Privacy Policy

RUVIN GmbH Version 2026-10 Effective Date: 4 October 2026

This Privacy Policy explains how RUVIN GmbH ("RUVIN", "we", "us") processes personal data when you visit ruvin.com, use the RUVIN Creator Portal or Partner Portal, or contact us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Austrian data protection law.

1. Controller and Contact

RUVIN GmbH Stephansplatz 8/20, 1010 Vienna, Austria Company register number: FN 518975z Commercial Court of Vienna (Handelsgericht Wien) Managing Director: Bernhard Kropacek Email: contact@ruvin.com

For all privacy questions and requests, please contact us at contact@ruvin.com.

2. Website Visitors

2.1 Hosting and server logs. When you visit ruvin.com, our hosting provider processes technical data that your browser transmits, such as IP address, date and time of access, requested page, referrer and browser/device information. This is necessary to deliver the website, keep it secure and detect misuse (legitimate interest, Art. 6(1)(f) GDPR).

2.2 Analytics. We use Plausible Analytics to understand how our website is used. Plausible does not use cookies, does not create user profiles and does not track visitors across websites; we only see aggregated statistics, such as page views, referrers, clicks on outbound links and selected interactions (for example, opening a public creator profile). Legal basis: legitimate interest in operating and improving our website (Art. 6(1)(f) GDPR).

2.3 Cookies. RUVIN uses cookies that are technically necessary to provide authenticated areas of the platform, in particular login and session cookies (Art. 6(1)(f) GDPR and § 165(3) of the Austrian Telecommunications Act). We do not use advertising or marketing cookies.

2.4 Location search. On certain forms in the Creator and Partner Portals (for example, when entering the location of a photo), we use Google Maps / Places autocomplete. When this feature loads, your browser connects to Google, which receives your IP address and technical browser data. We use it to make location entry accurate and easy (Art. 6(1)(f) GDPR).

3. Creators

3.1 Account and onboarding. Creator accounts are set up by RUVIN by invitation. We process your name, email address, login data, onboarding status and the information you provide during onboarding, in order to provide your account and our services under the Creator Terms & Conditions (Art. 6(1)(b) GDPR).

3.2 Creator profiles. We process your creator name, Instagram handle, profile image, biography, location information and links you provide. Published creator profiles and photo credits are publicly visible on ruvin.com, as described in the Creator Terms & Conditions (Art. 6(1)(b) GDPR).

3.3 Photos and submissions. We process the photos you upload, related information (such as location, captions and the credited photographer and featured creator), your usage choice for each image, and technical data such as a file fingerprint used to detect duplicate uploads. Uploaded originals are stored privately; images are published only as described in the Creator Terms & Conditions (Art. 6(1)(b) GDPR).

3.4 Evidence of terms acceptance and consent. When you accept our terms, we record the exact version accepted, the time of acceptance, and your IP address and browser information. Where publication consent is given outside the platform (for example by email or direct message), we keep a record of that consent, which may include a screenshot. We keep this evidence to demonstrate that terms and consents were given and to defend legal claims (Art. 6(1)(f) GDPR).

3.5 Payouts. If you are entitled to a payout, we process your PayPal email address, payout amounts, the related licence or transaction and the payout status. Payouts are currently made manually via PayPal; PayPal processes the payment under its own privacy policy. We process this data to fulfil our payment obligations (Art. 6(1)(b) GDPR) and to meet accounting and tax obligations (Art. 6(1)(c) GDPR).

3.6 Communication. We send you service emails, for example invitations, login and account information, and notifications about your content, licences and payouts (Art. 6(1)(b) GDPR).

4. People Shown or Credited in Creator Photos

Creator photos may show or credit other people, for example a featured creator or an identifiable person in a photo. We process the image and, where applicable, the name or social media handle shown in the credit, in order to publish editorial content with correct attribution (Art. 6(1)(f) GDPR). Creators confirm that they have the necessary permissions under the Creator Terms & Conditions.

If you are shown or credited in a photo on RUVIN and want it corrected, want the credit removed, or object to the publication, please contact contact@ruvin.com. We will review your request promptly and remove or correct the content where your rights or interests prevail.

5. Partners

5.1 Partner accounts. For partner organisations, we process the names, business email addresses and roles of contact persons, as well as organisation details, in order to provide the Partner Portal and our services (Art. 6(1)(b) GDPR).

5.2 Billing and payments. We process billing details such as legal name, billing email, billing address and VAT ID, as well as licence and payment records. Payments are processed by Stripe; card and bank details are entered directly with Stripe and are not stored by RUVIN. We store the Stripe customer reference and payment status (Art. 6(1)(b) GDPR; accounting and tax obligations under Art. 6(1)(c) GDPR).

5.3 Portal activity. We process records of partner actions in the Partner Portal, such as licence purchases and accepted terms, including the time, IP address and browser information of terms acceptance (Art. 6(1)(b) and (f) GDPR).

6. Enquiries and Applications

If you contact us by email or through a form on ruvin.com (for example a partner enquiry or a creator application), we process the information you provide, such as name, email address, organisation, social media handle and your message, in order to respond and, where applicable, to assess your application (Art. 6(1)(b) and (f) GDPR). Form submissions are sent to us by email. Your IP address is used briefly to prevent misuse of the forms and is not stored.

7. AI-Assisted Editorial Tools

For internal editorial workflows, RUVIN uses AI services provided by OpenAI, for example to suggest a photo's location or to draft editorial texts and captions. This may involve sending a photo together with location information and the creator credits shown with it. These tools support our editorial team; all results are reviewed by RUVIN. We do not use automated decision-making within the meaning of Art. 22 GDPR. Legal basis: legitimate interest in efficient editorial work (Art. 6(1)(f) GDPR).

8. Administration and Security Records

We keep operational records of administrative actions, such as reviews, publication decisions, consent verification and payout processing, to run the platform, ensure accountability and prevent misuse (Art. 6(1)(f) GDPR).

9. Recipients and Service Providers

We use the following service providers, who process personal data on our behalf or, where stated, as independent controllers:

Personal data may also be disclosed where we are legally obliged to do so, or where necessary to establish, exercise or defend legal claims. We do not sell personal data and do not share it for advertising purposes.

10. International Transfers

Where personal data is transferred outside the European Economic Area, RUVIN relies on an applicable adequacy decision of the European Commission or appropriate safeguards under the GDPR, such as the EU Standard Contractual Clauses, where required.

11. Retention

We keep personal data only as long as it is needed for the purposes described in this Privacy Policy:

• Account and profile data: for as long as your account exists; after closure, we delete or anonymise it unless further retention is required for the reasons below.
• Published content and credits: as long as the content is published under the Creator Terms & Conditions, or until a valid withdrawal or objection is processed.
• Evidence of terms acceptance and consents: as long as needed to demonstrate them and to defend possible legal claims.
• Payment, payout and billing records: for the periods required by applicable tax and commercial law.
• Enquiries and applications: as long as needed to handle the enquiry or application.
• Server logs: for a short period as determined by our hosting providers' settings.

12. Your Rights

You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise your rights, contact contact@ruvin.com.

You also have the right to lodge a complaint with a data protection supervisory authority, in Austria the Austrian Data Protection Authority (Datenschutzbehörde).

13. Security

We use appropriate technical and organisational measures to protect personal data, including access restrictions, encrypted connections and private storage for non-public files.

14. Changes to this Privacy Policy

We may update this Privacy Policy when our services or legal requirements change. The current version is always available on ruvin.com, identified by its version number.