Privacy Policy
This policy explains what personal data the NutaChat app processes, why, who receives it, how long we keep it and what your rights are. NutaChat is operated by Revstream LLC, 3A Moskovyan Street, 0002 Yerevan, Republic of Armenia (“we”, “us”), which is responsible for your data. Contact: privacy@nuta.chat.
In short. You can use NutaChat without giving us your name. To make a result, we send your prompt and files to AI providers, only after you allow it. Face and voice data is used only for the feature you request and deleted when you ask, after 90 days without use, or when you delete your account. We do not sell your data, show ads or track you across apps.
1. Data we collect
- Account: a Firebase user ID and our internal ID; if you link one, your Apple, Google, phone number or email sign-in (with Sign in with Apple you can hide your email); language, plan, the usage segment you choose, your country (from IP address or device region); the consents you gave and when.
- Your content: prompts and chat messages, photos, videos, audio and documents you pick (through the system picker, not your whole library), generated results, files you keep, and reports you submit.
- Face and voice data: only if you use “Me in style” or custom voices (see section 3).
- Purchases: product, price, transaction IDs, subscription status and refunds from Apple or Google, and your unit balance. We never receive your card number.
- Device and technical data: an app device ID, Firebase Installation ID, platform and app version, push token (if you allow notifications), IP address, and server logs.
- Usage events: in-app actions such as opening a preset, starting a generation or viewing the paywall, sent to our servers and, for a subset without your user ID, email or phone, to Google Analytics for Firebase with ad features off.
We do not collect your precise location, contacts, health data, browsing history or advertising identifier (IDFA / Android advertising ID), and the app contains no ads.
2. AI providers
NutaChat does not run the generation models itself. When you start a generation or send a chat message, our servers send the prompt, the relevant chat history and the needed files to:
- OpenRouter (OpenRouter, Inc., USA) for chat models and speaking voices. It forwards requests to the model's provider (for example OpenAI, Anthropic, Google, DeepSeek, Alibaba, Mistral, xAI or Fish Audio). We allow only providers that, according to OpenRouter, do not store or train on prompts.
- Kie.ai for images, video, music and speech. It forwards requests to the selected model (for example Google, OpenAI, ByteDance, Black Forest Labs, Kuaishou, MiniMax, Suno or ElevenLabs).
Your permission comes first. Before your first request the app asks you to allow this on a separate screen; our servers refuse AI requests until you do, and you can withdraw consent in Profile. We do not send your name, email, phone or user ID to AI providers, but a prompt or file may itself contain personal data. Files are shared through links that expire in about two hours. Providers may keep content for a limited time under their own terms (Kie.ai keeps generated files for about 14 days); we copy every result to our own storage right away. Providers and model developers may process data outside Armenia and the EU, including in the USA and China, under their terms. We do not use your content, face or voice data to train our own models.
3. Face and voice data (biometric notice)
This is our notice and retention policy for biometric data under laws such as the GDPR and the Illinois (BIPA), Texas and Washington biometric laws.
- Face profiles: from 1 to 5 selfies you upload, we detect the face, check for nudity, make a face crop and compute a numerical face template on our own servers. We use them only to generate images of you and to pick the results that look most like you, never to identify you or for ads. The template never leaves our servers; the face crop is sent to Kie.ai and the Google image model only when you run a “Me in style” generation.
- Custom voices: a recording of about 1–3 minutes. A speaking voice is kept on our servers and sent with each speech request to Fish Audio through OpenRouter. A singing voice is sent to Suno through Kie.ai to create a voice model; we then delete our copies of the recordings. Suno and Kie.ai do not currently let us delete that model, so when you delete the voice we delete its identifier and it can no longer be used from NutaChat.
- Consent: before creating a face profile or voice, you confirm you are 16 or older and give separate consent. Use only your own face or voice, or that of a person who has consented.
- Deletion: we destroy face and voice data when you delete it in the app, when you delete your account, 90 days after its last use, or if processing fails, whichever comes first, and in any case within 3 years of your last use of NutaChat. We never sell or profit from face or voice data.
4. Why we use data
We use data to provide the service (account, generations, chat, storing results, sync), to process purchases, to keep NutaChat safe (moderation, one free grant per device, fraud prevention), to send service notifications and at most two news pushes per week (you can turn notifications off), to fix errors and improve the app, and to comply with law. Under the GDPR our legal bases are the performance of our contract with you, your consent (AI processing and biometric data), our legitimate interests (safety, fraud prevention, analytics) and legal obligations. Automated moderation can reject a request or hide a result; you can ask a person to review it.
5. Who receives data
| Recipient | Purpose | Location |
|---|---|---|
| OpenRouter and the model providers it routes to | Chat and speaking voices | USA and other countries |
| Kie.ai and the model developers it routes to | Images, video, music, speech, face crops, singing voices | Outside Armenia and the EU, under their terms |
| Google (Firebase Authentication, Analytics, Cloud Messaging, Google Play) | Sign-in, analytics, push notifications, Android purchases | USA and other countries |
| Apple | Sign in with Apple, push notifications, App Store purchases | USA |
| Timeweb Cloud | Hosting of our servers, database and file storage | The Netherlands |
We may also disclose data when the law requires it, to report child sexual abuse material, to protect users' safety, or to a successor of our business. We do not sell personal data or share it for advertising.
6. How long we keep data
| Data | Retention |
|---|---|
| Generated results | 30 days on the Free plan, 365 days on paid plans, or until you delete them |
| Uploaded source files | Up to 30 days, unless you keep them in Files |
| Files and chat threads | Until you delete them (deleted chats are purged after 30 days) |
| Face profiles and voices | See section 3 |
| Account data | While the account exists; deleted within 30 days after account deletion |
| Analytics events | Up to 25 months; unlinked from you when the account is deleted |
| Fraud-prevention records (device ID, IP, country) | 400 days |
| Purchase records | As required by tax and accounting law (up to 7 years) |
| Server logs and backups | Logs: a few days; backups: up to 14 days |
7. Your rights
In the app you can delete results, files, chats, face profiles and voices, withdraw AI or biometric consent in Profile, turn off notifications, and delete your account in Profile → Delete account (see Delete account). You can also email privacy@nuta.chat from the email linked to your account. Depending on where you live:
- EU, UK and Switzerland (GDPR): you can access, correct, delete or export your data, object to or restrict processing, withdraw consent at any time, and complain to your data protection authority. We answer within one month.
- USA (California and other states): you can know, access, correct and delete your data. We do not sell or share personal information for targeted advertising, and we do not discriminate against you for using your rights. If we decline a request, you can appeal by replying to us.
- Armenia: you have the rights under the Law “On Protection of Personal Data” and can complain to the Personal Data Protection Agency.
Your data is processed in Armenia, the Netherlands, the USA and other countries where our providers operate; where required, we use standard contractual clauses or your consent for these transfers.
8. Children
NutaChat is not directed to children. You must be at least 13 to use it and 16 to create a face profile or voice. We do not knowingly collect data from children under 13; if you believe a child has given us data, write to privacy@nuta.chat and we will delete it.
9. Security
Data is encrypted in transit. Files are kept in private storage and served through expiring links, backups are encrypted, and staff access is limited and logged. If a breach affects your data, we will notify you and the authorities as the law requires.
10. Changes and contact
We will post changes here and update the date; for material changes we will tell you in the app before they take effect. Contact: Revstream LLC, 3A Moskovyan Street, 0002 Yerevan, Armenia, privacy@nuta.chat.