchant of record. See section 7.

3. The data we process, why, on what basis, and for how long

Data	Source	Purpose	Legal basis (GDPR)	Retention period
Account: first name, last name, email address, password (stored as an irreversible hash), company, role, brands, language, profile picture if you add one	you, or the person who invites you	create and manage your account, sign you in, manage access	performance of the contract (Art. 6(1)(b)); the customer's legitimate interest in managing its team (Art. 6(1)(f))	life of the account, then deletion within 90 days after the account is closed
Acceptance of terms: date, version accepted	you	prove what you accepted	legal obligation and legitimate interest (evidence)	life of the account, then 5 years
Sign-in with Google: Google identifier, name, email address	Google, with your authorization	sign you in without a password	performance of the contract	same as the account
Connected devices and security: IP address and browser of each session, sign-in dates, sign-in attempts	your device	let you see and sign out your devices, block attacks, prevent fraud	legitimate interest (security)	sessions: up to 30 days after they expire; sign-in attempts: kept in memory, for no more than one hour
Service emails: confirmation, password reset and invitation links, email address of invited persons	you, our servers	confirm an email address, reset a password, invite a member	performance of the contract; legitimate interest of the inviting customer	links: 48 hours, 1 hour or 7 days depending on the case, then deleted no later than 30 days afterward; invitation: until it is accepted or expires
Billing: name or company name, address, country, status (business or consumer), VAT number or other tax number, history of payments and credits. After a payment, Stripe sends us: name, email, billing address, country, status (business or individual), tax number if you entered one, card brand and last 4 digits, card fingerprint (an identifier calculated by Stripe that shows whether two accounts use the same card, without revealing its number), amounts, subscription status. The full card number is kept by Stripe, never by us	you, Stripe	manage the subscription, credits and refunds, keep accounting records, handle withdrawals, apply promo codes and referrals (the card fingerprint is used to detect self-referrals)	performance of the contract; legal obligations (Art. 6(1)(c)); legitimate interest (preventing referral fraud)	period required by applicable tax and accounting laws, up to 10 years
Operation of the service: actions launched, credits consumed, costs	your use	operate the service, display and count credits, cap spending	performance of the contract; legitimate interest	credit log: same as billing; cost log: life of the account
Use of the service: screens viewed and time spent on each screen and tab (only while the page is displayed and you are using it), features opened, errors displayed, actions launched (type, duration, success or failure, credits, AI provider), sign-ins, creatives kept or discarded when sorting, downloads, exports, ad launches, feedback sent (its type, never its text), plan changes, top-ups, origin of the sign-up (early access, referral, code), linked to your account, your role, your Organization, its Brand, its plan and its niche. Never the content of your creations, texts, prompts, images or messages. No third-party tool: everything is recorded on our servers, without any cookie or additional identifier	your use, our servers	understand how Feedova is used, spot what gets in the way and what helps, improve the product, support and our offers	legitimate interest (art. 6.1.f), with a right to object: Settings › Privacy, "Do not measure my usage" (nothing is measured any more, and what was recorded is no longer linked to your account)	25 months in detail, then only monthly totals, with no account, Organization or Brand
Reason for leaving: the reason you choose when you cancel and the text you add, both optional	you	understand why customers leave, improve the service	legitimate interest	25 months, then only the number of departures per reason and per month
Technical logs of the hosting provider	our servers	security, diagnostics	legitimate interest	according to the hosting provider's retention period, no more than 12 months
Support and feedback: your messages ("Something wrong, an idea?", emails), page concerned, attached files	you	reply to you, fix, improve	legitimate interest; performance of the contract	3 years after the last exchange
Integrations: access tokens for Google Drive, Meta, Slack or your store; identifiers of the connected accounts	you, these services, with your authorization	operate the features you use	performance of the contract	until the service is disconnected or the account is closed
Direct marketing and free audit: name, email address, company, website, answers	you	send the audit you requested, present our offers to you	carrying out your request; legitimate interest between businesses; consent where required by law (Art. 6(1)(a))	3 years after the last contact
Browser: cookies and local storage	your browser	see the Cookie Policy	see the Cookie Policy	see the Cookie Policy
Browser extension (if you install it): settings, brand, sign-in token, items you choose to send (media, colors, fonts, screenshots, audio from a video)	you	send to your brand what you spot while browsing	performance of the contract	in the extension, until it is uninstalled; in Feedova, same as your content
Public data collected on our own behalf: text of ads, public reviews and discussions, names of advertiser pages; authors' names and usernames are deleted or pseudonymized at the time of collection	public websites, ad libraries, data collection providers	market monitoring and benchmarks (formats, angles) to improve the service	legitimate interest, with the safeguards recommended by the CNIL for automated collection	12 months, then only in aggregated form
Improvement of our models and services	customers' content, outputs and usage	see section 5	legitimate interest, with a right to object	see section 5

We do not make any decision based solely on automated processing that would produce legal effects concerning you or significantly affect you. Feedova's recommendations concern creatives and campaigns, not people.

4. Brand content

When you import into Feedova content that concerns other people (reviews and messages from your customers, photos and videos of models, voice recordings, data from your campaigns), we process it on your behalf, in accordance with the DPA. It stays within your Organization and within the Brand concerned; other customers never see it. You can delete it whenever you want; it is deleted at the end of the contract within the time limits set out in the Terms of Sale (export available for 30 days, then deletion within the following 90 days, with backups erased according to their cycle).

This content is not used to measure the use of the service (section 3): we do not read it to draw lessons about your market or other customers' markets, except in aggregated form, after personal data has been removed or pseudonymised, under section 5 and with the right to object it provides.

5. Improvement of our models and services

What we may do. We may use customers' content and outputs, and the way customers use the service (what they keep, discard or comment on), to improve our models, our generation rules and our services, including to train or fine-tune artificial intelligence models used by Feedova. We do not sell this data and we do not show it to other customers.

Current status. As of the date of this policy, no model is trained on customer content. Before the first training, we will put in place the safeguards below and announce it in the service.

Safeguards.

Before this use, we remove personal data or replace it with pseudonyms, to the extent reasonably possible: names, usernames, email addresses, order numbers and other identifiers in reviews and messages, and file metadata.
We do not use for this purpose the face, body or voice of an identifiable real person, except with that person's consent, nor sensitive data or children's data.
Access to this data is limited to the people and systems that need it; it is not used to make decisions about individuals.
We apply filters so that a model does not output its training data (the so-called "regurgitation" risk), and you can report to us any output that reproduces personal data.

Legal basis. Our legitimate interest in improving the quality, security and relevance of the service (GDPR Article 6(1)(f)). We have carried out the balancing test this basis requires, following the three-step method of the European Data Protection Board (EDPB Opinion 28/2024 on AI models): the interest is real and specific, the use is necessary to improve models suited to brands, and the safeguards above, together with the right to object, limit the impact on individuals. For content we process as a processor, the customer authorizes this use in the contract (Terms of Use, Article 4.3, and DPA), and we then act as controller for this purpose. Where the law requires consent (for example for the voice or image of a real person), we ask for it, or we do not use the data.

Your rights and their limits.

You may object to this use at any time, without having to give reasons and without your use of the service depending on it, by writing to privacy@feedova.ai. A customer may also refuse it for its entire Organization (Terms of Use, Article 4.3.3); an option will be added in Settings, and the refusal is contractually guaranteed for Enterprise accounts. Since we will announce the first training in advance, you can object before it begins.
An objection applies going forward. A model that has already been trained cannot always "forget" a piece of data; we stop using it for subsequent training.
These measures greatly reduce the risks, but no method is perfect: we do not claim that this data or the resulting models are anonymous, or that no information can ever be retrieved. That is why we exclude faces, voices and sensitive data. If a problem is confirmed, we can remove data from the training set and take this into account at the next retraining.

6. Artificial intelligence and providers

6.1 To produce what you request, we send the necessary content (text, reference images, instructions, voices) to artificial intelligence model providers. They act as our processors, within the limits set out below.

6.2 Some providers state in their public terms that they may use the data they receive to train or improve their own models. This is the case for Higgsfield, which currently produces Feedova's realistic photos and videos, and for HeyGen and ElevenLabs, which are being activated. Others, such as kie.ai (planned for generating images and, as a fallback, videos, when this service is activated; it may then receive images that show people), are vague on this point. No data processing agreement has been signed to date with Higgsfield or with kie.ai. Anthropic and Google (paid tier of the Gemini API) state that they do not train their models on data received through their API. The list of subprocessors shows, for each one, what it receives and what its policy says. We are seeking to obtain from each of them terms that exclude this use, and we update the list whenever there is a change.

6.3 If you do not want an image or a voice to be sent to a provider that may use it for its models, do not use with it the features that rely on that provider (indicated in the list), or write to us at privacy@feedova.ai to discuss it beforehand.

6.4 Generated files will carry machine-readable markings indicating that they are generated by artificial intelligence (see the AI Transparency page).

7. Who receives your data

Our processors: hosting, domain name and protection, emails, error tracking, payment, artificial intelligence models. The up-to-date list gives the role, location and transfer safeguard of each one.
Stripe, merchant of record for our payments (Sold through Link, LLC), and the Stripe group companies that process payments (Stripe Payments Company, Stripe Technology Europe, Limited, Stripe Payments Canada, Ltd., Stripe Payments Singapore Pte. Ltd., Stripe Payments Australia Pty Ltd.). You give your payment information directly to Stripe, on its checkout page. Stripe processes it on its own behalf, as an independent controller (payment, taxes, receipts and invoices, Link account, payment support, refunds, disputes, fraud prevention, financial obligations), under its privacy policy. You can ask Stripe to delete your transaction data; Stripe then cancels the subscriptions sold through it, including your Feedova subscription.
The services you connect (Google, Meta, Slack, your store), when you ask us to act on them.
The members of your Organization, according to the access the Owner grants them.
Our support team, only when necessary, with read-only access that is time-limited, justified and logged.
Our advisers (lawyers, accountants) and the authorities, when required by law or to defend our rights.
An acquirer, in the event of a merger, acquisition or sale of all or part of the business, after notice to you.

We do not sell your personal data and we do not share it for targeted advertising.

8. Transfers outside your country

8.1 Feedova is provided by a US company. Our servers are in the European Union (Frankfurt, Germany), but we access them from outside the European Union, and several of our providers are in the United States.

8.2 Depending on the case, these transfers are governed by the European Commission's adequacy decision for US companies certified under the EU-US Data Privacy Framework; by the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914); for the United Kingdom, by the UK Extension to that framework or the UK Addendum to the standard contractual clauses; and for Switzerland, by the Swiss-US Data Privacy Framework or the standard contractual clauses as adapted for Switzerland. You may ask us for a copy of the applicable safeguards.

9. Security

We protect data with appropriate measures: encryption of communications (HTTPS), a protected session cookie (unreadable by scripts, limited to our site), sessions that can be revoked device by device, passwords stored as irreversible hashes, limits on sign-in attempts, separation of data by Organization and by Brand, role-based access rights enforced by our servers, read-only and logged support access, hosting in the European Union, and no library or tracker loaded from a third-party site. Two-factor authentication is not yet available. No system is perfectly secure: in the event of a data breach presenting a risk, we notify the authorities and the individuals concerned as required by law, and customers as provided in the DPA.

10. Your rights

Depending on the law that applies to you, you may request access to your data, its rectification, its erasure, the restriction of its processing and its portability; object to processing based on our legitimate interest or to direct marketing; and withdraw your consent at any time. The rights specific to each region are detailed in section 15.

How to exercise them. Write to privacy@feedova.ai, preferably from your account's email address. You can already change your name, your password and your email address, sign out your devices and object to the measurement of your usage (Privacy), in Settings. Self-service account deletion and data export are not yet available: in the meantime, we carry them out at your request, within the legal time limits. We may ask you to prove your identity. We respond within one month (which may be extended by two months if the request is complex, in which case we will tell you).

11. If you are the author of public content analyzed by Feedova

Feedova analyzes public content (reviews, discussions, ads) to help brands understand their market. We delete or pseudonymize authors' names and identifiers at the time of collection, we do not try to identify or contact you, and we exclude sites that clearly refuse automated collection. You may object to this processing by writing to privacy@feedova.ai, with the link to the content concerned.

12. Data received from Google and Meta

12.1 Google. Feedova's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use data from your Google Drive only for the features you use in Feedova (importing, organizing and exporting your photos and videos). We do not sell it, we do not use it for advertising, and we do not use it to train generalized artificial intelligence models.

12.2 Meta. We use the data received from Meta (results of your ads, information about your ad account and your pages) only for the features you use in Feedova. To have it deleted, disconnect Meta in Feedova or write to privacy@feedova.ai; we delete it within 30 days.

13. Minors

Feedova is reserved for persons aged 18 and over. We do not knowingly collect children's data. If you believe that a minor has provided us with data, write to us: we will delete it.

14. Consumers and businesses

Feedova is open to businesses and consumers. The rules of this policy apply in the same way to both; consumers also have the rights granted to them by consumer law, described in the Terms of Sale.

15. What changes depending on your region

15.1 European Union, European Economic Area and Switzerland

The legal bases are set out in sections 3 and 5. Where we rely on our legitimate interest, you may ask us how we balanced it against your rights.
You have the rights set out in GDPR Articles 15 to 22. In France, you may also give instructions on what happens to your data after your death.
You may lodge a complaint with the data protection authority of your country (in France: the CNIL, www.cnil.fr).
Switzerland: the Federal Act on Data Protection (FADP) applies; you may refer a matter to the Federal Data Protection and Information Commissioner (FDPIC). We have not appointed a representative in Switzerland, as the obligation applies only to processing that is high-risk, regular and large-scale.

15.2 United Kingdom

The UK GDPR and the Data Protection Act 2018 apply. You have the same rights as in 15.1 and may lodge a complaint with the Information Commissioner's Office (ico.org.uk).

15.3 United States

Several states (including California, Virginia, Colorado, Connecticut, Utah, Texas and Oregon) grant rights to their residents. Some of these laws apply only above revenue or data volume thresholds. We nevertheless apply the following principles to all residents of the United States:

Categories of personal information collected in the last 12 months: identifiers (name, email address, IP address); commercial information (subscriptions, credit purchases); internet or other electronic network activity information (use of the service, logs); professional information (company, role); audio or visual information you provide (profile picture, voice or image for an avatar); account log-in credentials (sensitive personal information under California law, used only to sign you in).
Sources, purposes and recipients: sections 3, 5 and 7.
We do not sell your personal information and we do not "share" it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not use sensitive personal information to infer characteristics about you.
Your rights (depending on your state): to know what personal information we hold and to access it, to correct it, to delete it, to receive it in a portable format, to opt out of its sale, its sharing or certain profiling, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. An authorized agent may act on your behalf with your written authorization. If we deny your request, you may appeal by replying to our denial; if the appeal is denied, you may contact the Attorney General of your state.

15.4 Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial laws apply. You may access your personal information, have it corrected, and withdraw your consent subject to legal and contractual obligations, and you may file a complaint with the Office of the Privacy Commissioner of Canada. Your personal information may be processed outside Canada, where the authorities may access it in accordance with local law.

15.5 Brazil

The Brazilian General Data Protection Law (LGPD) applies. You have the rights set out in its Article 18 (confirmation and access, correction, anonymization or deletion of unnecessary data, portability, information about sharing, withdrawal of consent) and may file a complaint with the National Data Protection Authority (ANPD). Contact: privacy@feedova.ai.

15.6 Other countries

We apply this policy everywhere. If the law of your country gives you other rights, write to us at privacy@feedova.ai.

16. Changes

We may change this policy. In the event of a significant change, we will notify you by email or in the application before it takes effect. The date of the last update appears at the top of the page.

17. Language and contact

This policy is available in French and in English. For persons established or resident in France, the French version prevails; for all others, the English version prevails.

Contact: privacy@feedova.ai · Nabta LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States.