Privacy Policy

This Privacy Policy explains how PT Evora Vera Teknologi, a company incorporated in Indonesia and the operator of the Hugogen platform ("Hugogen", "we", "our", or "us"), collects, uses, discloses, retains, and protects information when you access or use our websites, applications, APIs, and related services (collectively, the "Services").

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services. Your use of the Services is also governed by our Terms of Service, which are incorporated by reference.

"Personal data" (or "personal information") means information that identifies, relates to, or can reasonably be linked to an identified or identifiable individual. This policy does not apply to information that has been aggregated or de-identified such that it can no longer reasonably be used to identify you.

2.1 Information you provide to us

We collect information you choose to provide when you use the Services, including:

• Account and profile information — such as your name, email address, password, phone number, job title, organization, and preferences.
• Billing information — subscription and transaction details. Card and payment credentials are collected and processed by our third-party payment processors; we do not store full card numbers.
• Content you provide — the prompts, instructions, text, files, images, audio, video, and other materials that you upload, submit, generate, or create through the Services, together with the outputs produced ("Content"). See Section 5.
• Communications — messages, support requests, feedback, and survey or research responses you send to us.

2.2 Information we collect automatically

When you use the Services, we and our providers automatically collect certain information, including:

• Device and connection data — IP address, browser and device type, operating system, unique identifiers, and general location inferred from IP address.
• Usage and log data — pages and features viewed, actions taken, timestamps, referring pages, crash and diagnostic data, and other interaction data.
• Cookies and similar technologies — as described in Section 7.

2.3 Information from third parties

We may receive information about you from third parties, such as authentication or single sign-on providers when you sign in with them, business partners, and analytics or advertising providers, consistent with their own terms and privacy policies.

We use the information described above for the following purposes:

• To provide, maintain, secure, and support the Services and to process your transactions.
• To personalize your experience and remember your preferences.
• To communicate with you about your account, updates, security alerts, and — where permitted — marketing, from which you can opt out.
• To develop, operate, and improve the Services, including to build new features, measure performance, and to train, fine-tune, evaluate, and improve our and our providers' AI models and systems, as further described in Section 4.
• To maintain the safety, integrity, and security of the Services — including to prevent, detect, and investigate fraud, abuse, security incidents, and other harmful, prohibited, or unlawful activity.
• To conduct research and analytics, and to produce aggregated or de-identified insights.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

Providing an AI product means continually improving it. We may use the information and Content you provide, and the outputs generated through the Services, to operate, develop, and improve the Services, including to train, fine-tune, evaluate, and improve our and our providers' machine learning models and systems.

By creating an account and using the Services, you acknowledge and agree that this use of your information and Content is a normal and necessary part of providing and improving an AI product. We rely on the legal bases described in Section 15, including our legitimate interests in operating, securing, and improving the Services and, where required, your consent. We do not seek to use special-category or sensitive personal data to train our models, and we ask that you do not submit such data through the Services.

4.1 Your choice to opt out

You can opt out of the use of your Content to train our models through your account settings, where this control is available to you. Opting out does not affect our use of your information for the other purposes described in this policy, such as providing, securing, and supporting the Services.

Any opt-out applies going forward only. It does not require us to delete, retrain, or reverse models that were already trained, and it does not apply to Content covered by the limited exceptions below or to data already held in aggregated or de-identified form.

4.2 Limited exceptions

Even where you have opted out, we may retain and use Content when:

• it is flagged, reported, or reviewed in connection with trust, safety, security, or legal or policy compliance; or
• you have explicitly submitted it to us as feedback (for example, by reporting an issue or rating an output).

4.3 Aggregated and de-identified data

We may create and use aggregated or de-identified data — which cannot reasonably be used to identify you — for any purpose, including research, analytics, benchmarking, and improving the Services. Where we hold data in de-identified form, we will maintain and use it in that form and will not attempt to re-identify it, except as permitted by law.

Aggregated and de-identified data is no longer personal data, is owned by us, and is not subject to the opt-out in Section 4.1 or to rights that apply only to personal data. We may retain and use it for as long as we consider useful.

You retain ownership of the Content you provide. This section explains the rights you grant us to operate the Services and the responsibilities that come with the Content you upload or create.

5.1 License to operate and improve the Services

You grant us a worldwide, non-exclusive, royalty-free, sublicensable license to host, store, copy, reproduce, process, transform, adapt, transmit, and display your Content solely as necessary to provide, secure, support, and improve the Services and to develop our models and systems, consistent with this policy (including your training opt-out in Section 4). This license ends when your Content is deleted from our active systems, except for Content retained as described in Section 8, used in de-identified or aggregated form, or already incorporated into a trained model.

5.2 Your responsibilities and warranties

You are solely responsible for the Content you upload, submit, generate, or create through the Services. You represent and warrant that you own or have all rights, licenses, consents, and permissions necessary to provide that Content and to grant the license above, and that your Content and your use of the Services do not infringe or violate the intellectual property, privacy, publicity, or other rights of any person, or any applicable law.

5.3 No responsibility for Content

We do not control, endorse, verify, or assume responsibility for Content provided by users. To the fullest extent permitted by applicable law, we are not responsible or liable for any Content, or for any loss or damage arising from Content you or others upload, create, or share through the Services. You are responsible for maintaining your own copies of your Content.

5.4 Indemnity

To the fullest extent permitted by applicable law, you agree to indemnify and hold us harmless from any claim, demand, loss, or damages, including reasonable legal fees, arising out of or related to the Content you provide or your breach of this section, as further described in our Terms of Service.

We do not sell your personal data. We share information only in the circumstances described below:

• Service providers and sub-processors — vendors who perform services on our behalf, such as cloud hosting and infrastructure, AI model and compute providers, storage, analytics, customer support, communications, and payment processing. They may access information only to perform those services for us and are bound by confidentiality and data-protection obligations.
• Affiliates — companies within our corporate group, for the purposes described in this policy.
• Legal, safety, and compliance — where we believe in good faith that disclosure is necessary to comply with law, a legal process, or a governmental request; to enforce our terms; or to protect the rights, property, safety, or security of Hugogen, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this policy.
• With your direction or consent — including when you choose to connect or share through third-party integrations.
• Aggregated or de-identified data — which does not identify you.

Some features let you connect third-party services. We do not control, and are not responsible for, the data practices of any third-party service, which are governed by their own privacy policies.

We and our providers use cookies and similar technologies to operate the Services, remember your preferences, understand usage, and measure and improve performance and marketing. This includes analytics and advertising technologies such as Google Analytics and the Meta Pixel.

You can control cookies through your browser settings and, where available, through the consent controls we provide. Disabling some cookies may affect how the Services function. Where required by law, we obtain your consent before setting non-essential cookies.

We retain personal data for as long as reasonably necessary for the purposes set out in this policy — to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements — after which we delete or de-identify it.

When you delete Content or your account, we remove the associated data from our active systems within a reasonable period (typically within 30 days), except where we are required or permitted to retain it, where it exists in backups that are deleted on a rolling basis, where it has been de-identified or aggregated, or where it has already been incorporated into a trained model.

We implement appropriate technical and organizational measures designed to protect personal data against loss, misuse, and unauthorized access, disclosure, alteration, and destruction. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly of any unauthorized use of your account.

We operate globally, and your information may be processed and stored in Indonesia, the United States, and other countries where we or our service providers operate, which may have different data-protection laws than your own. Where we transfer personal data across borders, we implement appropriate safeguards required by applicable law, such as Standard Contractual Clauses, to protect your information.

Depending on where you live and subject to applicable law and exceptions, you may have some or all of the following rights regarding your personal data:

• To access, and to receive a copy of, the personal data we hold about you.
• To correct inaccurate or incomplete personal data.
• To delete your personal data.
• To port your personal data to another provider.
• To restrict or object to certain processing, and to withdraw consent where processing is based on consent.
• To opt out of the use of your Content for model training (see Section 4) and to opt out of marketing communications.

To exercise these rights, contact us at [email protected]. We will respond within the time required by applicable law — for requests subject to the EU or UK GDPR, within one calendar month, which may be extended where permitted. We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights. If you have concerns, you may also lodge a complaint with your local data-protection authority.

The Services are not directed to children, and we do not knowingly collect personal data from children under the age of 18 (or the minimum age of digital consent in your jurisdiction, if higher). If you believe a child has provided us with personal data, please contact us at [email protected] and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time to reflect changes to our practices, the Services, or legal requirements. When we make material changes, we will update the Effective Date above and, where appropriate, provide additional notice. Your continued use of the Services after the changes take effect constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests about this Privacy Policy or your personal data, please contact us through the relevant channel below. Hugogen is operated by PT Evora Vera Teknologi, incorporated in Indonesia, which acts as the data controller for personal data processed under this policy.

Where the EU or UK GDPR applies, we process personal data only where we have a valid legal basis to do so. The bases we rely on, depending on the context, are:

• Contract — to provide the Services you have requested and perform our agreement with you.
• Legitimate interests — to secure, support, analyze, and improve the Services (including model development), to prevent fraud and abuse, and to operate our business, where those interests are not overridden by your rights.
• Consent — where we ask for it, such as for certain cookies or marketing; you may withdraw consent at any time.
• Legal obligation — to comply with applicable laws and lawful requests.