Effective: 11 October 2026 · This policy explains how we handle your personal data
We collect the minimum needed to run your account, take payment and generate your media. We do not sell your data, we run no advertising or analytics trackers, and we never see your card or bank details — those go straight to our payment gateway.
Triavatech Studio (“we”, “us”, “our”) operates this Service from Malaysia and is the data user responsible for your personal data under the Personal Data Protection Act 2010 (PDPA). Our seller details are on the Policies page. Privacy questions and requests: admin@triavatech.studio.
This policy covers the Triavatech Studio web application and these policy pages. It does not cover third-party sites we link to.
| Category | What it includes | Why |
|---|---|---|
| Account details | Your name, email address, a scrypt hash of your password, your role and the date you registered. | To create and secure your account, and to let you sign in. We never store your password itself. |
| Credit balance and activity | Your current credit balance and every credit movement — top-ups, spends and refunds. | To bill correctly and to show your balance. |
| Generations | The prompts you write, the model and settings used, the credit cost, the status, any error or refusal reason, the link to the finished file, and timestamps. | To run your job, refund you when it fails, and populate your Library. |
| Reference media you upload | Images, video and audio files you attach as references. | To generate the result you asked for. These files are sent to the model provider for processing. |
| Payment records | The amount, the payment reference, the status and the tax applied. | To credit your balance, handle refunds and meet tax obligations. |
| An API key, only if you choose to add one | A Higgsfield API key you paste into your account settings. | To let generations run against your own provider account. Purely optional; you can remove it at any time. |
| Technical data | Your IP address and standard request information in server logs, kept for security and troubleshooting. | To detect abuse and keep the Service running. |
We do not use your data for automated decision-making that has a legal effect on you, and we do not send marketing email — we have no mailing list.
We use the minimum needed to keep you signed in:
| Cookie | Purpose | Lifetime |
|---|---|---|
triavatech_session |
Identifies your signed-in session. It is HttpOnly, so page scripts cannot read it, and SameSite=Lax. | 14 days, or until you sign out |
triavatech_key |
Set only if you connect your own provider API key, so the key travels with your requests. | Until you remove the key or sign out |
We set no advertising or analytics cookies. Signing out clears your session. Most browsers let you block or delete cookies, but the session cookie is required to stay signed in.
We share your data only with the providers needed to deliver the Service, and only what each one needs. These are data processors acting on our instructions.
| Who | What they receive | Which part of the Service |
|---|---|---|
| Generative model providers (our primary model provider, and a second image provider used by the Triavatech Banana engines) |
Your prompt, your generation settings, and links to the reference media you attached. | Producing your image or video. |
| Prompt-enhancement provider (DeepSeek) |
Your prompt text and up to three of your reference images. Only when you press the Enhance button — never otherwise. | Rewriting your prompt to be more descriptive. |
| SyokBill (payment gateway) | Your name, your email address, the amount and the payment reference. | Taking payment and issuing refunds. |
| Exchange-rate services (frankfurter.dev, open.er-api.com) |
No personal data. We only look up the public USD → MYR rate. | Pricing model usage in Ringgit. |
| Google Fonts | Your IP address, as part of the browser fetching the typeface files. | Displaying the studio's typography. |
We may also disclose data where we are legally required to — for example to a regulator, a court, or law enforcement — or where it is necessary to investigate fraud or abuse of the Service.
Our own administrator can view accounts, generations and payments through an internal admin panel, for support, billing and abuse investigation.
The model, enhancement, payment and font providers above operate servers outside Malaysia, primarily in the United States and Europe. Processing your request therefore involves transferring the data listed above outside Malaysia. We use providers that apply their own security and privacy commitments, and we share no more than each request requires.
| Data | How long |
|---|---|
| Account details, generations and reference media | Until you close your account, then deleted |
| Payment and tax records | Retained as required by Malaysian law (generally 7 years), then deleted |
| Session records | Up to 14 days, and swept automatically after they expire |
| Server logs | A short period, for security and troubleshooting |
When you close your account we delete your personal details, generation history and uploaded reference media. We keep only what the law requires us to keep, and we do not use retained records for any other purpose. Note that generated image and video files are hosted by the model provider, not by us — see the Delivery Policy.
Triavatech Studio has a community feed. It exists so creators can learn from each other: a finished render appears there, and another creator can load its prompt and run their own version of it. This is the one place where work you made is shown to other people, so it is spelled out here rather than left to be discovered.
| Detail | |
|---|---|
| What is published | The prompt text, the model used, the finished image or video, and a shortened display name such as Aina F. Nothing else about you is published: no email address, no credits, no account id. |
| Who can see it | Other signed-in creators of this studio. The feed deliberately excludes your own render, so it only ever shows you other people's work. |
| When it appears | Reading a render takes time, so a render is only listed once it has finished with a playable result. Failed, blocked or cancelled attempts are never listed, and neither is a request with no output. |
| How to stop it | Open Library and use the Shared control on the render to switch it off. It disappears from the feed immediately and the render itself stays in your Library. Sharing a render again switches it back on. |
The prompt is shared on purpose — the prompt is the thing other creators learn from. Do not put personal or confidential details into a prompt if you do not want them seen. The media file itself is still served from the model provider's storage, as described in the Delivery Policy.
Withdrawing your consent to this publication is one of your rights below: switching a render off, or closing your account, removes it from the feed.
Under the PDPA you have the right to:
Email admin@triavatech.studio from your registered address. We will respond within 21 days as the PDPA requires, and we may ask you to verify your identity first so that nobody else can access your data. There is normally no charge; we may charge a reasonable fee where the law permits for an excessive request.
If you are not satisfied with our response, you may complain to the Department of Personal Data Protection (JPDP), Malaysia.
No system is perfectly secure. If we ever become aware of a breach affecting your personal data, we will notify you and the relevant authority as the PDPA requires.
The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, contact us and we will delete it.
We may update this policy to reflect changes to the Service or to the law. The “Effective” date at the top will change, and material changes will be notified in the studio or by email. Continuing to use the Service after a change means you accept the updated policy.
← Back to Triavatech Studio