Privacy Policy

Important Information And Who We Are

1.1. Purpose Of This Privacy Policy

1.1.1. This privacy policy aims to give you information on how Videfy collects and processes your personal data through your use of the Applications and our services, including any data you may provide through direct interactions such as chatting with us via the support function on our website, creating an account, purchasing or subscribing to a service, or uploading/editing audio or video files; and passive means such as cookies, analytics, log files, and device or usage data collected automatically when you interact with our Applications.

1.2. Applicability to Children

1.2.1. The Applications and Services are not intended for children under 13 years of age (or such higher age as required under local data-protection laws).

1.2.2. We do not knowingly collect, store, or process personal data from children.

1.2.3. If we become aware that we have collected personal data from a child without verified parental consent, we will take immediate steps to delete such data in compliance with the Children’s Online Privacy Protection Act (COPPA) and applicable international laws.

1.2.4. Parents or guardians who believe that their child has provided personal data to Videfy are encouraged to contact us at legal@videfy.ai so that we may delete the information without delay.

1.3. Relationship Between Policies and Layered Notices

1.3.1. This Privacy Policy forms part of Videfy’s layered privacy notice framework and it is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data.

1.3.2. This privacy policy supplements other notices and privacy policies and is not intended to override them.

1.4. Jurisdiction and Governing Law

1.4.1. Videfy is a corporation incorporated in the State of Delaware, United States, and maintains its principal place of business at 2121 Biscayne Blvd #1997, Miami, Florida 33137, United States. Unless otherwise required by applicable local law, the law of the United States governs Videfy's data practices. Videfy complies with applicable privacy and data protection laws in each jurisdiction where it operates or where it processes personal data of residents, including but not limited to the laws referenced in the 'Your Legal Rights' section of this Policy.

1.4.2. For users located in other jurisdictions, such as the European Economic Area (EEA), United Kingdom (UK), Canada, or other regions with specific privacy regimes, Videfy complies with the applicable provisions of those laws, including but not limited to:

1.4.2.1. The General Data Protection Regulation (EU) 2016/679 (GDPR);

1.4.2.2. The UK GDPR and the Data Protection Act 2018;

1.4.2.3. The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA); and

1.4.2.4. The Personal Information Protection and Electronic Documents Act (PIPEDA) (Canada).

1.4.3. Users located in these regions may have additional rights as outlined in this Privacy Policy.

1.4.4. EU/UK Representative. Where Videfy is required by applicable law to appoint a representative in the European Economic Area or the United Kingdom, Videfy will make that appointment and update this Policy accordingly. Until such appointment is made, individuals in the EEA and UK may direct privacy inquiries to legal@videfy.ai

1.5. Controller

1.5.1. Videfy Inc. (collectively referred to as “videfy”, "we", "us" or "our" in this privacy policy) is the controller and responsible for your personal data, except where we process your personal data because you use our services as a result of your relationship with a customer to whom we supply our services (for example, if you use our services as a result of being our customer’s employee or client).

1.5.2. We have appointed a Data Privacy Manager who is responsible for monitoring compliance with this Privacy Policy and data-protection obligations. At this time, Videfy is not legally required to appoint a Data Protection Officer (“DPO”) under Article 37 GDPR; however, the Data Privacy Manager performs equivalent oversight functions.

1.5.3. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the Data Privacy Manager using the details set out below.

1.5.4. Where we process your personal data because you use our services as a result of your relationship with a customer, we are not the data controller as we process personal data on behalf of our customer as a data processor. In such cases, you should refer to our customer’s privacy policy, which will inform you as to how your personal data will be processed.

1.6. Contact Details

1.6.1. If you have any questions about this privacy policy or our privacy practices, please contact our Data Privacy Manager in the following ways:

1.6.1.1. Full legal entity name: Videfy Inc.

1.6.1.2. Email address: legal@videfy.ai

1.6.1.3. Postal address: 2121 Biscayne Blvd #1997, Miami, FL 33137, Florida, United States

1.6.2. You have the right to make a complaint at any time to your relevant data protection authority. However, we would appreciate the chance to deal with your concerns before you approach a regulator, so please contact us in the first instance.

1.7. Changes To The Privacy Policy And Your Duty To Inform Us Of Changes

1.7.1. Videfy may review and update this Privacy Policy regularly to reflect changes in our business operations, technology, or applicable law.

1.7.2. Material changes will be communicated via in-application notifications, prominent website banners, or email, as appropriate.

1.7.3. Updated versions will include a revised “Last Updated” date at the top of this document.

1.7.4. You are responsible for ensuring that any personal data you provide to us remains accurate and current throughout your relationship with Videfy.

1.8. Third-Party Links

1.8.1. Our Applications may contain links to external websites, plug-ins, or third-party services (e.g., payment processors, social logins, or analytics tools). Clicking on those links or enabling those connections may allow third parties to collect or share data about you.

1.8.2. Videfy does not control and is not responsible for the data-collection practices or content of such third parties.

1.8.3. Before submitting any personal data to a third-party platform, we recommend reviewing its privacy policy and terms of service to understand how your data will be used .

1.8.4. Videfy assesses the security and reputation of major integration partners before inclusion, but ultimate responsibility for interacting with such platforms rests with the user.

The Personal Data We Collect About You

2.1. Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). Where applicable law recognizes “pseudonymized” data, we treat data as personal if it can, directly or indirectly, single you out when combined with other information under our control.

2.2. Biometric and Biometric-Adjacent Data, including facial geometry, voice prints, and other biometric identifiers or biometric information derived from images, videos, or audio files you upload or generate through the Service. Where collected, such data is subject to heightened protections under applicable biometric data laws including the Illinois Biometric Information Privacy Act (BIPA) and equivalent state and international laws.

2.3. We may collect, use, store, and transfer different kinds of personal data about you which we have grouped together as follows:

2.3.1. Identity Data – including but not limited to first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender, any content, video or audio uploaded by you, if you are in a video or audio file uploaded to the Applications, visual and/or audio identifiers present in such audio or video files.

2.3.2. Contact Data – includes billing address, email address, and telephone numbers.

2.3.3. Financial Data – includes bank account and payment card details.

2.3.4. Transaction Data – includes details about payments to and from you and other details of services you have purchased from us.

2.3.5. Technical Data – includes internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, other technology on the devices you use to access the Applications, and information in or about the audio or video files you provide (including metadata), such as the location of a video or the date it was created.

2.3.6. Profile Data – includes your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.

2.3.7. Usage Data—includes information about how you use the Applications and services.

2.3.8. Marketing and Communications Data—includes your preferences in receiving marketing from us and our third parties, and your communication preferences

2.3.9. We also collect, use, and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

2.4. Special Categories Of Personal Data

2.4.1. We do not ask you for any Special Categories of Personal Data (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health information, and genetic and biometric data). Nor do we request information about criminal convictions and offences.

2.4.2. However, you may choose to provide us with Special Categories of Personal Data through uploading video or audio files or other data onto the Applications. Where you provide such data, you are giving us your explicit consent to process it, to the extent permitted by the applicable data protection regime.

2.4.3. If you upload content containing Special Categories of Personal Data including biometric data, health information, racial or ethnic identifiers, or religious beliefs, relating to persons other than yourself, you must:

2.4.3.1. obtain their explicit, written consent prior to uploading, specifying the nature and purpose of the processing;

2.4.3.2. retain evidence of such consent and provide it to Videfy upon request;

2.4.3.3. comply with all applicable biometric data laws in the individual's jurisdiction of residence; and

2.4.3.4. not upload such content if the relevant individual has declined to give consent.

2.4.4. Videfy does not sell or disclose biometric identifiers or biometric information to third parties for commercial purposes. Biometric data processed during AI feature use is not retained beyond the processing session unless you explicitly save the resulting output.

2.4.5. Videfy's schedule for the retention and permanent destruction of biometric identifiers and biometric information is set out in the Data Retention table in Section 9 of this Privacy Policy and constitutes Videfy's publicly available biometric data retention and destruction policy for the purposes of the Illinois Biometric Information Privacy Act (BIPA) and equivalent laws.

2.5. If You Fail To Provide Personal Data

2.5.1. Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services).

2.5.2. In such cases, we may need to cancel a service you have with us, but we will notify you if this is the case at the time.

2.6. Aggregation, Anonymization, and Safeguards

2.6.1. We employ industry-standard technical and organizational measures to anonymize or aggregate personal data where appropriate for analytics or research purposes. Once data has been anonymized in accordance with applicable law, it is no longer subject to this Privacy Policy. We review anonymization and aggregation methods periodically to ensure adequacy and compliance with evolving legal requirements.

How Is Your Personal Data Collected?

3.1. We use different methods to collect data from and about you, including the following:

3.2. Direct Interactions

3.2.1. You may provide us with Identity, Contact, and Financial Data by filling in forms or by corresponding with us by post, phone, email, or other means. This includes personal data you provide when you:

3.2.1.1. Apply for our services;

3.2.1.2. Upload audio or video files on the Applications;

3.2.1.3. Create an account on the Applications;

3.2.1.4. Subscribe to our services or publications;

3.2.1.5. Request marketing communications to be sent to you;

3.2.1.6. Enter a survey;

3.2.1.7. Provide feedback or contact us directly; or

3.2.1.8. Participate in programs, forums, or groups that we may invite you to join.

3.2.2. This also includes personal data you may provide through automated chat or AI-driven support features integrated into our Applications. We rely on your accurate and up-to-date information and encourage you to inform us promptly of any changes.

3.3. Automated Technologies Or Interactions

3.3.1. As you interact with our Applications, we automatically collect Technical Data about your device, browsing behavior, and usage patterns using cookies, web beacons, server logs, and similar technologies. We collect such data whether or not you have an account or are logged in. Examples of Technical Data collected include:

3.3.1.1. Internet Protocol (IP) address;

3.3.1.2. Browser type, version, and language settings;

3.3.1.3. Device identifiers and operating system;

3.3.1.4. Time zone and geographic location;

3.3.1.5. Browsing actions and patterns across our Applications.

3.3.2. When you visit other websites or third-party platforms that use our cookies or tracking technologies, we may also collect Technical Data regarding those interactions. Our use of cookies and related technologies is described in detail in our Cookie Policy. Unless legally exempt, we obtain your prior consent for the use of non-essential cookies through cookie banners or other mechanisms. You may manage your cookie preferences through our consent management tool or your browser settings. We also respect browser settings such as “Do Not Track,” where feasible.

3.4. Third Parties Or Publicly Available Sources

3.4.1. We may also receive personal data about you from third parties and public sources, including:

3.4.1.1. Technical Data from:

3.4.1.1.1. Analytics providers;

3.4.1.1.2. Advertising networks;

3.4.1.1.3. Search information providers.

3.4.1.2. Contact, Financial, and Transaction Data from providers of technical, payment, and delivery services.

3.4.1.3. Identity and Contact Data from data brokers, aggregators, or similar sources.

3.4.1.4. Identity and Contact Data from publicly available registers

3.5. AI Processing and Vendors.

3.5.1. Videfy uses a combination of proprietary and third-party AI technologies to deliver features such as text generation, voice synthesis, and image creation. Each provider acts as a data processor under contract with Videfy and processes information only to the extent required to provide its functionality. Videfy will not represent that a service provider or vendor meets these standards until written confirmation has been received.

3.5.2. Personal data categories shared with these AI vendors may include Identity Data, Profile Data, Usage Data, and content you upload. We implement appropriate technical, contractual, and organizational safeguards including encryption and access controls to protect your data during transfer and processing. Where applicable, data transfers to AI vendors located outside your jurisdiction are governed by Standard Contractual Clauses or other approved transfer mechanisms to ensure an adequate level of protection.

3.5.3. Any automated decision-making or profiling conducted through these AI technologies is disclosed to you. You have the right to request explanations of such automated processes, to express your views, and to seek human intervention where decisions significantly affect you.

How We Use Your Personal Data

4.1. We will only use your personal data when we have a lawful basis to do so . Most commonly, we will process your personal data in the following circumstances;

4.1.1. Performance of a contract: Where we need to perform the contract we are about to enter into or have entered into with you.

4.1.2. Legitimate interests: Where it is necessary for our legitimate business interests (or those of a third party) and your interests and fundamental rights do not override those interests.

4.1.3. Legal obligations: Where we need to comply with a legal or regulatory obligation.

4.1.4. The types of lawful bases we rely on to process your personal data are explained in the Glossary.

4.2. We generally do not rely on consent as a legal basis for processing your personal data, except in the following cases:

4.2.1. Processing of Special Categories of Personal Data (where applicable).

4.2.2. Certain automated decision-making activities (where applicable).

4.2.3. We will always seek your consent before sending you third-party direct marketing communications by email or SMS. You may withdraw consent to marketing at any time by contacting us.

4.2.4. Videfy does not sell your personal data to third parties. We do not exchange your personal information for monetary or other valuable consideration.

Purposes For Which We Use Your Personal Data

5.1. We have set out below a summary of how we plan to use your personal data, the types of data involved, and the lawful basis on which we rely for each purpose.

5.1.1. Register you as a new customer

5.1.1.1. Data types: Identity, Contact

5.1.1.2. Lawful basis: Performance of a contract with you

5.1.2. Process And Deliver Your Order (Including Managing Payments And Recovering Debts)

5.1.2.1. Data types: Identity, Contact, Financial, Transaction, Marketing & Communications

5.1.2.2. Lawful basis: (a) Performance of a contract with you, (b) Legitimate interests (debt recovery)

5.1.3. Evidence Our Claims Or Charges In Case Of Disputes

5.1.3.1. Data types: Identity, Contact, Financial, Transaction, Marketing & Communications

5.1.3.2. Lawful basis: (a) Performance of a contract with you, (b) Legitimate interests (defending claims, recovering debts)

5.1.4. Enable You To Upload And/Or Edit Video Or Audio Files On The Applications

5.1.4.1. Data types: Identity, Profile, Special Categories of Personal Data

5.1.4.2. Lawful basis: (a) Performance of a contract with you, (b) Consent (for Special Categories of Data)

5.1.5. Manage Our Relationship With You (Including Policy Updates, Surveys, Reviews)

5.1.5.1. Data types: Identity, Contact, Profile, Marketing & Communications

5.1.5.2. Lawful basis: (a) Contract, (b) Legal obligation, (c) Legitimate interests (customer engagement, record keeping)

5.1.6. Allow Participation In Prize Draws, Competitions, Surveys, Or Programs/Forums

5.1.6.1. Data types: Identity, Contact, Profile, Usage, Marketing & Communications

5.1.6.2. Lawful basis: (a) Contract, (b) Legitimate interests (service development, business growth)

5.1.7. Administer And Protect Our Business And The Applications (E.G., Troubleshooting, System Maintenance, Fraud Prevention, Security)

5.1.7.1. Data types: Identity, Contact, Technical

5.1.7.2. Lawful basis: (a) Legal obligation, (b) Legitimate interests (IT operations, security, business continuity)

5.1.8. Deliver Relevant Content/Ads And Measure Effectiveness Of Marketing Activities

5.1.8.1. Data types: Identity, Contact, Profile, Usage, Marketing & Communications, Technical

5.1.8.2. Lawful basis: Legitimate interests (customer engagement, marketing strategy)

5.1.9. Use Data Analytics To Improve Applications, Services, Marketing, And User Experience

5.1.9.1. Data types: Technical, Usage

5.1.9.2. Lawful basis: Legitimate interests (innovation, service development, marketing strategy)

5.1.10. Develop and improve our Applications and services using free-tier data (including AI training, benchmarking, and model refinement) — “Development & Improvement Processing”

5.1.10.1. Data types: Identity, Usage, Content submitted

5.1.10.2. Purpose: Develop and improve the Service using de-identified and aggregated usage data where users have opted in.

5.1.10.3. Data types: Aggregated and anonymized usage data only — not personal data, Identity Data, User Content, or uploaded media.

5.1.10.4. Lawful basis: Consent (freely given, specific, informed opt-in not bundled with account registration).

5.1.11. Suggest Products, Services, Or Features That May Interest You

5.1.11.1. Data types: Identity, Contact, Technical, Usage, Profile, Marketing & Communications

5.1.11.2. Lawful basis: Legitimate interests (service growth, customer engagement)

5.1.12. Marketing

5.1.12.1. We may use your Identity, Contact, Technical, Usage, and Profile Data to form a view on what products or services we believe may interest you. This is how we tailor our marketing.

5.1.12.2. You will receive marketing communications if:

5.1.12.3. You have requested information or purchased services from us, and

5.1.12.4. You have not opted out of marketing.

5.2. Third-Party Marketing

5.2.1. We will obtain your express consent before sharing your personal data with third parties for marketing purposes.

5.2.2. Opting out You can opt out of marketing messages at any time by:

5.2.2.1. Using the unsubscribe links in emails, or

5.2.2.2. Contacting us directly.

5.2.2.3. Opting out does not affect service-related communications (e.g., policy updates, purchase confirmations).

5.3. Cookies

5.3.1. You may configure your browser to refuse cookies or alert you when cookies are set. Please note that disabling cookies may limit functionality of the Applications. See our Cookie Policy for more details.

5.4. Change Of Purpose

5.4.1. We will only process your personal data for the purposes stated, unless we reasonably determine a new purpose that is compatible with the original. If an unrelated purpose arises, we will notify you and explain the legal basis.

5.5. Automated Decision-Making

5.5.1. We use limited algorithmic tools to personalize your experience and recommend settings within the Applications. These tools do not produce legal or similarly significant effects. Videfy does not make automated decisions that materially affect you without either your explicit consent or appropriate human review

5.5.2. Where Videfy uses automated tools that may significantly affect you, we will seek your separate, specific consent before doing so, and you may withdraw that consent at any time without affecting your access to the Service. Where Videfy relies on human review as the safeguard, you may request that any particular decision be reviewed by a member of our team by contacting legal@videfy.ai.

5.6. Rationale For Automated Decisions Includes:

5.6.1. Suggesting optimal settings or tips during service use;

5.6.2. Improving decision-making processes;

5.6.3. Ensuring consistent, unbiased, and fair treatment;

5.6.4. Minimising human error, bias, or discrimination risks;

5.6.5. Reducing risk of non-compliance with contractual obligations.

5.7. Your Rights

5.7.1. If you are subject to automated decision-making, you may:

5.7.1.1. Request an explanation of decisions;

5.7.1.2. Express your views and challenge the decision;

5.7.1.3. Request human intervention.

5.8. Notifications

5.8.1. Push notifications: You may disable them in your device settings, though this may affect your Application experience.

5.8.2. Email notifications: You may unsubscribe through links provided in our emails, or adjust communication preferences within the Applications.

Disclosures Of Your Personal Data

6.1. We may share your personal data with the following categories of recipients for the purposes outlined in the section “Purposes for which we use your personal data”:

6.1.1. Third Parties (as defined in the Glossary). These include service providers, professional advisers, regulators, and other parties that support the delivery of our services.

6.1.2. Business transfers. In the event that we sell, transfer, or merge parts of our business or assets, or where we acquire or merge with another business, your personal data may be shared with or transferred to the new owners. In such cases, the new entity will be required to use your personal data in accordance with this Privacy Policy.

6.2. We require all third parties to:

6.2.1. Treat your personal data securely and in accordance with applicable data protection laws.

6.2.2. Use your personal data only for specified purposes and strictly in line with our instructions.

6.2.3. Refrain from using your personal data for their own independent purposes.

6.3. We will not share your personal data with third parties for purposes unrelated to the lawful processing activities described in this Privacy Policy, unless you have provided explicit consent or unless we are legally obliged to do so. Additionally, we will ensure that any international data transfers are protected under appropriate safeguards, such as Standard Contractual Clauses or other approved mechanisms.

6.4. You retain the right to request details of the third-party recipients with whom your personal data has been shared, and to object to certain disclosures where legally permissible. To exercise these rights, or for any questions regarding data disclosures, please contact us at legal@videfy.ai.

International Transfers

7.1. Some of our external third parties are located outside the United States. This means that processing your personal data may involve a transfer of data to other countries whose data-protection laws may differ from those of your home jurisdiction.

7.2. Whenever we transfer personal data internationally, we ensure that an appropriate level of protection is applied by implementing one or more of the following safeguards:

7.2.1. Contractual Safeguards. We use Standard Contractual Clauses (SCCs) approved by the European Commission or International Data Transfer Agreements (IDTAs) approved in the United Kingdom, as applicable, to ensure that your personal data is protected when transferred internationally.

7.2.2. Risk Assessments and Supplementary Measures: We may conduct transfer impact assessments to evaluate the legal environment of recipient countries. Where necessary, we may implement supplementary technical, organizational, or legal measures such as enhanced encryption or restricted access controls to mitigate risks arising from local laws or practices.

7.2.3. Legal and Organisational Measures. We require all recipients of personal data to comply with privacy and security obligations that are consistent with this Privacy Policy and applicable law.

7.2.4. Technical Measures. We apply encryption, access controls, and data-minimisation principles to help maintain data integrity and confidentiality during cross-border transfers.

7.3. If you would like more information about the transfer mechanisms or safeguards we use, you may contact us at legal@videfy.ai

Data Security

8.1. We take the protection of your personal data seriously and have implemented appropriate technical and organisational security measures designed to prevent your personal data from being accidentally lost, used, accessed, altered, or disclosed in an unauthorised way.

8.2. We use encryption in transit (TLS 1.2 or higher) and at rest for stored content. Access to personal data is restricted under least-privilege principles and audited on a periodic basis.

8.3. Access to your personal data is limited strictly to employees, agents, contractors, and other third parties who have a legitimate business need to know. Such parties are required to process your data only on our instructions and are bound by confidentiality obligations.

8.4. We have also established robust procedures to deal with any suspected personal data breach. Where legally required, we will notify you and the relevant supervisory authority of such a breach without undue delay.

8.5. We encourage users to adopt best security practices, including safeguarding credentials and updating software regularly, to complement our protective measures.

Data Retention

9.1. How Long Will We Use Your Personal Data?

9.1.1. We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which it was collected. This includes satisfying any legal, regulatory, tax, accounting, or reporting obligations. We may also retain your data for a longer period in the event of a complaint or where we reasonably believe there is a likelihood of litigation arising from our relationship with you.

9.1.2. When determining the appropriate retention period, we consider:

9.1.2.1. The amount, nature, and sensitivity of the personal data;

9.1.2.2. The potential risk of harm from unauthorised use or disclosure of your data;

9.1.2.3. The purposes for which we process your data and whether these purposes can be achieved through other means; and

9.1.2.4. Applicable legal, regulatory, tax, accounting, or other requirements.

9.2. Your Rights Regarding Retention

9.2.1. You may request details of our specific retention periods for different categories of personal data by contacting us. In some circumstances, you may also request that we delete your personal data (see the “Your Legal Rights” section) or contact us at legal@videfy.ai.

9.3. UUIDs and technical identifiers

9.3.1. For analytics and preference storage, we may generate a Universally Unique Identifier (UUID) when you install our programme(s). The UUID persists across programme launches and updates, but it is erased if you delete the programme. A new UUID will be generated upon reinstallation.

9.4. Anonymisation And Aggregated Use

9.4.1. In certain cases, we will anonymise your personal data so that it can no longer be linked to you. Such anonymised information may be used indefinitely for research or statistical purposes without further notice to you.

9.5. Free-Tier Users And Development & Improvement Processing

9.5.1. If you are, or have been, a free-tier user and you exercise your right to erasure of personal data used for Development and Improvement Processing (for example, after deleting your account or upgrading to a paid subscription), we will delete such data unless we are required to retain it for legal purposes.

9.5.2. However, we may continue to use any information derived from Development and Improvement Processing provided it has been sufficiently de-identified, anonymised, or aggregated so that neither you, your content, nor any other individual can be identified.

9.6. Free-Tier AI Development and Opt-Out

9.6.1. If you use Videfy under a free-tier plan, you may choose to opt in to allow Videfy to use de-identified and aggregated usage data derived from your interactions with the Service to improve our AI models and Service functionality. This processing is not automatic and requires your separate, affirmative consent, which will be sought through a distinct consent mechanism at or after account registration and will not be bundled with acceptance of these policies or the Terms of Use.

9.6.2. This processing applies only to de-identified and aggregated usage data. It does not include your User Content, uploaded media, personal data, or Identity Data. Paid-tier and enterprise users are excluded from this processing entirely.

9.6.3. You may withdraw your consent at any time by emailing legal@videfy.ai. Videfy will process your withdrawal request within thirty (30) days. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal. Where you withdraw consent during an active free-tier subscription, the processing will cease but your account will not be affected. Data Category Default Retention Purpose / Notes Account data While account active + 3 months after account closure or deletion request, unless retention required by law To manage reactivation and support audits Billing / transaction data Minimum 3 year or as required by applicable tax, accounting, and regulatory law Tax and accounting compliance Uploaded media 30 days after account closure or deletion request, unless retention required by law Service functionality Analytics & logs Minimum 3 months Security and diagnostics Anonymised or aggregated data Indefinite Research and statistical use Biometric identifiers and biometric information Destroyed within days following completion of the processing session or purpose for which collected, unless the user explicitly saves the resulting BIPA and equivalent biometric data law compliance; not retained beyond processing session output, in which case retention follows the 'Uploaded media' schedule above

9.7. Retention schedules may vary depending on jurisdictional requirements, contractual obligations, or specific user circumstances. Personal data no longer required for processing is securely deleted or irreversibly anonymized.

Your Legal Rights

10.1. Under certain circumstances, you have rights under data protection laws in relation to your personal data. These rights apply to you to the extent required by applicable data-protection law in your country or state of residence.

10.2. Your Rights Include The Ability To:

10.2.1. Request access to your personal data (a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to verify that we are lawfully processing it.

10.2.2. Request correction of your personal data: This allows you to have any incomplete or inaccurate data we hold about you corrected. We may, however, need to verify the accuracy of the new data you provide.

10.2.3. Request erasure of your personal data: You may ask us to delete or remove your personal data where there is no valid reason for us to continue processing it. You may also request erasure where you have successfully exercised your right to object to processing, where your information has been unlawfully processed, or where local law requires deletion. Please note that we may not always be able to comply with your request for erasure for specific legal reasons. If this applies, we will inform you at the time of your request.

10.2.4. Object to processing of your personal data: You may object where we rely on legitimate interests (or those of a third party) and you believe processing impacts your fundamental rights and freedoms. You also have the right to object if we process your data for direct marketing. In some cases, we may demonstrate compelling legitimate grounds to continue processing.

10.2.5. Request restriction of processing: You may ask us to suspend processing of your data in the following scenarios:

10.2.5.1. If you want us to establish its accuracy;

10.2.5.2. Where our use of the data is unlawful but you do not want it erased;

10.2.5.3. Where you need us to hold the data even if we no longer require it, because you need it for legal claims;

10.2.5.4. Where you have objected to our use of your data but we are verifying whether overriding legitimate grounds exist.

10.2.6. Request transfer of your personal data: You may request that we provide your personal data to you or a third party of your choice in a structured, commonly used, machine-readable format. This right applies only to automated information you consented to us using or that we used to perform a contract with you.

10.2.7. Withdraw consent at any time: Where we rely on consent to process your personal data, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal. Please note that if you withdraw consent, we may not be able to provide certain services to you.

10.2.8. Free-tier users and Development & Improvement Processing : If you have opted in to Development and Improvement Processing as described in Section

9. 6, you may withdraw that consent at any time. Withdrawal will be processed

within thirty (30) days and will stop any further use of your data for AI development purposes. It will not affect processing already carried out, and it will not affect your access to the Service or your account status.

10.3. Additional information on exercising your rights

10.3.1. No fee usually required You will not have to pay a fee to access your personal data (or to exercise your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply in such circumstances.

10.3.2. What we may need from you We may request specific information to confirm your identity and to safeguard your rights. This is a security measure to ensure that personal data is not disclosed to anyone who is not entitled to receive it. We may also contact you for further details to expedite our response.

10.3.3. Time limit to respond We aim to respond to all legitimate requests within one month. If your request is particularly complex or you have made multiple requests, it may take longer. In such cases, we will inform you and keep you updated on progress.

10.4. U.S. State Privacy Rights: For residents of California and certain other U.S. states (including Virginia, Colorado, Connecticut, Utah, and Nevada), additional rights may apply under state privacy laws.

10.5. Notice at Collection. We collect the categories of personal information for the business purposes.

10.6. Right to Know, Delete, or Correct. You may request access to, correction of, or deletion of your personal information by emailing legal@videfy.ai

10.7. How to Exercise Your Rights To exercise any of your rights described in this Privacy Policy, please contact us at legal@videfy.ai We may need to verify your identity before responding. Residents of California may designate an authorized agent to make a request on their behalf by providing written authorization and verification of identity.

Glossary

11.1. Lawful Basis

11.1.1. Legitimate Interest

11.1.1.1. This means the interest of our business in conducting and managing our operations to provide you with the best services and the most secure experience. Before relying on legitimate interests, we carefully balance any potential impact on you (both positive and negative) and your rights. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent, or we are otherwise required or permitted by law).

11.1.1.2. You can obtain further information about how we assess our legitimate interests against potential impacts on you in respect of specific activities by contacting us.

11.1.2. Performance of Contract: Processing your personal data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.

11.1.3. Comply with a Legal Obligation: Processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.

11.1.4. Third Parties Service Providers and Subcontractors/Sub-processor: We use a range of trusted service providers and sub-processors to deliver our services.

11.1.5. Personal Information Collected from Connected Third-Party Accounts: We may collect and store certain information if you link your account with a connected third-party account or service. Please ensure you carefully read the privacy policy of the connected third party before linking accounts, and review the terms applicable to such connections.

11.1.6. Disconnection of Accounts: If you choose to disconnect a third-party account, we will delete the stored data associated with that account. You may also revoke access directly via the settings of the relevant third-party account.