Privacy Policy

1. Who we are

VIKIO is operated by [TO BE COMPLETED — legal business name], [TO BE COMPLETED — business address]. For privacy questions, contact [TO BE COMPLETED — privacy contact email].

Where the GDPR or UK GDPR applies, we act as the controller of the personal data described in this policy.

For attorney review — Controller identity, EU/UK representative and any DPO appointment must be confirmed with counsel before launch.

2. Information you provide

• Account details: email address, password (stored only as a hash by our authentication provider) or Google sign-in identifier, and display name
• Profile details: display name, profile photo or generated avatar you save
• Onboarding answers: interests, what you are looking for in a companion, and how you identify if you choose to answer
• Companion configuration: companions you save, build or favourite, including personality, interests, communication style, appearance selections and voice choice
• Conversations: the messages you send and the replies generated for you
• Voice: audio you record in Voice Mode or as a voice message, and the text transcript produced from it
• Memories: selected facts drawn from your conversations so a companion can stay consistent
• Generated content: companion photos, scenes, avatars and audio generated at your request
• Uploads: images you upload, such as a profile or reference photo
• Support and feedback: what you write to us, including cancellation feedback if you choose to give it
• Billing-related information: your subscription state, plan, trial dates and credit transactions. Card details are collected and stored by Stripe, not by us

3. Information collected automatically

• Device and browser information, including browser type and operating system
• IP address, which is processed by our hosting and authentication providers and may indicate approximate location (typically country or region)
• Session and login activity, including sign-in events and session identifiers used to keep you signed in
• Usage data: which pages and features you use, message and voice counts used for plan limits and metering, and credit spending
• Technical logs and error reports generated when something fails
• Local storage and cookie identifiers, described in the Cookie Policy

We do not currently run third-party advertising or cross-site tracking technology on VIKIO.

4. How we use your information

• To create and secure your account and keep you signed in
• To generate companion responses and keep conversations coherent, by sending recent messages, selected memories and companion configuration to our AI provider
• To create and maintain memories and personalization, including proactive greetings and check-ins within your plan limits and notification settings
• To recommend companions that match your onboarding answers and activity
• To transcribe your speech and generate synthetic voice replies when you use voice features
• To generate images, scenes and avatars you request
• To meter usage: daily message counts, voice minutes and credit balances
• To process subscriptions, trials, renewals, cancellations and credit purchases
• To provide support and respond to your requests
• To detect, investigate and prevent abuse, fraud, security incidents and violations of the Terms of Use
• To fix bugs, monitor errors and improve how the product works
• To meet legal obligations

Legal bases (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the service you signed up for), legitimate interests (security, abuse prevention, product reliability), consent (optional cookies and any optional marketing, where applicable), and legal obligation (tax, accounting, responding to lawful requests).

Model training

We do not sell your personal data, and we do not run our own model training on your conversations. Your prompts and content are sent to third-party AI providers to generate responses for you; their handling of that data is governed by their terms and their data-processing commitments to us. If we ever wanted to use your content to train or fine-tune models, we would update this policy and, where legally required, obtain consent first.

For attorney review — Confirm the exact data-retention and training commitments in each AI provider agreement, and align this wording with them before launch.

5. Service providers and processors

VIKIO runs on infrastructure and services operated by others. We share only what each provider needs to perform its function.

• Hosting and application delivery — serves the website and server functions
• Database, authentication and file storage — accounts, profiles, conversations, memories, subscription state, credit transactions, uploaded images and voice-message audio
• Google — only if you choose Google sign-in, to authenticate you
• AI text and image generation (our AI provider gateway, which routes to the underlying model providers) — generates companion replies and generated images from the content described above
• Speech-to-text and text-to-speech (accessed through the same gateway) — transcribes your voice input and generates synthetic voice replies
• Stripe — payment processing, subscriptions, trials and billing records; Stripe handles card data as its own controller
• Email delivery — transactional email such as sign-in and account messages

We do not currently use a third-party product-analytics or advertising provider. If that changes, we will update this policy and the Cookie Policy, and obtain consent where required.

6. When we share information

Beyond the providers above, we share personal data only:

• when you ask us to
• to comply with law, legal process or a valid government or law-enforcement request
• to enforce our Terms, or to protect the rights, safety or property of users, the public or us
• in connection with a merger, acquisition, financing or sale of assets, in which case we will notify you and the acquirer will remain bound by this policy or an equivalent one

We do not sell personal information for money. We do not share personal information for cross-context behavioural advertising.

7. Data retention and deletion

We keep your account data for as long as your account exists. Conversations, memories, generated media and voice audio remain available until you delete them or delete your account.

• You can delete individual conversations and, where your plan includes memory controls, individual memories, from inside the app
• You can request account deletion from Settings. Deletion removes your profile, companions, conversations, memories and stored media from the live systems
• Some records are retained after deletion where we are required to keep them — in particular billing and tax records held by us and by Stripe, and limited security and abuse-prevention records
• Deleted data can persist for a limited period in encrypted backups maintained by our infrastructure provider before those backups roll over

Deletion is therefore not always instantaneous across every system. We do not claim otherwise.

For attorney review — Exact retention periods for backups, billing records and abuse logs must be confirmed and stated numerically before launch.

8. Security

We use access controls, row-level database security scoped to your user account, authenticated server functions, signed URLs for private files, and transport encryption (HTTPS) between your device and our providers. Payment card data never reaches our systems.

No online service can be completely secure, and we do not claim to be. You are responsible for keeping your password safe. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires it.

9. International transfers

Our providers operate globally, so your data may be processed in countries other than your own, including the United States. Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on the transfer mechanisms offered by those providers, such as the European Commission's Standard Contractual Clauses.

For attorney review — Confirm the transfer mechanism actually in place with each provider, and complete a transfer impact assessment if required.

10. Your privacy rights

Depending on where you live, you may have some or all of the rights below. Contact [TO BE COMPLETED — privacy contact email] to exercise them; we may need to verify your identity, and we will not discriminate against you for making a request.

• Access — get a copy of the personal data we hold about you
• Correction — fix inaccurate or incomplete data
• Deletion — delete your account and associated data, subject to the retention above
• Portability — receive certain data in a machine-readable format
• Restriction and objection — limit or object to certain processing, including processing based on legitimate interests
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing
• Cookie preferences — change your cookie choices at any time from Cookie Settings in the footer
• Marketing opt-out — unsubscribe from any marketing email
• Complain — lodge a complaint with your local data-protection authority

EEA, UK and Switzerland

If the GDPR or UK GDPR applies to you, the rights above apply as described in those laws, and you may complain to your supervisory authority.

California and other US states

If you are a California resident, the CCPA/CPRA gives you rights to know, delete, correct and opt out of sale or sharing, and to limit use of sensitive personal information. As stated above, we do not sell or share personal information for cross-context behavioural advertising. Residents of other US states with comprehensive privacy laws have comparable rights, which we honour where those laws apply.

We do not claim universal compliance with every privacy regime worldwide. Your rights depend on the law that applies to you.

For attorney review — Verify which US state privacy laws apply based on user volume and revenue thresholds, and whether an authorized-agent process and a 'Your Privacy Choices' link are required.

11. Do Not Track and Global Privacy Control

Because VIKIO does not use advertising or cross-site tracking cookies, there is nothing to opt out of for targeted advertising. Browsers vary in how they implement Do Not Track, and there is no common standard, so we do not respond to DNT headers. If we introduce technology that a Global Privacy Control signal would apply to, we will honour that signal where the law requires it.

12. Children

VIKIO is for adults. You must be at least 18 to use it. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact [TO BE COMPLETED — privacy contact email] and we will delete the account and its data.

13. Changes to this policy

We will update this policy as the product changes. We update the version and last-updated date, and for material changes we notify you in the app and, where required, ask for your consent.

Version 1.0 · Effective [TO BE COMPLETED — date] · Last updated [TO BE COMPLETED — date].

14. Contact us

Privacy contact: [TO BE COMPLETED — privacy contact email].

[TO BE COMPLETED — legal business name], [TO BE COMPLETED — business address].