Privacy Policy

Effective October 22, 2026 · Updated October 27, 2026 · Korea Standard Time

Previzion is operated by IAYN. This policy covers the website, accounts, public board, and the AI features, feedback, surveys and usage analytics in the app. For privacy inquiries and requests, contact IAYN at 17iayn@gmail.com.

Information we use

Sign-in and accounts: the verified Google account identifier (sub) and email address, your chosen nickname, account creation and consent times, a hash of the sign-in token for each computer you sign in to the app on and when it was issued, the hash and expiry of an invite code if your account signs in with one, and your Viz balance and usage records. Google sign-in requests the openid and email permissions, not your profile name or picture.
AI requests: scenarios, instructions, shot descriptions, reference images, scene context, tool results, and search terms for assets, animations and effects; the generated results and operational metadata needed to process these requests.
The public board: projects and movies you upload, their previews, your nickname and upload details. A random visitor identifier records likes and daily views. Published content and its previews are visible to other visitors; hiding a post is not the same as deleting its stored files.
Feedback and surveys: feedback you send from the app carries your message, your account, the app's session identifier, the failed run it reports when you send it from a run's error notice, and the app's logs from the current and previous session. The open project file goes along unless you untick it. App logs can contain file paths on your computer and project names; the usage events described below do not. A satisfaction survey carries your rating, the shortcomings you pick and an optional comment, with your account and the session identifier but no logs or files. We use these to reply to you at your account email, fix bugs and improve the service, and keep them until the end of the public-test retention period below.
Website operation: cookies for sign-in, form security, board interactions and your site-language preference. Blocking these cookies can prevent the related features from working. You can remove them in your browser settings.

We use this information to authenticate users, manage accounts and Viz usage, provide AI generation and search, distribute installers, operate the board, respond to feedback, support or privacy requests and improve the app.

How AI processing works

Every model request follows this route: Previzion server → OpenRouter → Anthropic or OpenAI. Scene generation is processed by Anthropic. Storyboard text, image generation and editing, and search embeddings are processed by OpenAI.

Our OpenRouter account allows only Anthropic and OpenAI as model providers. Requests do not automatically switch to a model provider outside that list. These companies may still use cloud, security and support subprocessors. The restriction does not remove those subprocessors.

Our Anthropic API credentials are configured for priority use through OpenRouter (BYOK). This is a preference, not an exclusive BYOK route or a zero-retention agreement. We use OpenRouter's global API and have not enabled US-only regional routing.

We do not separately add your Google identifier, email, Viz balance or app sign-in token to model input fields. Personal information that you include in a scenario, image or other submitted material can nevertheless be transmitted with it. Only submit information you are entitled to use.

AI processing and overseas transfers

When and how: when you request the relevant AI feature, the necessary inputs and results are transmitted between the Previzion server, OpenRouter and the selected model provider over encrypted HTTPS connections. Tool-driven follow-up and search requests can occur as part of that feature. Request identifiers, model information, token counts, timing, usage and security metadata may accompany the processing.

The recipients, purposes, locations and retention conditions are set out below. A company's headquarters does not determine where all processing takes place. The countries listed by a provider describe its processing arrangements; they do not mean that every request is sent to every location.

OpenRouter

Recipient and contact: OpenRouter, Inc. (United States), privacy@openrouter.ai.
Purpose and information: Routing all AI requests and returning results, usage accounting, service operation and security. It handles the AI inputs, results and necessary metadata described above.
Countries and processing locations: Its published DPA describes US-hosted Google Cloud infrastructure and US-restricted storage at rest. Its Trust Center lists US locations for infrastructure and operational subprocessors, and provider-dependent global locations for model processing. The downstream Anthropic and OpenAI locations below also apply. This is not a commitment to US-only processing throughout the request.
Retention and training: Optional input/output logging and the data-sharing discount are disabled for our operating workspace, and paid endpoints that train on requests are disallowed. These settings do not prevent retention of operational, billing or security metadata for service, security and legal needs. Image inputs are normally kept only as needed to route the request, with abuse-detection, security, billing and legal exceptions. OpenRouter's published policy does not give one fixed deletion deadline for all such metadata. We do not promise immediate deletion or zero data retention.

Anthropic

Recipient and contact: Anthropic, PBC (United States), privacy@anthropic.com.
Purpose and information: Scene generation and its follow-up tool interactions: relevant scenarios, instructions, shot descriptions, reference images, scene context, tool results, generated results and necessary operational metadata, received through OpenRouter.
Countries and processing locations: Anthropic states that data is stored in the United States. Default inference can take place in selected countries in the United States, Europe, Asia and Australia. Its public subprocessor list describes Google Cloud, AWS and Microsoft Azure infrastructure as worldwide and Cloudflare routing as worldwide/local to the customer. It does not enumerate a complete country list for default global inference. See its location notice.; Safety review, support and incident response can also occur at affiliate locations: the United States, United Kingdom, Canada, Ireland, Switzerland, France, Japan, Germany, South Korea and Australia. The support subprocessor list additionally includes South Africa. These support locations are not a substitute for a list of inference countries.
Retention and training: Commercial API inputs and outputs are not used to train its models by default. Standard API inputs and outputs are normally deleted within 30 days of receipt or generation. Legal obligations, policy enforcement, applicable model-safety requirements and contractual or feature-specific terms can require longer retention. Inputs and outputs flagged for policy violations may be kept for up to two years, and safety classification scores for up to seven years. BYOK priority does not change these conditions into a zero-retention promise.

OpenAI

Recipient and contact: OpenAI OpCo, LLC (United States), privacy@openai.com.
Purpose and information: Storyboard text: scenarios, instructions and shot descriptions. Image generation/editing: prompts, shot descriptions and reference images. Search embeddings: asset, animation and effect search terms. Each request also involves its generated results and necessary operational metadata, received through OpenRouter.
Countries and processing locations: OpenAI's API subprocessor list identifies cloud processing in Australia, Belgium, Brazil, Canada, Denmark, Finland, France, Germany, India, Indonesia, Ireland, Italy, Japan, Malaysia, Mexico, the Netherlands, New Zealand, Norway, Poland, Singapore, South Africa, South Korea, Spain, Sweden, Switzerland, the United Arab Emirates, the United Kingdom and the United States. Locations vary by infrastructure provider. Cloudflare uses its global network with routing near the end user; no US-only route is configured for Previzion.; Support and moderation can additionally involve the Philippines; US services handle warehousing, data integration and moderation. OpenAI affiliates provide technical and operational support from the United States, Ireland, the United Kingdom and Japan. Support content is shared when a customer submits it, and moderation samples when flagged. The linked list distinguishes each provider's purpose and conditions; this list is not a claim that a particular request is processed in all of these countries or stored solely in the United States.
Retention and training: API content is not used to train OpenAI models by default unless explicitly shared for that purpose. Abuse-monitoring logs, which may include inputs, outputs and related metadata, are retained for up to 30 days by default; legal requirements or protection against harm can require longer retention. Applicable prompt caches can retain encrypted processing state for up to 24 hours. Image inputs flagged for possible child sexual abuse material can be retained for manual safety review. These are separate retention rules, not a guarantee that all data is deleted within 30 days. Previzion does not apply or guarantee zero data retention.

Your choice about these transfers

For this signup flow, IAYN requests separate consent to these AI overseas transfers under Article 28-8(1)(1) of Korea's Personal Information Protection Act. Accepting the general terms or visiting this site does not substitute for that consent. Review the recipients, information, countries, timing, purposes and retention above before selecting the separate checkbox.

You may refuse by leaving that checkbox unticked. In the current public-test signup flow, your account cannot then be created, so account-based AI features and installer downloads are unavailable. Public pages and the public board remain accessible.

To withdraw consent, stop further AI requests and email 17iayn@gmail.com. IAYN will verify your request and arrange the necessary restriction or closure of account-based AI access and relevant deletion requests. This is handled by the operator, not an automatic switch in the app. Withdrawal does not recall completed transfers or override a provider's applicable legal or safety retention obligations. Changes requiring renewed transfer consent will be disclosed and consent obtained before the changed transfers begin.

Sign-in, hosting, downloads and analytics

Google: sign-in takes you to Google for authentication, and we receive the verified identifier and email described above. Google handles that authentication under its own Privacy Policy. We do not send your AI prompts to Google as a model provider through this configuration.

AWS: the service is hosted on the operator's EC2 infrastructure. Installer downloads use temporary S3 links. Following a download link connects your browser to AWS, which receives the network information needed to serve the file. The link does not add your Google identifier, email or Viz balance as download parameters. Accounts and board records use the service's database; this download flow does not upload those records to S3.

Amplitude: release packages of the Previzion app send usage events to Amplitude, Inc. (United States), privacy@amplitude.com, which processes and stores them on IAYN's behalf for IAYN's product analytics. An event records a decision you make in the app, such as opening a page, starting a generation or rendering a movie, with values like lengths, counts, durations, scores, flags, setting values and project and run identifiers. Events also carry your nickname while you are signed in, a session identifier, an identifier issued once per installation, and the app build, operating system, GPU name and display size and scale. They never include your prompts or conversation, the text of feedback or survey comments, names you type, file paths, project names or content, or your sign-in token. The app does not add your IP address or location to the events; Amplitude receives the network connection information needed to accept them. The app sends the events over encrypted HTTPS connections to Amplitude's US endpoint while you use it, shortly after they occur; events that could not be sent wait on your computer until the app next runs. They are processed and stored in the United States. They are kept until the end of the public-test retention period and then deleted through Amplitude's deletion process, both described below. This landing website does not load an Amplitude SDK.

IAYN discloses this transfer under Article 28-8(1)(3) of Korea's Personal Information Protection Act, as processing and storage it entrusts to Amplitude; it does not rely on the separate AI-transfer consent above. The app has no setting that turns usage analytics off. To refuse, stop using the app and email 17iayn@gmail.com. IAYN will verify your request and ask Amplitude to delete your events. Refusal does not recall events already sent.

IAYN's retention and deletion

IAYN's retention period for this public test ends on November 21, 2026 (Korea Standard Time). This covers account and consent records, Viz usage, board interactions, uploaded content, feedback and surveys, and personal data in logs, crash reports and backups under IAYN's control.

We delete data without undue delay when that period ends, when its purpose is fulfilled, or when an applicable earlier deletion request is fulfilled. Electronic records are removed so they cannot be recovered. Records subject to a specific legal preservation obligation are separated and kept only for that obligation's duration.

The November 21 date does not promise that the external AI providers finish deleting all their records on that date. Their retention and exceptions are described above. We handle relevant external deletion requests as part of responding to your request. Because the app sends usage events to Amplitude, we will stop collection and re-ingestion at the end of the period, request deletion and check completion; Amplitude's published deletion process can take up to 30 days after a request. That is not an automatic 30-day event-retention setting.

Your rights and contact

You can request access, correction, deletion, account closure, restriction of processing or withdrawal of consent by emailing IAYN at 17iayn@gmail.com. We verify your identity and handle requests under applicable law. Deleting a browser cookie or hiding a board post does not delete your account or all associated records.

Official policy sources

Reviewed October 22, 2026. The API/commercial policies below apply to this description; consumer ChatGPT or Claude subscription terms are not used as substitutes.

OpenRouter: Privacy Policy, DPA, data collection, provider restrictions, subprocessors.
Anthropic: API retention, commercial training policy, processing locations, subprocessors, privacy contact.
OpenAI: API data controls, API subprocessors and countries, DPA.
Amplitude: Privacy Policy, user deletion. Korea: Personal Information Protection Act, Article 28-8.