Privacy Policy

Avatar Flow

Effective date: July 12, 2026

Avatar Flow creates image avatars, animated social logos, and video avatars from images you submit. This Privacy Policy explains what information we process, why we process it, how generation files are handled, and the choices available to you.

1. Controller and scope

This policy applies to the Avatar Flow mobile application, our API, and these legal pages. Avatar Flow is operated by GREEN VIREO LLC, a Wyoming limited liability company (Wyoming File ID 2024-001555850), with a principal address at 1021 E Lincolnway Unit #915, Cheyenne, WY 82001, USA. In this policy, “Avatar Flow,” “we,” “us,” and “our” mean GREEN VIREO LLC.

2. Information we process

Account information: your email address, password hash when you use email sign-in, and identifiers supplied by Google or Apple when you use social sign-in. Before an email/password account is created, we temporarily process the requested email address, a password hash, and a hashed verification code to confirm ownership of the email. If you delete an account, we retain one-way HMAC security identifiers derived from the account email and social sign-in identifiers to prevent repeated free-credit abuse; these identifiers cannot be used by Avatar Flow to recover the original values.
Source images: images you choose from your library or capture with the camera for a requested generation.
Generation settings: selected output type, styles, strength, format, and related request data.
Generated files: avatar images, animated social logos, and video outputs, together with the metadata required to display and download them from your private history.
Billing information: product identifiers, transaction identifiers, purchase tokens or signed store transaction data, entitlement status, and credit balances. We do not receive or store your full payment card number.
Service data: push notification tokens when you enable notifications, IP-based security and rate-limit data, and technical logs needed to secure and operate the service.
Support information: messages and screenshots you voluntarily send through in-app support.

3. Why we process it

To create, deliver, download, and share the generation you request.
To authenticate you, maintain account access, and prevent account abuse.
To maintain your private generation history and process deletion requests.
To verify Apple App Store and Google Play purchases, manage subscriptions and credit add-ons, and prevent duplicate or fraudulent entitlement grants.
To send generation-complete, generation-failed, and account notifications where you have allowed them.
To investigate support requests, improve reliability, and comply with applicable legal obligations.

4. Legal bases for processing

Where applicable privacy law requires a legal basis, we process your information to perform our contract with you, to comply with legal obligations, with your consent where required, and for our legitimate interests in securing, operating, improving, and protecting Avatar Flow. You can withdraw a consent-based permission, such as camera, photo library, or push notification permission, through your device settings. Withdrawal does not affect processing that occurred before it.

5. Source images and generated files

Source images are stored in private object storage and used to perform the generation you request. The source image remains available in your generation history together with the generated result until you delete that generation or your account.

Generated results are kept in private object storage so that you can access them in your history, download them, or share them from the app. They are not publicly listed or served through public object-storage links. Access is authorized by your Avatar Flow account. Deleting a generation deletes its associated stored output files. Deleting an account deletes the stored generation files associated with that account.

6. AI and infrastructure providers

To perform the service, we use service providers that process information on our behalf, including OpenAI for requested image generation, Amazon Web Services for private object storage, Mailgun for transactional verification emails, Apple and Google for authentication and in-app purchase verification, and Expo for push notification delivery. These providers process only the information needed for the relevant service. Provider processing may occur in countries other than the one where you live.

7. Payments and subscriptions

Purchases are processed by Apple App Store or Google Play. We use store transaction information to verify your purchase and activate the associated subscription or credit add-on. Subscription credits are refreshed for the active billing period. Separately purchased add-on credits are tracked independently from subscription credits. Subscription management, cancellation, and refund requests are handled through the applicable app store and remain subject to that store’s rules.

8. Sharing, international transfers, and no sale

We do not sell your personal information or source images, and we do not share them for cross-context behavioral advertising. We disclose information only to service providers described in this policy, when needed to protect the service or users, to comply with law or a valid legal request, or as part of a corporate transaction involving Avatar Flow. We do not use your source images to create generations for other users or to train an Avatar Flow model.

Our providers may process information in the United States and other countries. Where required, we use contractual, organizational, or technical safeguards intended to protect data transferred internationally.

9. Retention

Source images and generated results are deleted when you delete the associated generation or your account.
Pending email-registration verification records are deleted after successful verification and expire after 15 minutes.
Generated files and generation metadata remain in your account history until you delete the generation or delete the account.
Account, security, support, and technical records are retained only as long as reasonably necessary to operate, protect, troubleshoot, and enforce the service, unless a longer period is required or permitted by law.
One-way account-abuse security identifiers created after account deletion are retained for five years to prevent repeated free-credit abuse.
We may retain limited purchase, tax, and fraud-prevention records where required to meet legal, accounting, dispute-resolution, or app-store obligations.

10. Security

We use measures intended to protect account data and generation files, including authenticated access controls, private object storage, and server-side payment verification. No online service can guarantee absolute security. Keep your device and account credentials secure and notify us through in-app support if you believe your account has been accessed without authorization.

11. Your choices and rights

You can delete an individual generation from its history.
You can delete your account from the app. This removes the application account and associated generation files; store-managed purchase records remain governed by Apple or Google. To protect the service from repeated free-credit abuse, a deleted email address or Google or Apple sign-in identity cannot be used to create another Avatar Flow account during the security-retention period described above.
You can disable push notifications through your device settings.
You can contact us through in-app support to request access, correction, deletion, or other privacy assistance available under applicable law.

Do not submit images of another person unless you have their permission and the right to use the image for this purpose.

12. Children

Avatar Flow is not directed to children. Do not use the service or submit another person’s image where you do not have the legal capacity or consent required to do so. If you believe a child has provided personal information without appropriate consent, contact us through in-app support so we can investigate and take appropriate action.

13. Changes to this policy

We may update this policy when the service, providers, or legal requirements change. We will publish the revised version here and update the effective date. Material changes may also be communicated in the app.

14. Contact and privacy requests

For privacy questions or requests, use the Support option in the Avatar Flow app and include the email address associated with your account. You may also write to GREEN VIREO LLC at 1021 E Lincolnway Unit #915, Cheyenne, WY 82001, USA. We may need to verify your identity before acting on a request. You may have the right to complain to a relevant data-protection authority where applicable law provides that right.