Privacy Policy

1. Data Controller

The administrator of personal data is Igor Oprządek.

Bągart 14A, Poland
E-mail: privacy[at]weborbiton.com

2. Data Protection Officer

No Data Protection Officer has been appointed.

3. Nature of the Service

MevaSearch is a private internet search engine available in a premium model.

• no search history assigned to the user
• no user profiling
• no cross-site tracking
• no tracking identifiers
• no sale of user data to third parties

4. Scope of Processed Data

Using MevaSearch requires creating an account and purchasing access through an external Payment Processor.

In connection with this, the following data may be processed:

Account Data

• e-mail address
• information about active subscription / access
• Kids Mode status (enabled/disabled), set by the account holder

Payment Data

• transactional data processed by the authorized Payment Processor. We do not store your full credit card details on our servers.

Technical Data

• IP address (exclusively for technical, security, and diagnostic purposes)
• date and time of request
• browser and device type

Search Data

• are not saved in a way that allows user identification
• are not assigned to the account
• do not create a search history
• are forwarded to external search index providers in anonymous form (see Section 8)

Photo Search Data

Photo search works only if you choose a photo yourself and agree to the notice shown the first time you use it. Here is what happens to your photo:

• On your device: before anything is sent, your browser makes the photo smaller and removes the hidden information stored in the file — such as the location where it was taken and the phone model.
• Recognition: the photo is sent to Google Gemini, an AI service (see Section 8), which tells us what is in it. If you add an optional question (for example "where can I buy it?"), it is sent together with the photo and kept just as briefly. You get a short description and the search results for it.
• Nothing is kept by MevaSearch: the photo is not saved on our servers, not written to our logs and not linked to your account. It exists only for the few seconds needed to process it.
• No face recognition: the AI is instructed never to say who a person in the photo is.
• Not for children: photo search is switched off in Kids Mode and on kids' profiles, because a child cannot give this consent on their own.
• Your plan's limit: each photo search counts as one AI query in your plan. We only count how many queries you use, not what they were.
• Illegal content: photos showing the sexual abuse or exploitation of children are refused. We then record only the time, your account number and the reason — never the photo — and after repeated attempts photo search is switched off for your account for 24 hours (see also the Terms of Service, Section 8).

5. Analytics: PriviMetrics

The service uses its own analytical system, PriviMetrics, which is privacy-first and self-hosted.

• no cookies / no user tracking
• privacy-first aggregated data (number of visits, country, browser type)

6. Purposes and Legal Basis (GDPR)

• service provision (account, premium access): Art. 6(1)(b) GDPR
• ensuring the security and operation of the service: Art. 6(1)(f) GDPR
• privacy-focused traffic analysis: Art. 6(1)(f) GDPR
• forwarding anonymous search queries to external index providers to deliver results: Art. 6(1)(b) GDPR
• forwarding anonymous queries to an AI provider to generate content summaries: Art. 6(1)(b) GDPR
• photo search (sending a photo you choose to an AI service to recognise it): your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time by clearing MevaSearch's data in your browser settings — no photo is sent again until you agree once more. Withdrawing consent does not affect searches made before.
• Kids Mode settings management (parental control feature): Art. 6(1)(b) GDPR

7. Server Logs

The server records technical logs containing the IP address exclusively for technical and security purposes.

8. Data Recipients and Sub-processors

MevaSearch uses the following external service providers. Where search queries or AI prompts are transmitted, they are forwarded in anonymous form, without any user identifier, account reference, or personal data attached. The providers listed below receive only the query text and standard technical request metadata (e.g. server-side IP of MevaSearch).

Infrastructure & Payments

• Hostinger: hosting provider (server infrastructure). Physical service files and user account data are stored on servers located in Lithuania (primary), with backup copies maintained in France. Both locations are within the European Economic Area (EEA). The service additionally uses a global Content Delivery Network (CDN) for static asset delivery (scripts, stylesheets, fonts). CDN edge nodes may be located outside the EEA; no personal user data is stored or processed at CDN nodes.
• Polar.sh (Polar Signals Inc.): payment processor and authorized reseller
• Titan Mail (Titan World Inc.): business e-mail hosting provider, used for sending and receiving account-related and support correspondence.
• Brevo (Sendinblue SAS): transactional and account-related e-mail delivery provider. Used to send service notifications (e.g. account, billing, and security-related messages) to users. Brevo's terms and privacy policy apply to this processing.

Search Index Providers (anonymous queries only)

• Brave Search API (Brave Software, Inc.): web search index. Queries are forwarded without any user identifier; only the query text and MevaSearch's server-side IP are transmitted. Data processing by the provider is governed by the standard API terms and Brave's privacy policy: brave.com/privacy. No personal data of MevaSearch users is shared with Brave.
• Mojeek API (Mojeek Ltd.): independent web search index. Queries are forwarded anonymously, without any user identifier.
• WebAtlas Index API: web search index. Queries are forwarded anonymously, without any user identifier.
• Odysee API (Odysee/LBRY, Inc.): video search index. Queries are forwarded anonymously, without any user identifier.

AI Content Generation (anonymous queries only)

• Google Gemini AI (Google LLC): powers all AI features — AI summaries above search results, MevaSearch AI chat, related searches and the AI overview in the knowledge panel. Queries are sent from our servers without your account details or any other identifier, and MevaSearch does not share any personal data of its users with Google for these features. We use Google's paid service, so under its terms Google does not use your queries or the answers to train or improve its products; it keeps them only for a limited time, solely to detect misuse of its service and where the law requires it. Google's terms apply: ai.google.dev/gemini-api/terms.
• Google Gemini AI (Google LLC), photo search: if you use photo search and agree to it, the reduced photo (without its hidden details) is sent from our servers to Google Gemini, which recognises what it shows. Your account details are not sent. We use Google's paid service, so under its terms Google does not use your photo or the answer to train or improve its products. Google keeps them only for a limited time, solely to detect misuse of its service and where the law requires it. For users in the EEA, Switzerland and the UK, Google processes this data only on our behalf, as a data processor under its Data Processing Addendum.

9. Kids Mode and Minors

When Kids Mode is active:

• SafeSearch is locked to Strict filtering
• Access to billing, payment settings, and subscription management is blocked
• The mode can only be disabled by entering the account password

MevaSearch does not collect any additional personal data from or about children. No separate child profile is created. The account remains registered to the adult account holder.

Parental responsibility: The account holder (parent/guardian) is solely responsible for enabling Kids Mode and supervising usage. MevaSearch does not guarantee complete filtering of all potentially inappropriate content and does not assume liability for content accessed through search results.

MevaSearch is a service intended for adults (18+). Minors may use the Service only under parental supervision, with the parent or legal guardian as the registered account holder.

MevaSearch does not knowingly collect personal data from children under the age of 16 without verified parental consent, in accordance with Art. 8 GDPR and applicable Polish law. Note: the age of 16 referred to in Art. 8 GDPR relates specifically to the lawfulness of processing personal data of minors, and is separate from the general requirement that the account holder must be an adult (18+).

10. Cookies and Local Storage

MevaSearch uses cookies and browser localStorage strictly for the technical operation of the Service. No advertising, tracking, or analytics cookies are used.

Cookies

• Session cookie: keeps you logged in to your account (standard/rolling 48-hour session, or 30-day rolling session with "remember me"). Strictly necessary; without it the Service cannot authenticate you.
• meva_appLanguage: stores your selected interface language. Retained for up to 12 months.

Local Storage

The Service uses browser localStorage to remember your interface preferences entirely on your device, for example:

• color theme, accent/background/text colors, and font
• SafeSearch level and search region
• result display preferences (layout, favicons, descriptions, thumbnails, link style)
• feature toggles (e.g. AI summaries, sticky search bar, related searches)
• Kids Mode status and its password hash, set by the account holder
• that you agreed to photo search, so the notice is not shown again on this device

After a photo search, the description and a small thumbnail of your photo are kept only in the current browser tab (session storage), so they can be shown above the results. They are not sent anywhere and disappear when you close the tab.

These values are stored locally in your browser, are not transmitted to or readable by MevaSearch servers, and are not shared with any third party.

• All of the above are strictly necessary for the correct display and functioning of the interface.
• No personal data is stored in these mechanisms beyond preferences you configure yourself.
• Clearing your browser storage will reset these preferences to default.

11. Retention Period

• technical logs: up to 30 days
• account data: for the duration of the service provision
• analytical data: up to 12 months
• search queries: not retained (anonymous, not stored)
• AI prompts: not retained on MevaSearch servers (processed in transit)
• photos used for photo search: not kept by MevaSearch at all; Google keeps them only for a limited time to detect misuse and where the law requires it (see Section 8)
• record of refused photo searches (time, account number and reason — never the photo): up to 90 days

12. User Rights

• access to data, rectification, and deletion
• restriction of processing and data portability
• objection to processing and withdrawal of consent
• right to lodge a complaint with a supervisory authority (PUODO, the Polish Personal Data Protection Office)

Contact: privacy[at]weborbiton.com

13. Voluntariness of Data

Providing account data is voluntary, but necessary to use the service.

14. Profiling and Automated Decisions

The service does not use profiling or automated decision-making affecting users (Art. 22 GDPR).

15. Data Transfer Outside the EEA

User account data and service files are physically hosted within the European Economic Area (EEA). Primary servers are in Lithuania, backup in France.

The following involves processing that may occur outside the EEA:

• Hostinger CDN (global content delivery network): static technical assets (scripts, stylesheets, fonts) may be cached and served from CDN edge nodes located outside the EEA, including the United States. No personal data, user account information, or search queries are stored or transmitted through CDN nodes.
• Polar.sh (Polar Signals Inc.): United States. Data transfers are subject to appropriate legal safeguards (Standard Contractual Clauses or equivalent).
• Brave Software, Inc.: United States. Anonymous queries only.
• Google LLC (Gemini AI): United States. Anonymous queries and, with your consent, photos submitted for photo search, processed under Google's API terms, its Data Processing Addendum and applicable data transfer mechanisms.
• Titan World Inc. (Titan Mail): United States. Data transfers are subject to appropriate legal safeguards (Standard Contractual Clauses or equivalent).
• Sendinblue SAS (Brevo): European Union (France). No transfer outside the EEA involved.
• Odysee/LBRY, Inc.: United States. Anonymous queries only.

All transfers involving personal data are carried out in accordance with Chapter V of the GDPR using appropriate safeguards.

16. Changes to the Policy

We reserve the right to update this policy. Users will be informed of significant changes via e-mail.