Privacy Policy

1. Account data: email, name (optional), encrypted password, OAuth provider ID (Google).
2. Usage data: prompts entered, models selected, generation results metadata, credit transactions, IP address, browser/device info.
3. Uploaded content: images, videos, audio, persona reference photos you upload as input to AI models.
4. Payment data: handled by Toss Payments / PortOne / Paddle. We store transaction IDs and last-4 card digits only; full card details never touch our servers.
5. Cookies: session, authentication, analytics (Google Analytics 4, anonymized IP).

1. Provide and operate the Service (generate AI content based on your prompts).
2. Process payments and credit balances.
3. Send transactional emails (account verification, credit alerts, payment receipts).
4. Improve quality and security (anonymized aggregate analytics).
5. Detect and prevent abuse, fraud, and policy violations.
6. Comply with legal obligations (tax records, law-enforcement requests, content moderation reporting).

• Contract performance — providing the Service you signed up for.
• Legal obligation — tax records (5 years under Korean Commercial Act), content-moderation reporting for CSAM/NCII.
• Legitimate interest — security, fraud prevention, service improvement (anonymized).
• Consent — marketing emails (opt-in), promotional cookies, AI training data exclusion choices.

• fal.ai (USA) — AI model inference; receives prompts and uploaded reference media for the duration of each generation request.
• OpenAI (USA) — prompt translation and GPT Image 2 inference. OpenAI's Data Processing Addendum applies; data is not used for model training when accessed via API.
• Google Cloud / Gemini (USA) — Nano Banana Pro inference; subject to Google's Generative AI APIs Terms.
• Supabase (Singapore / USA) — database and file storage.
• Toss Payments / PortOne / Paddle — payment processing (PCI-DSS compliant).
• Resend (USA) — transactional and marketing email delivery.
• Solapi (Korea) — SMS and KakaoTalk notifications.
• Vercel (USA) — application hosting and CDN.
• Google Analytics 4 (USA) — anonymized usage analytics.
• Channel.io (Korea) — customer support chat.

• Account data: until account deletion + 30 days (recovery grace period).
• Generation history and uploaded content: until you delete it, or 365 days after account closure.
• Payment records: 5 years (Korean Commercial Act).
• Communications/dispute records: 3 years (Korean Consumer Protection Act).
• AI moderation logs (audit trail for prohibited content attempts): 2 years.

• Access, correct, or delete your personal data.
• Export your data in a portable format (data portability).
• Object to or restrict processing.
• Withdraw consent for marketing communications at any time.
• Lodge a complaint with the Korean PIPC (Personal Information Protection Commission) or your local data-protection authority.

To exercise these rights, contact contact@vivosai.com. We respond within 30 days.

1. Your prompts and uploads are sent to third-party AI providers. Do not include sensitive personal data, government IDs, financial information, or third-party personal data in prompts.
2. Generated content may resemble real persons accidentally. AI models can produce outputs that coincidentally look like real people. We do not control this. You are responsible for ensuring you have rights to publish generated content.
3. Persona library / reference uploads: face reference photos you upload to create a "persona" are stored in our Supabase Storage. You must have explicit consent from any real person whose photo you upload. Uploading non-consensual photos violates our Content Policy and may result in account termination + legal reporting.