Privacy Policy

Last updated: 14 September 2026

Anva turns a photo into a live, talking AI avatar. To do that we process your account details, the photos you upload, the avatars and voices you create, and your conversations. We don't sell your data. Photos used to build a facial avatar may be biometric information — we only collect them with your consent and delete them on a defined schedule (see “Biometric data”).

1. Who we are

Anva (“we”, “us”) is a product of Penguin Robotics (penguinrobotics.net), which operates the Anva service at anva.ai. For privacy questions or requests, contact hello@penguinrobotics.net.

2. Information we collect

  • Account information — email and authentication details when you sign up.
  • Photos you upload — the image(s) you provide to generate an avatar.
  • Avatars and voice/persona settings — the avatars you generate and the prompts, voice, and language you configure.
  • Conversations — audio and text exchanged in a live session. We process these in real time to run the conversation and show a live transcript; we do not store the content of conversation transcripts after the session ends.
  • Usage & session data — session duration, timestamps, IP address, device/browser, and referring site, used for security, billing, and analytics.
  • Payment information — processed by Stripe. We do not store card numbers; we receive limited billing metadata (plan, status).

3. Biometric data

Creating an avatar from a photo may involve processing a facial geometry / biometric identifier. This section governs that processing and is designed to meet biometric-privacy laws (including the Illinois Biometric Information Privacy Act, BIPA, and similar laws in Texas and Washington).

  • Consent. We collect and process biometric information only after you affirmatively confirm, at upload, that you have the right to use the face and consent to creating an avatar from it.
  • Purpose. We use it solely to generate and render your avatar and to operate the service. We do not use it to identify you elsewhere.
  • No sale. We do not sell, lease, or otherwise profit from your biometric information.
  • Retention & destruction. We retain the source photo and any derived biometric data only as long as needed to provide your avatar. We permanently delete it: (a) within 30 days of you deleting the avatar or your account, or (b) within 3 years of your last interaction with it, whichever comes first. Copies in encrypted backups are purged on the normal backup-rotation cycle (within ~35 days).
  • Disclosure. We share biometric data only with the subprocessors below that are strictly necessary to generate/render the avatar, under contract, and never for their own purposes.

4. How we use your information

  • To generate avatars and run live conversational sessions.
  • To operate, secure, and improve the service and troubleshoot problems.
  • To bill you and prevent fraud/abuse.
  • To communicate with you about your account and the service.
  • To comply with law and enforce our Terms and Acceptable Use Policy.

5. Subprocessors

We use vetted third parties to run the service. They process data on our behalf under contract and are not permitted to use it for their own purposes.

  • OpenAI — conversational language model.
  • ElevenLabs — text-to-speech (voice).
  • Deepgram — speech-to-text.
  • Cloudflare (R2) — storage and delivery of avatar assets.
  • Modal, Kling, Replicate — GPU compute used during avatar generation.
  • Neon — application database.
  • DigitalOcean — hosting and compute.
  • Stripe — payments.

6. Sharing

We share information only with the subprocessors above, when required by law or valid legal process, to protect rights and safety, or in connection with a merger or acquisition (with notice). We do not sell your personal information.

7. Your rights

Depending on where you live (e.g. under GDPR or CCPA/CPRA), you may have the right to access, correct, delete, or export your data, to withdraw consent, and to opt out of “sale”/“sharing” (we don't sell). You can delete an avatar or your account from the dashboard, or email hello@penguinrobotics.net and we'll action verified requests within the time required by law.

8. Data retention

We keep account and usage data (such as session duration for billing) while your account is active and as needed for legal, billing, and security purposes. Photos and biometric data follow the schedule in “Biometric data”. We do not retain the content of conversation transcripts after a session ends.

9. Security

We use encryption in transit and at rest, access controls, and other safeguards. No system is perfectly secure, but we work to protect your data and will notify you of a breach as required by law.

10. International transfers

We may process data in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers.

11. Children

Anva is not for anyone under 13 (or the minimum age in your country), and we don't knowingly collect their data. Do not upload a photo of a minor without the rights and consents required by law.

12. Changes

We may update this policy; we'll change the “Last updated” date and, for material changes, provide additional notice.

Questions? hello@penguinrobotics.net. This document is provided for transparency and is not legal advice.