Privacy Notice — Puw

Last updated: 9 November 2026

In short

• Puw is made and sold by Luvi Technologies, Inc. Luvi is the controller of the personal data described here; you can reach us at support@luvi.io.
• Your camera footage, event descriptions, reports and alert history stay on your PC. Luvi never receives or stores them.
• No account, no telemetry, no cloud processing. Puw does not recognize faces and records no audio.
• All Luvi receives is the license check (with the record of which Terms you accepted), purchase records, your e-mail address, your support messages (by e-mail or in the website's chat) and, if you use it, the @puw_bot link record.
• Your card details never reach Luvi; Stripe takes the payment.
• If you use @puw_bot, the alerts you chose to send to your phone pass through our server to Telegram without being stored. For that, we work on your behalf.
• If you turn on remote management, your own computers use Puw on your business's PC through our server, encrypted end to end: we pass on bytes we cannot read. Sealed receipts of your clips and alerts wait there 30 days; we see only their numbers.
• The Puw app uses no cookies and no analytics. The website measures visits with Google Analytics and, if you allow it, our ads with Google Ads; where the law requires it, we ask first. You can always say no; Google then still receives cookieless signals without a visitor ID. We do not sell personal data.
• Data is processed mostly in the US. To use your rights, write to support@luvi.io; we answer within 30 days.

1. Who we are

Puw is developed, sold and licensed by Luvi Technologies, Inc. ("Luvi", "we", "us"), a Delaware corporation. Luvi is the controller of the personal data described in this notice.

• Address: 651 N Broad St Suite 206, Middletown, DE 19709, USA
• E-mail: support@luvi.io (support, privacy and every request)
• Privacy requests by post: the same address, marked "Attn: Privacy"
• Website: https://puw.ai

Purchases and the license service run on Luvi's server at api.luw.ai. For people in Türkiye we have also published a KVKK Notice.

2. What Luvi never receives

Puw is a Windows app that watches your business's own IP cameras. It records events as short clips (it does not record 24/7) and describes them in text with an AI that runs on your PC.

• Footage, clips, the AI's descriptions, your searches, your reports and your alert history are processed and stored only on your PC. Luvi never receives, sees or stores them.
• No account is needed. Puw sends no usage data (telemetry). Footage is not uploaded to or processed in any cloud.
• Puw does not recognize faces and records no audio. The AI is instructed never to say anything about a person's identity, ethnicity, religion, age, health or emotions; it says "a woman" or "a man" only when that is clearly visible.
• You (the business owner) are the controller of the data of the people your cameras record. Luvi is neither controller nor processor of that data. Your duties are set out in the Terms of Use and License and the Shop-owner Kit.

The one exception is in your hands: if you set up phone alerts with @puw_bot, the alerts and answers you chose to send to your phone pass through Luvi's server without being stored (see section 5).

The second is also in your hands: if you turn on remote management, Puw's pages, pictures and clips travel between your own computers through Luvi's server, encrypted so that Luvi cannot read them (see section 5).

3. What we process

The table below shows every time Puw or the website goes online and every piece of personal data Luvi processes. Apart from these, Puw does not connect to the internet.

Legal bases. KVKK Art. 5/2: (c) entering into or performing a contract, (ç) our legal obligation, (e) establishing, exercising or protecting a right, (f) our legitimate interests. GDPR Art. 6(1) (for people in the European Union): (b) contract, (c) legal obligation, (f) legitimate interests. Our legitimate interests are the purposes in the "Why" column. Apart from the website's analytics and advertising, where the table says so, we do not rely on consent.

What is required? You must give your e-mail address to buy. Without the license check, Puw runs for at most 14 days. Phone alerts, Telegram questions and support are entirely optional.

As with any internet connection, every server that Puw or your browser connects to, Luvi's included, sees your IP address. Connections between Puw and our servers are encrypted (HTTPS).

4. The license check and updates

Puw checks its license with Luvi's server at first start (after you tick "I agree" to the Terms of Use and License), when you enter a license key, when you press "Check for updates", and then about once a week in the background.

• Sent: a one-way hash of your PC's Windows ID (not the ID itself; the ID cannot be recovered from it), the app version, the version of the Terms you accepted and when, and the license key if you type one.
• Never sent: footage, frames, event descriptions, camera names or names of people.
• Our server hashes the hash again before storing it, and keeps only a hash of the license key.
• If the check cannot be made, Puw keeps working offline for up to 14 days; then it stops watching the cameras until it can check again. The recordings and search on your PC stay available.
• When a newer version of Puw is out, the license check's answer says so, signed by Luvi. Puw downloads the installer from GitHub and deletes it if it does not match what Luvi signed. Puw never installs an update by itself; it is installed only when you press "Restart and update".

5. Phone alerts and @puw_bot: Luvi's role

Phone alerts are off by default and are sent only through Telegram. When you turn them on, only text is sent by default; a photo or clip is added only if you choose it for that alert. Once you set up a channel, Puw's notices about itself (Puw stopped, a camera sends no picture, a protecting setting was weakened) and the camera tampering alert are also sent unless you turn them off; they too are text only unless you choose a photo.

There are two ways to set alerts up:

• Your own Telegram bot: alerts, questions and answers go directly between your PC and Telegram. Luvi sees nothing and has no role.
• Easy setup (@puw_bot): Luvi's bot is used. Alerts and answers pass through Luvi's server (Heroku, US) on their way to Telegram.

Luvi's role with @puw_bot, in plain words:

• For the content passing through, Luvi is your courier. The legal term is processor: we act on your behalf and on your instructions. You decide what is sent (text, photo or clip) and to which chat. Luvi uses the content only to pass it on to Telegram: it does not store it, log it, use it for its own purposes or give it to anyone else. It is never written to disk: if it cannot be delivered at once, it waits in memory only, for at most 10 minutes, and is then dropped. The services Luvi uses for this are Heroku (server) and Telegram (delivery).
• For the link and heartbeat records, Luvi is the controller. The server keeps: the record that links your install to your Telegram chat (the chat number, the chat's language and a message counter that prevents abuse); only the latest of the heartbeats Puw sends every 2 minutes (whether Puw is running, and your time zone); and any block set with /report. If the heartbeat stops, the server tells you on Telegram.
• For the people in your footage, you are the controller. If you add a photo or clip to an alert, images of the people recorded pass through our server in the US and Telegram's servers abroad. You are responsible for that transfer being lawful. Where you can, use text-only alerts, and mention phone alerts in your camera notice.
• You can remove the link at any time in Puw or by sending /stop in Telegram; the link record and heartbeat are then deleted within 30 days. Every message from @puw_bot carries /stop and /report. If someone uses /report, that Puw install can no longer send messages through @puw_bot; we keep the block record so the block stays in force.

Questions from Telegram (on unless you turn them off): you can ask Puw questions from the Telegram chat that receives the alerts. The question goes to Puw on your PC; the answer, and any photo or clip you ask for, comes back to the same chat. With your own bot, your PC fetches the question from Telegram itself. With @puw_bot, the question waits in our server's memory until your Puw picks it up, 10 minutes at most, and is then dropped; the answer passes through like an alert, without being stored. Each question is also listed in Puw on your PC.

Telegram processes messages under its own terms and privacy policy.

Remote management (off until you turn it on in Puw, or with /remote in the alert chat): you can use Puw on your business's PC from your own computers anywhere, with the same pages. Both computers connect out to Luvi's server, which passes the connection on. The connection is encrypted end to end with a key only your computers have (a separate key for each computer), so Luvi passes on bytes it cannot read and cannot step into the connection. A computer is added with the owner code; Puw tells your phone when one is added, and you can remove it at any time. With remote management on, Puw also writes a numbered receipt for each clip and alert and sends it sealed to Luvi's server; Luvi sees only the number and keeps it 30 days, so your computers can see what happened even if it was deleted on that PC, and tells you on Telegram if the numbers start over, skip or change. For the content passing through, Luvi is your processor, as with @puw_bot; for Puw's record and the receipts' numbers, Luvi is the controller. If you send yourself the owner code with /remote, it passes through Telegram (and, with @puw_bot, our server) like any message: make a new code in Puw once your computer is added.

6. Purchases and payment

Puw is sold as one plan, USD 199 a year (taxes excluded). Buying works like this:

1. Stripe's payment page (Stripe Payment Links): the buy button in Puw or on puw.ai opens it directly. There you can tick "I'm purchasing as a business" and enter a tax ID. Stripe takes the payment. Stripe processes your name, billing details and card details as a controller in its own right, under its own privacy policy (https://stripe.com/privacy). Your card number never reaches Luvi. Luvi sees only your e-mail address, whether you bought as a business and the tax ID you gave, the Stripe customer and subscription IDs, your plan and the dates.
2. Confirmation e-mail: we e-mail your license key right after payment. We keep only a hash of the key, not the key itself.

You can cancel in Stripe's customer portal or by writing to support@luvi.io; the details are in the Refund and Cancellation Policy. The e-mails we send are service messages about your license and subscription; they contain no advertising.

7. Support bundle

If something goes wrong, you can create a "support bundle" in Puw. It contains the app's logs, your settings with passwords masked, and system information (Windows version, processor, memory, graphics card). It may also contain camera names, the cameras' network addresses and event times. It contains no video, frames or event descriptions.

The bundle is never sent automatically: you create the file and, if you want, e-mail it to us. We use the bundle and the support conversation only to solve your problem, and delete them 90 days after the case is closed.

8. Recipients and countries

Your support messages are held by the e-mail provider that hosts our support@luvi.io mailbox, and chat conversations by Crisp. Public authorities and courts receive information only where the law requires it.

9. Where your data is processed

Luvi is established in the US and collects your data directly from you: through the Puw app, the website and its chat, @puw_bot and e-mail. The data of our users in Türkiye and in other countries is processed in the US, by Luvi and the providers above. Part of the payment data is processed by Stripe's company in Ireland, and chat conversations are stored by Crisp in the EU.

• Türkiye: according to the Personal Data Protection Authority's guide of January 2025, a controller abroad collecting data directly from people in Türkiye is not making a transfer abroad under KVKK Art. 9. We still follow KVKK's core principles; the KVKK Notice gives the details.
• European Union: to the extent we offer Puw to people in the EU, the GDPR applies to this data (GDPR Art. 3(2)), and we act accordingly.

10. Cookies and analytics, no selling, no automated decisions

• The Puw app uses no cookies, no analytics or tracking tools, and shows no advertising.
• The website uses Google's tag (Google Analytics 4, and Google Ads when we advertise) with Google Consent Mode. In the EEA, the UK, Switzerland, Türkiye and Québec, and wherever we cannot tell your country, a banner asks first, and nothing is stored on your device until you allow it. Elsewhere there is no banner: measuring visits is on from your first visit, advertising stays off until you allow it, and Cookie settings at the bottom of the page turns either on or off. To know whether to ask, our host (Vercel) works out your country from your IP address; the site keeps only the country.
• Even if you reject, or before you choose, Google's tag still loads and sends Google cookieless signals without a visitor ID (that a page was viewed and when, the browser, an approximate location). Google uses them to estimate visits. Nothing is written to your device, and your visits cannot be linked to each other.
• If you came from one of our ads, information about the ad click can be carried from page to page in the address instead of a cookie. Without your advertising consent, ad identifiers are removed from what Google's tag sends for advertising, and nothing is stored on your device.
• If your browser sends Global Privacy Control, we take it as a no to all of the above, even over an earlier yes.
• Your choice is kept for 12 months; then we ask again. When you change it, the Google cookies you no longer allow are deleted.
• The website's cookies: puwConsent (your choice; 12 months; puw.ai only), puwCC (your country, so the site knows whether to ask; 30 days; puw.ai only), puwLang (the language you picked from the menu, so puw.ai opens in it; 12 months; puw.ai only), Crisp's chat cookies (names starting with crisp-client; set only once you open the chat; they keep your conversation; 6 months) and, only while analytics is on, Google Analytics' _ga and _ga_GF52T45SBC (up to 2 years), and, only with your advertising consent, Google's advertising cookies starting with _gcl (up to 90 days). Luvi's other sites (luw.ai) keep their own cookies and choices.
• Stripe's payment page belongs to Stripe; Stripe may use its own cookies for security and fraud prevention.
• We do not sell personal data or rent it. Only with your advertising consent does Google use your visit to measure and show our own ads; we share data with no one else for advertising.
• Luvi makes no decisions about people based solely on automated processing, including profiling. The license check automatically checks only whether a PC has a valid trial or license; if you think it got that wrong, write to us and a person will look at it.

11. Your rights and how to use them

In Türkiye, KVKK Art. 11, and in the European Union, GDPR Arts. 15–22, give you the right to:

• learn whether your data is processed, and ask for information about it and a copy of it;
• learn the purpose of processing, whether the data is used for it, and who it is transferred to;
• have wrong or incomplete data corrected;
• have your data deleted or destroyed;
• have processing restricted;
• receive your data in a common, machine-readable format (portability);
• have corrections and deletions passed on to those who received the data;
• object to processing based on legitimate interests;
• object to a decision against you based solely on automated processing;
• claim compensation if unlawful processing caused you damage.

If you live in another country, you can still send us these requests. The full text of KVKK Art. 11 is in the KVKK Notice.

How to apply:

• Write to support@luvi.io. If you can, write from the e-mail address you used to buy Puw; that helps us find your records.
• By post: Luvi Technologies, Inc., Attn: Privacy, 651 N Broad St Suite 206, Middletown, DE 19709, USA.
• We answer free of charge and within 30 days at the latest.
• We may need to verify your identity so that we do not give your data to someone else. Trial records carry no name or e-mail, so to find them we may ask for more information about your PC.
• The law requires us to keep some records (for example, accounting records). We cannot delete those before their period ends; if that is the case, we tell you why.

The KVKK Notice also explains how to apply from Türkiye.

12. Complaints

If you are not satisfied with our answer:

• In Türkiye, you may complain to the Personal Data Protection Board (https://www.kvkk.gov.tr). Under KVKK Art. 14 you must apply to us first; the complaint is made within 30 days of learning our answer, and in any case within 60 days of your application.
• In the European Union, you may complain to the data protection supervisory authority of the member state where you live, where you work or where the issue arose.
• Elsewhere, you may contact your local data protection authority.

13. Children

Puw is made for businesses. It is not meant for anyone under 18, and we do not knowingly collect data from them. If you think someone under 18 has sent us data, write to us and we will delete what the law does not require us to keep. Your cameras may record children; that footage stays on your PC and is your responsibility.

14. Changes to this notice

We update this notice when the data we process, or the way we process it, changes. The date at the top shows the latest version. We tell customers about an important change by e-mail or in Puw before it takes effect. We update this notice before we start processing data for a new purpose.

Contact

Luvi Technologies, Inc. · 651 N Broad St Suite 206, Middletown, DE 19709, USA · support@luvi.io · https://puw.ai