Our All-Truth Privacy Promise
Aiwa Creators operates under a strict truth policy. We state clearly which AI models process your content, how financial reserves work, how original assets remain private, and how your media is deleted after 30 days in recoverable trash.
Section 1
1. Overview & Data Controller
This Privacy Policy applies to the software services, APIs, and web platform operating under Aiwa Creators (accessible at creator.aiwamediagroup.com), operated by Aiwa Media Group LLC ("Aiwa Media Group", "we", "us", or "our"), headquartered in Muscat, Sultanate of Oman.
We act as the Data Controller for account administrative data, financial transactions, and platform security telemetry, and as a Data Processor / Service Provider for customer-uploaded media assets and generative AI workspace workloads.
Section 2
2. Information We Collect
To provide generative media workflows, we collect the following categories of information:
Account & Organization Identity
Full name, work email address, password hashes, tenant/organization affiliation, avatar, and assigned administrative permissions.
Generative Prompts & Uploaded Media
Text briefs, prompt parameters, style guidelines, and source reference image/audio assets submitted for processing.
Generated Asset Provenance
Generated images, videos, narration audio clips, job status logs, model identifiers, seed parameters, and creation timestamps.
Financial & Credit Ledger Logs
Platform credit balances, reservation tokens, micro-USD provider cost entries, OMR baisa ledger records, and billing metadata.
Section 3
3. AI Provider Processing & All-Truth Disclosure
In full transparency under our All-Truth Policy, Aiwa Creators dispatches AI generation workloads to enterprise AI inference providers strictly through our internal integration adapters (@aiwa/providers).
AI Generation Data Pipeline
Private SandboxUser prompt & reference asset ID
Zod validation & API credential filter
Immutable provenance output
Model Training & Commercial Usage Protections
No Public Model Training: Your prompts, uploaded reference files, and generated outputs are processed solely to fulfill your generation requests. Neither Aiwa Media Group nor our infrastructure providers use your private workspace media to train foundation AI models for public distribution without your explicit prior written consent.
Credential Security: Provider API credentials are kept strictly server-side inside our isolated worker environment (apps/worker). Secret credentials are never embedded into client components or exposed to web browsers.
Section 4
4. Asset Storage & 30-Day Lifecycle
Every uploaded or generated media item receives a canonical server-generated identity (Asset). User-provided filenames are treated strictly as display metadata, while storage object keys are opaque, server-generated, and tenant-isolated.
30-Day Asset Lifecycle Timeline
Recoverable StateActive Asset
Full workspace availability
30-Day Trash
Recoverable by tenant
Permanent Purge
Byte & derivative deletion
- Original Media Privacy: Full-resolution original files remain private. Dashboard grids and thumbnail views render bounded derivative variants to preserve bandwidth and privacy.
- 30-Day Recoverable Trash: Deleting an asset moves it to a recoverable 30-day trash state. Storage bytes and original/variant objects are not permanently purged from cloud storage until the 30-day lifecycle window expires or an audited operator purge completes.
- Immutable Provenance: Reorganizing assets into folders, tags, or projects preserves the immutable generation history of the job that produced the asset.
Section 5
5. Financial Ledger & Credit Reservation
Aiwa Creators enforces exact accounting integrity for platform usage:
Integer Math
Exact Micro-USD & Baisa
Monetary values are calculated as integer baisa (OMR) and micro-USD to eliminate rounding drift.
Credit Pre-Reservation
Prior to Generation
Credits are reserved before dispatching job requests. Unused reserves are refunded upon task completion.
Immutable History
Audited Ledger
Wallet history records cannot be deleted or rewritten. Adjustments are posted as audited reversal entries.
Section 6
6. Legal Bases for Processing
Under Omani PDPL and international regulations, we process personal data under the following legal grounds:
- Contractual Necessity: To deliver generation services, manage subscriptions, allocate platform credits, and store project media.
- Legitimate Business Interests: To maintain platform security, prevent unauthorized access, audit resource capacity, and optimize service performance.
- Legal Compliance: To comply with tax, commercial record-keeping, and regulatory duties under Sultanate of Oman legislation.
- Consent: For optional promotional communications, beta testing programs, or specific customer integration permissions.
Section 7
7. Third-Party Sharing & Transfers
We do not rent, sell, or trade personal information to third parties. We share information only with:
- Infrastructure Sub-Processors: High-security cloud hosts, data centers, and specialized AI execution partners (BytePlus, NVIDIA).
- Financial Institutions & Payment Gateways: Payment processors managing Oman Rials (OMR) transactions and credit grants.
- Legal & Regulatory Authorities: When required by Omani court orders, law enforcement warrants, or statutory regulations.
Section 8
8. Technical & Organizational Security
We enforce multi-layered defense to safeguard customer assets and account credentials:
Strict Schema Validation
Every external API request boundary is strictly validated using explicit Zod schemas.
Encryption Standard
TLS 1.3 encryption in transit and AES-256 storage encryption at rest across all media buckets.
Tenant Isolation
Organization-scoped authorization revalidates ownership on every folder, tag, asset, and generation job access.
No Plaintext Credential Logs
Prompts, passwords, provider keys, and customer media URLs are filtered from system logs.
Section 9
9. Your Rights & Data Subject Controls
Under Omani PDPL and international privacy laws, you possess the following rights regarding your personal data:
Request a copy of the personal data and asset metadata held about your account.
Correct inaccurate profile data, organization details, or billing contact info.
Request permanent deletion of your account, workspace assets, and generation records.
Object to specific non-essential processing activities or withdraw consent at any time.
Export your generated assets and metadata in standard file formats.
To exercise any of these rights, please contact our Data Protection Officer at [email protected]. Requests are responded to within 30 days.
Section 11
11. Children's Privacy
Aiwa Creators is an enterprise creative platform designed for adult professionals, businesses, and organizations. We do not knowingly solicit or collect personal information from individuals under 18 years of age. If we become aware that a minor has created an account, we will take immediate steps to remove the account and purge associated data.
Section 12
12. Policy Updates & Contact Information
We may update this Privacy Policy to reflect platform enhancements, operational changes, or statutory updates under Omani law. Material modifications will be announced via in-app notification or email prior to taking effect.
Data Protection Enquiries
Aiwa Media Group LLC · Legal & Privacy Office
Muscat, Sultanate of Oman