DRAFT — counsel review required. This policy describes how the product behaves today. It has not been reviewed by qualified legal counsel and is not legal advice.
Effective date: September 14, 2026 · Last updated: September 14, 2026
Who holds your data
Cerveio AI LLC, 19495 Roark Mtn Dr., Abingdon, VA 24211, United States. Privacy questions: Cerveioai@gmail.com.
What CerveioAI collects
To have an account: your email address, a password (stored only as a hash, never as the password), and your date of birth. A Google sign-in adds the identifier Google returns.
Because you chose to add it: your Creator profile, your Knowledge Library files, your Digital Human asset, and the authorizations you grant for your voice and likeness.
Because the system runs: sign-in and security records, audit records of consequential actions, notification delivery records, and conversations with a Digital Human.
What CerveioAI never holds: your card number. A payment processor handles card details; no part of this system stores them. CerveioAI also stores no voiceprint, no voice embedding and no voice clone.
Your age
A date of birth is required to open an account, because eligibility depends on it: 13 to hold an account at all, 18 to become a Creator or take part in monetization.
If CerveioAI learns an account belongs to a child under 13, the account is blocked from further collection and the situation is referred to a person to decide.
Your voice and likeness
These are the most sensitive things here, and they are handled separately from everything else. An uploaded asset is not approved; an approved asset is not authorized; and authorization is re-checked on every single request, so withdrawing it takes effect on the next one rather than whenever a cache expires.
Closing your account revokes every voice and likeness authorization it holds. Consent does not outlive the account that gave it.
What happens when you close your account
This is the part policies usually describe vaguely. Here is what the system actually does, by category:
Erased: your Creator profile; your Knowledge Library content; your Digital Human asset bytes; sign-in tokens, password-reset and verification tokens, and linked Google identities; notification history.
Scrambled so it can no longer identify you, while leaving the records that point at it valid: your account identity, and your voice and likeness authorizations — which are revoked first, with the revocation itself kept.
Kept, and why: billing and payout records, because there are legal and tax obligations attached; rights complaints and safety investigations, until they are resolved; and a minimal record that the account existed and was closed.
Export your Knowledge Library before you close, because closure erases it.
How long things are kept — honestly
CerveioAI does not yet run an automatic retention timer. Deletion happens when you ask for it, when you close your account, or when a person acts — not on a schedule.
That means the durations under discussion (for example “30 days after closure”, “12 months” for conversations, “7 years” for financial records) are targets that have been decided but not yet enforced by software. They are written down, reconciled against the actual storage in the project’s retention reconciliation, and are not presented here as promises the system currently keeps. When a retention job exists, this section will say so and say what it does.
Backups follow normal rotation. Data you deleted can persist in a backup until that backup ages out, which is a limitation of backups, not an exception CerveioAI is claiming for itself.
Who your data is shared with
Service providers that make the product run — hosting, storage, email delivery, and a payment processor once payments are enabled — and only what each needs. Your Knowledge Library, your conversations, your unpublished Digital Human and your authorization material are not sold, and are not used to advertise to you.
Your choices
You can see and change your profile, export your Knowledge Library, withdraw a voice or likeness authorization, change your notification preferences, and close your account — each from your account, without asking anyone.
For anything else, including a request to have specific data deleted, write to Cerveioai@gmail.com.
Security
Passwords are hashed. Sessions expire and can be revoked. Consequential administrative actions are authenticated and recorded. Likeness assets are streamed through the application on each request rather than handed out as links that outlive the permission that produced them.
No system is perfectly secure, and this one is in beta.
Contact
Cerveio AI LLC, 19495 Roark Mtn Dr., Abingdon, VA 24211, United States · Cerveioai@gmail.com