1. Who we are
Corvela is run by [Company legal name], registered in [country] under number [registration number], with its address at [street, postcode, city, country] ("Corvela", "we", "us").
We are the controller of the personal data described in this policy. This policy covers the website corvela.dev, the waitlist, and the Corvela app once it opens. Questions about privacy go to privacy@corvela.dev.
2. What we collect
| When | What we collect |
|---|---|
| You join the waitlist | Your email address, what you want to build (if you tell us), and when you gave consent. |
| You contact us or report a bug | Your name and email if you give them, your message, and any technical details you send (such as browser, screen size and the page you were on). |
| You ask for help under Support | Your request and its number, the conversation with our team, any screenshots you add, the page you were on and your browser, and your plan (so Max requests can be answered first). We keep it so you and we can follow the conversation, and email you when we answer. |
| You report a site | The site's address, what you think is wrong, any details you write, and your email address only if you give it (to get back to you). We use it to check the site and, if it breaks our rules, take it offline. We don't tell the site's owner who reported it. |
| Your site is reported or taken offline | The report about it, and a note of who at Corvela took it offline, when and why. We email you the reason. |
| You create an account | Your name, email address and sign-in details. Passwords are stored only as a secure hash. If you sign in with Google, Google tells us your name, email address and a Google account ID; we don't get your Google password. |
| You build with Corvela | Your messages to the AI, files and images you upload, links to websites you ask us to read for their style (we fetch that public page), the projects and code that are created, and the sites you publish. |
| Someone fills in a form on a site published with Corvela | What they type into the form (for example name, email and message), the page it came from and the time. We keep it for the site's owner, who decides what to do with it; for these messages we act on the site owner's behalf. [Lawyer: check processor wording] |
| You pay for a plan | Your plan, billing name and address, and payment status. Card details are handled by our payment provider; we never see or store full card numbers. If you pay with crypto, the payment is handled by NOWPayments: we receive the order, the coin, the amount and whether it was paid, but never your wallet's keys. [Lawyer: check processor wording for NOWPayments] |
| You sign in or change account security | A security log of sign-ins, wrong passwords and codes, and changes like a new password, email or two-step login: the time, your device and browser, your IP address and an approximate location worked out from it (city level at best, looked up with ipwho.is). We show it to you in Account settings, put it in security emails so you can spot someone else in your account, and delete it after 180 days. If you turn on two-step login we also keep its secret key and your backup codes (stored as a hash). [Lawyer: check retention period and location lookup] |
| You use the website or app | Technical data such as IP address, device and browser type, pages visited, errors, and how many credits you use. |
3. Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Emailing you when you can join from the waitlist | Your consent. You can withdraw it at any time. |
| Answering your messages and bug reports | Our legitimate interest in helping you and fixing problems, or steps you ask for before a contract. |
| Providing Corvela: running the AI, hosting your projects, publishing your sites | Performing our contract with you. |
| Billing and keeping financial records | Performing our contract, and our legal obligations under tax law. |
| Keeping Corvela safe: preventing fraud, abuse and misuse of the AI | Our legitimate interest in a secure service, and legal obligations where they apply. |
| Improving Corvela, for example finding where people get stuck | Our legitimate interest. We use aggregated or minimised data where we can. |
We do not sell your personal data, and we do not use it for advertising.
4. How the AI works with your data
Corvela uses AI models provided by Anthropic, PBC (United States) through its commercial API. When you use the builder, your messages, uploaded files and the relevant project code are sent to Anthropic so the AI can produce a response. Anthropic processes this data on our behalf, under its commercial terms and data processing terms.
- We do not use your prompts or projects to train AI models.
- Under its commercial terms, Anthropic does not use data sent through the API to train its models by default. Anthropic may keep data for a limited time, for example to detect misuse, as described in its own documentation.
- Requests may be checked automatically to prevent harmful or illegal use.
- AI responses can be wrong. Review what Corvela builds before you rely on it or publish it.
5. Who we share it with
We share personal data only with service providers that help us run Corvela. They act on our instructions and must protect your data.
| Provider | What they do | Location |
|---|---|---|
| Anthropic, PBC | AI models that power the builder | United States |
| [Hosting provider] | Servers that run the website, app and your projects | [country] |
| [Payment provider, for example Stripe] | Payments and invoices | [country] |
| [Email provider] | Sending waitlist and account emails | [country] |
We may also share data when the law requires it, to protect people from harm, or as part of a sale or merger of our business, in which case this policy continues to apply.
6. Transfers outside the EU
Some providers, including Anthropic, are in the United States. When personal data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, with extra safeguards where needed. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
- Waitlist: until you join Corvela or unsubscribe, and at most 12 months after we open access to everyone.
- Messages and bug reports: up to 24 months after the conversation ends.
- Account and projects: while your account is open. When you delete your account, we delete your projects within 30 days, apart from backups, which expire within a further 30 days.
- Billing records: as long as tax law requires, usually up to 7 years.
- Technical logs: up to 90 days, longer only when needed to investigate a security problem.
8. Cookies and fonts
This website does not use advertising or analytics cookies. The Corvela app will use only cookies that are strictly necessary, for example to keep you signed in. If we ever add optional cookies, we'll ask first.
The fonts on this website are stored on our own server, so loading a page doesn't connect you to Google or any other font service. The website remembers whether you picked light or dark mode in your browser's local storage. This stays on your device, isn't sent to us, and you can clear it any time.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- have your data deleted;
- restrict or object to how we use it, including use based on our legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing.
To use these rights, email privacy@corvela.dev or use the contact form. We reply within one month. We may ask you to confirm your identity first.
You can also complain to a data protection authority, for example the one where you live. Our lead authority is [name of the supervisory authority in our country, for example the Autoriteit Persoonsgegevens in the Netherlands].
10. Security
We protect your data with encryption in transit, access controls, limited staff access, and regular updates of our systems. No service is perfectly secure. If a breach puts your rights at risk, we'll tell you and the authorities as the law requires. To report a security problem, email security@corvela.dev.
11. Children
Corvela is not meant for children under 16, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll delete it.
12. Changes
We'll update this policy when our service or the law changes. The date at the top shows the latest version. For important changes, we'll tell you by email or in the app before they take effect.
13. Contact
[Company legal name], [address]. Email: privacy@corvela.dev.