Privacy Policy

BVA LLC is responsible for the personal data described here. Reach us at support@nectar-shield.com.

• Your account: email, display name, and your password as a one-way hash.
• Your plan: its status and dates, and the customer and subscription references Stripe gives us. Card details go to Stripe only; we never see them.
• Your sessions: a hashed sign-in token and its expiry date.
• Abuse counters: the number of recent sign-in attempts per email and per IP address, and of studio requests per account, kept for about a day.

We use these to run your account and your plan, to secure them, and to meet our legal obligations.

Your AI provider key and your saved assets and games are stored in your own browser, not on our servers. When you generate something, your prompt and key travel through our server to the provider you chose and the result comes back to you; we don't keep either. That provider processes them under its own privacy policy.

One cookie, ns_session, keeps you signed in for up to 30 days. It is strictly necessary, so it needs no consent. There are no analytics, advertising or third-party tracking cookies.

• Cloudflare — hosting and the database that holds your account.
• Stripe — payments and subscriptions.
• The AI provider you connect — only on your instruction, under your own agreement with it.

These companies may process data in the United States, under safeguards such as the EU–US Data Privacy Framework or standard contractual clauses.

Account and plan data for as long as your account exists. Sign-in records until they expire. Billing records are kept by Stripe for as long as the law requires.

You can ask to access, correct, export or delete your data, or object to how we use it, by writing to support@nectar-shield.com. Deleting your account also cancels any running plan. If you are in the EU, you can also complain to your data protection authority — in France, the CNIL.

Nectar Shield is not intended for children under 16.