Arvum Privacy Policy
1. Controller and scope
The data controller is PT GANESH GRAHA DIGITAL, Indonesia; details and contacts appear below. This Policy describes processing of information that can directly or indirectly identify a person, taking account of Indonesian law and other applicable mandatory rules.
2. Data we process
Email is the contact detail required for registration. Country is optional; a suggestion may be based on IP and can be changed or cleared. Country is used only to understand audience geography and for internal statistics.
We process account and sign-in data; uploaded and created materials, including images, videos, projects, models, textures, prompts and responses; payment, subscription and credit information; support requests and records of accepted terms; and technical information about IP addresses, devices, browsers, sessions, operations and errors. External sign-in supplies permitted profile data. Passwords are stored in securely hashed form; full card numbers and CVV are not stored in Arvum’s application database and are entered on the payment service’s side.
Do not upload identity documents or unnecessary personal or confidential information. The service is not intended to collect sensitive data, perform biometric identification or collect information about children. Such information appearing in materials does not permit unrestricted use of it.
3. Purposes and legal bases
Data is needed for registration and sign-in, requested operations, storage and delivery of results, payments and refunds, support, security, diagnostics, internal statistics and legal obligations. Legal bases are the contract, legal requirements, consent for the relevant purposes and legitimate interests balanced against individual rights.
Necessary service messages are sent regardless of marketing subscription. Marketing emails require separate voluntary consent. Section 8 of the Agreement governs use of non-personal, non-confidential materials; that licence does not replace a legal basis for personal-data processing or required consent.
4. Service providers and overseas processing
To the extent necessary, data is provided to infrastructure, storage, authentication, email, security and AI-processing providers, payment services and banks, engaged specialists and, on a lawful basis, public authorities or a business successor. Access is limited to the task; engaging a provider does not permit arbitrary independent use of data. External sign-in and payment pages are also governed by their operators’ rules.
The service uses overseas providers, including infrastructure in Singapore. Transfers require a legal basis and the necessary safeguards under applicable law. Required transfer information is provided beforehand to the extent required by law; information about applicable processing and exercising rights can be requested at support@arvum.ai. General acceptance of the Agreement does not mean consent to every transfer.
Personal data is not published solely on the basis of the materials licence. The Operator does not sell its contact database to advertising intermediaries.
5. Retention and deletion
Data is retained while needed for the account, selected services or applicable legal obligations. Once its purposes are fulfilled, it is deleted or anonymised, except information needed for accounting, pending requests, protection of rights and abuse prevention, for as long as the corresponding basis applies.
Account closure ends access; deletion of working materials and Assistant history is handled separately. Minimal closed-account information, including email and the closure record, and necessary financial and security records may be retained on a lawful basis. Deletion requests should be sent to support and are handled within mandatory deadlines.
Isolated backups are for disaster recovery and are cleared after the protective cycle ends and active use of the data ceases. This is not immediate deletion at account closure. Support can clarify applicable retention periods and bases; mandatory legal requirements take precedence.
Local projects and device settings may remain after sign-out. The User manages them in the service and browser; deleting unsynchronised data can result in lost work.
6. Rights and requests
To the extent provided by law, you may obtain information and a copy of your data, correct it, request deletion, cessation or restriction of processing, request data portability, withdraw consent and contest a significant decision based solely on automated processing.
Send requests to support@arvum.ai with the subject “Personal data”. The Operator checks authority proportionately and responds within mandatory deadlines. Withdrawal of consent does not invalidate prior lawful processing or retention on another basis. The right to contact a competent authority or court is preserved.
8. Security and policy changes
The Operator uses organisational and technical safeguards, access restrictions and secure transmission. Absolute security is not guaranteed. Incidents are addressed and mandatory notifications are made.
New revisions are published on the site. Material processing changes are notified in advance as required by law; necessary consent is requested before the new processing begins. A marketing subscription is not required for service notices.