Privacy Policy

We collect only what is necessary to provide the service:

Account data: Email address, password (hashed), account type (Creator or Agency), registration date.

Billing data: Company name, billing address, country, VAT/tax number if provided. Payment is processed by our certified payment processor — we never store card numbers.

Onboarding data: Brand name, website, target audience, tone preferences, topics, language, logo, brand colours, reference channels.

Production data: Uploaded photos (headshots) for Talking Head format, video scripts, revision comments, approval decisions.

Technical data: IP address, browser type, session data, cookies. See Section 7.

Communication data: Emails sent and received regarding your account, videos, and billing.

We use your data exclusively to:

• Create, produce, and publish AI-generated videos for your account

• Send you video previews, script approvals, and production notifications

• Process subscription payments and issue invoices

• Provide customer support via email

• Send billing notifications and account alerts

• Comply with legal obligations (invoicing, tax records)

We do not use your data for advertising, profiling, or selling to third parties.

If you use the Talking Head feature, you upload a photo of yourself or another person. This is special category data that we treat with heightened care.

What we do with it: The photo is submitted to our AI video animation provider to generate an animated talking head video. The service animates the face to match the audio narration.

Your responsibility: By uploading a photo, you confirm via a mandatory checkbox that:

• You have the right to use this photo for AI video generation

• You (or the depicted person) consent to AI animation of their likeness

• You accept full legal responsibility for the use of the image

For Agency accounts: You additionally confirm you have obtained written consent from the person depicted.

Retention: Photos are stored in encrypted cloud storage and can be deleted from your dashboard at any time. Deletion from your dashboard triggers deletion from all processing systems within 30 days.

Provider data processing: Our AI animation provider processes the photo under their own privacy policy. We have a Data Processing Agreement with all sub-processors in place.

We use the following categories of trusted services to deliver AIVOXIS:

• **Authentication & database provider** — Secure storage of user accounts and production data (EU-hosted)

• **Payment processor** — Subscription billing and invoice generation (SCCs in place)

• **Transactional email provider** — Delivery of notifications, scripts, and alerts (EU-hosted)

• **Cloud storage provider** — Encrypted storage of produced videos and uploaded photos (EU-hosted)

• **AI voice synthesis provider** — Generation of AI narration from approved scripts (SCCs in place)

• **AI video generation provider** — Production of video visuals from scripts (SCCs in place)

• **AI video animation provider** — Talking Head photo animation (SCCs in place)

• **Web hosting provider** — Application and API hosting (SCCs in place)

All non-EU processors have Standard Contractual Clauses (SCCs) in place per GDPR Article 46. An up-to-date list of specific sub-processors is available on request at founder@aivoxis.ai.

• **Contract performance (Art. 6(1)(b)):** Processing required to deliver the AIVOXIS service — video production, publishing, billing.

• **Legitimate interests (Art. 6(1)(f)):** Service security, fraud prevention, service improvement.

• **Legal obligation (Art. 6(1)(c)):** Invoice retention (10 years, Slovenian accounting law).

• **Consent (Art. 6(1)(a)):** Talking Head photo upload, marketing emails (if opted in).

As an EU/EEA resident, you have the right to:

• **Access:** Request a copy of all personal data we hold about you

• **Rectification:** Correct inaccurate or incomplete data

• **Erasure:** Request deletion of your data ("right to be forgotten")

• **Portability:** Receive your data in a machine-readable format

• **Restriction:** Limit how we process your data

• **Objection:** Object to processing based on legitimate interests

• **Withdraw consent:** For photo uploads and marketing emails at any time

To exercise any right, email founder@aivoxis.ai with the subject "GDPR Request". We respond within 30 days. You also have the right to lodge a complaint with the Slovenian Information Commissioner (ip-rs.si).

We use the minimum necessary cookies:

• **Session cookies:** Required for login and authentication. Cannot be disabled.

• **Stripe cookies:** Required for secure payment processing. Cannot be disabled.

• **Analytics cookies:** Optional. We use privacy-respecting analytics (no fingerprinting, no cross-site tracking). You can opt out via the cookie banner.

We do not use Facebook Pixel, Google Ads tracking, or any third-party advertising cookies.

• **Account data:** Retained while your account is active + 90 days after deletion request

• **Billing records and invoices:** 10 years (Slovenian legal requirement)

• **Videos produced:** 12 months after production, then deleted unless you download them

• **Uploaded photos (Talking Head):** Until you delete them from the dashboard, or 90 days after account closure

• **Email logs:** 12 months

• All data encrypted in transit (TLS 1.3) and at rest

• Passwords hashed with industry-standard algorithms

• Database access restricted by row-level security policies

• Photo uploads stored in private, encrypted cloud buckets (not publicly accessible)

• Payment data never touches our servers — handled entirely by our certified payment processor

We will notify you by email at least 14 days before making material changes to this policy. Continued use of AIVOXIS after the effective date constitutes acceptance. The current version is always available at aivoxis.ai/privacy.