This policy explains how Viro ("Viro", "we") handles personal information when you use virotok.com and the Viro web app. The short version: your selfie is used only to make the trend you picked and is deleted within 24 hours, we do not sell or share your information for advertising, and we do not use advertising trackers.
What we collect
| Category | What | Source |
|---|---|---|
| Identifiers | Email address; name and profile picture if you sign in with Google or add a name; account ID; IP address | You, Google, your device |
| Photos and prompts | Photos you upload and any text you add to a trend | You |
| Biometric information | Facial geometry the AI may derive from your photo while generating (see below) | Your photo |
| Generated content | Results made for you, and whether you made them public | The Service |
| Commercial information | Plan, its status, purchase history and credit balance. Card details go straight to Stripe; we never see or store them | You, Stripe |
| Internet activity | Browser and device information and short-lived security logs | Your device |
We do not collect precise location (location metadata is removed from photos), and we do not build profiles or draw inferences about you.
How we use it
- To run your account, generate results, keep your credit balance and process payments.
- To send sign-in codes, purchase confirmations, renewal reminders and other service emails.
- To prevent fraud and abuse, keep the Service secure, enforce our terms and comply with the law.
- To understand how the site is used and which pages lead to sign-ups and purchases, through web analytics.
Your photos and biometric information
To put your face into a trend, the AI provider processes the face in your photo, which may involve creating facial geometry. Some US state laws, including those of Illinois, Texas and Washington, treat this as biometric information. Our practices:
- Consent first. Before you upload a photo, we ask you to agree to this processing. Upload only photos of yourself or of people who agreed to it.
- One purpose. It is used only to generate the result you asked for. We do not use it to recognise, identify or track anyone, and we do not use your photos to train AI models.
- Limited sharing. It is disclosed only to the AI provider that generates the result, under a contract limiting its use to that task.
- Never sold. We do not sell, lease, trade or otherwise profit from it.
- Retention and destruction. Uploaded photos, and any biometric information derived from them, are permanently deleted within 24 hours of upload, and in any case once the generation is complete or no later than the earliest time required by law.
- Protected. Photos are re-encoded on upload (removing metadata such as location), stored privately and encrypted in transit.
Who we disclose it to
We do not sell personal information and do not share it for cross-context behavioural advertising or targeted advertising. We disclose it only to service providers that process it on our behalf under contract:
- Cloudflare: hosting, storage, bot protection (Turnstile) and cookie-free web analytics.
- Google Analytics: site usage statistics (pages viewed, the trend you open, sign-up and checkout steps), with advertising features turned off.
- A third-party AI provider: generating results from your photos and prompts.
- Stripe: payments and subscriptions.
- Resend: sending sign-in codes and service emails.
- Google: only if you choose to sign in with Google.
We may also disclose information when the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business (with this policy continuing to apply). Your information is processed in the United States.
Cookies, Do Not Track and Global Privacy Control
We use one essential cookie to keep you signed in. Cloudflare Turnstile may set cookies needed to tell people from bots. Google Analytics sets first-party cookies (_ga) to count returning visitors, except in the European Economic Area, the UK and Switzerland and in browsers that send a Global Privacy Control signal, where it runs without cookies. We use no advertising or cross-site tracking cookies and do not track you across other sites, so the Service works the same whether or not your browser sends a Do Not Track signal. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, although we do neither.
How long we keep it
| Information | Kept for |
|---|---|
| Uploaded photos and biometric information | Deleted within 24 hours |
| Results, account and credit history | Until you delete your account |
| Payment records held by Stripe | As long as tax and accounting law requires |
| Security logs | Short periods, then deleted |
Your privacy rights
You can delete your account and its data at any time from your account page. Depending on your state (including California, Colorado, Connecticut, Virginia, Texas and others with consumer privacy laws), you also have the right to:
- know what personal information we collect, use and disclose, and get a copy of it in a portable format;
- correct inaccurate information;
- delete your information;
- opt out of sale, sharing, targeted advertising and profiling (we do none of these);
- limit the use of sensitive personal information (we use it only to provide the Service);
- not be discriminated against for exercising these rights.
To make a request, email support@virotok.com from the email address on your account, or ask an authorised agent to do so with your signed permission. We verify requests by confirming control of that email address and respond within 45 days. If we decline your request, you can appeal by replying with the subject "Privacy appeal"; we answer appeals within 60 days, and if you are not satisfied you can contact your state attorney general.
California residents may also ask, once a year, whether we disclosed personal information to third parties for their direct marketing purposes. We do not.
Children
Viro is not for anyone under 18, and photos of people under 18 are not allowed. We do not knowingly collect personal information from children under 13. If you think a child's information has reached us, write to us and we will delete it.
Security
Information is encrypted in transit, photos and results are stored privately, and access to them is limited to what the Service needs. No system is perfectly secure, but we work to protect your information and will notify you of a breach that affects you as the law requires.
Changes and contact
We will update this page when our practices change, show the new date at the top, and tell you about significant changes before they apply. Questions or requests: support@virotok.com.