Privacy Policy

This service is operated by Krivalo (registered officially as Krivalo Computer Programming Services), a sole proprietorship based in Cebu City, Philippines and registered with the Department of Trade and Industry and the Bureau of Internal Revenue. Referred to as Krivalo throughout this policy.

Your card or e-wallet statement may show the registered name rather than the brand name. That is the same business.

Our full registration details — registered name, TIN and registered address — are available on request. We do not publish them here because this is a sole proprietorship: those details identify a private individual and their home, and the BIR seal badge shown with this page already provides scannable public proof that the business is registered.

We handle your information under the Data Privacy Act of 2012 (RA 10173) and its implementing rules.

This is the part most people care about, so it comes before everything else.

We do not keep your photos. No photograph you upload is stored on a Krivalo server or in our database. Your photo is sent for processing, the result comes straight back to your browser, and nothing is retained on our side afterwards.

Where the finished photo lives. Your results are saved inside your own browser, on the device you used, so you can come back to them for three days without paying again. After three days they are deleted automatically. Clearing your browser data removes them straight away, and they never travel to another device.

Who else sees your photo. To remove a background or change an outfit, your photo has to reach the service that performs that edit. Those services are listed in section 5. They receive the image for as long as the edit takes and return the result. We do not permit them to use your photo to train their models, and we do not use it to train any model of our own.

Some processing never leaves your device at all. If our providers are unavailable, Krivalo falls back to a background-removal model that runs inside your own browser. In that case the photo is never transmitted anywhere.

When you register:your name, username, email address and mobile number. Your password is handled by Google’s Firebase Authentication and is never visible to us. If you sign in with Google, we receive your name and email address from that account.

When you pay: your wallet balance, and a record of every top-up and deduction — the amount, what it was for, and when. This is your receipt history, and it is shown to you on the wallet page.

We never see your payment credentials.Card numbers, GCash and Maya logins, and online banking details are entered on PayMongo’s own pages and never reach Krivalo. We receive only a confirmation that a payment succeeded and for how much.

When you order: which product you bought, the size, the price, the status, and the times it moved through the process. Not the photo itself.

When you contact support: your message, along with your name, email and most recent order, so we can answer without asking you to look up an order number.

Our own cost records: we keep an internal log of each automated processing call — which operation ran, which provider handled it, whether it succeeded, and what it cost us. It is linked to your account and order so we can investigate a failure you report. It contains no image data.

• No advertising or analytics trackers. Krivalo carries no third-party analytics, no advertising pixels, and no cross-site tracking of any kind.
• We do not sell, rent or trade your personal information. Ever, to anyone.
• We do not use your photos to train AI models, or let our providers do so.
• We do not use your photos in marketing without asking you first, in writing.
• We do not build advertising profiles or share data with data brokers.

The only browser storage Krivalo uses is for running the service itself: keeping you signed in, remembering your preference for staying signed in, and holding your in-progress designs and finished photos on your device.

This means your data crosses borders. Using Krivalo involves transferring your information — including, for the last two providers, your photograph — outside the Philippines. We only use providers that commit to protecting it, and we remain accountable to you for what they do with it.

We may also disclose information where the law requires it, such as a valid court order or a lawful request from a government authority.

• To perform our contract with you — we cannot deliver a photo you paid for without processing that photo, or run a wallet without recording its balance.
• Because the law requires it — financial and tax records must be kept.
• For our legitimate interests — keeping the service secure, preventing fraud and abuse, and understanding what our own costs are.
• With your consent — anything outside the above, which you can withdraw.

• Photographs — not retained by us at all. Finished files sit on your own device for three days, then delete themselves.
• Account details — for as long as your account is open, and for a short period afterwards in case you ask us to restore it.
• Payment, wallet and order records — kept for the period required of us for tax and accounting purposes, which is longer than the life of your account. These are financial records and we cannot delete them on request.
• Support messages — kept while we deal with your issue and for a reasonable period after, so we have the history if you come back.

Under the Data Privacy Act you have the right to:

• Be informed of what we hold and what we do with it — this page.
• Access a copy of your personal information.
• Correct anything inaccurate. You can edit most of it yourself in Settings.
• Object to certain processing, and to withdraw consent you have given.
• Erasure or blocking of your information where the grounds for it apply.
• Data portability — receive your data in a usable electronic format.
• Damages where you suffered harm from a false, unlawful or unauthorised use.

To exercise any of these, contact us using section 10. We will respond within a reasonable time, and we may need to confirm your identity first — otherwise the right to access becomes a way for someone else to read your records.

One honest limitation: erasure does not extend to financial records we are legally required to keep. If you ask us to close your account, we remove your profile but retain the transaction history.

If you are not satisfied with how we handle a concern, you can complain to the National Privacy Commission. We would rather you came to us first, but the route exists and you are entitled to use it.

Traffic is encrypted in transit. Every action that moves money or touches your records is verified on our server against your signed-in identity — the browser cannot simply ask for someone else’s data. Payment credentials never reach us at all, so they cannot leak from us.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that puts you at real risk, we will notify you and the National Privacy Commission as the law requires.

Children. Krivalo is not intended for children under 18 and we do not knowingly collect their information. A parent or guardian must hold the account. If you believe a child has registered, tell us and we will remove it.

Reach us through the Help Center contact form. Say that your message concerns privacy so it is routed properly.

Or email support@krivalo.com.

Krivalo · Cebu City, Philippines

We may update this policy. The date at the top shows when it last changed in substance, and we will tell you before a material change takes effect.