Privacy Policy

1. Who this applies to

This policy covers anyone who creates a Zhivo account or uses the Zhivo product, regardless of where you're located. Zhivo is currently operated by its founder, pending formal business incorporation — see Section 10 for contact details, which we'll update as that changes.

2. What we collect

• Account info:email, a display name and username, and date of birth (used only to confirm you're 18+ — see Section 8 on exactly how reliable this check is).
• Character content: the photo, name, and persona description you submit to create a character. If the photo shows a real, identifiable human face, this includes biometric data — see Section 3, which is specific to this and worth reading before you upload one.
• Call content:during a live call, your audio and video are streamed in real time to our video-generation provider so it can generate the character's responses — see Section 4 for exactly where that provider is located and why that matters. We don't record or store the video or audio of the call itself. We do store a text transcript of what was said (both your side and the character's), which an automated process condenses into discrete facts ("memories") so a character can recall them in a later call with you.
• Billing:purchases are handled by Paddle.com Inc., our merchant of record; we store how many credits you've bought and used, not your card details, which never reach our servers.
• Technical & usage data: IP address, device/browser information, crash reports, and product usage events (e.g. that a call started or a character was created) — see Section 5.

3. Biometric data — read this before uploading a photo

If you upload a photo of a real, identifiable human face to create a character, that photo — and any facial geometry our video-generation provider derives from it to animate the character — is biometric data under laws like Illinois' Biometric Information Privacy Act (BIPA) and similar statutes elsewhere. This notice, together with the consent checkbox you accept at sign-up, is our disclosure of:

• What's collected: the photo itself, and facial-geometry data our video provider (Vidu S1) derives from it to generate a talking likeness during calls.
• Why: solely to generate the live video of the character you created, for as long as that character exists.
• How long: for as long as the character exists on your account, or until you delete it or your account — see Section 6.

We do not sell, license, or otherwise profit from biometric data, and we don't use it for anything beyond generating your own character's live video. If you use a photo of someone else, you're representing to us that you have their consent — see the Terms of Service, Section 4.

The same reasoning applies, to a lesser and less settled extent, to voice: some jurisdictions treat a "voiceprint" as biometric data too. Zhivo's character voices are preset, not cloned from your own voice, so this mainly concerns your own speech during a call, which is processed live to drive the conversation and is not stored as audio (see Section 2).

4. Where your data goes — including outside your country

This is the most important disclosure on this page, not boilerplate: to generate a live character during a call, your uploaded photo and your real-time call audio/video are sent to Vidu S1, operated by ShengShu Technology, and to AliRTC, operated by Alibaba Cloud— both of which process data in, or route it through, the People's Republic of China. This is a genuine international data transfer, not a formality: China does not have a data-adequacy decision from the EU, so a transfer there doesn't get the automatic legal green light that a transfer to an "adequate" country would.

Being direct about where we actually stand: we have not independently verifiedwhat specific transfer safeguard (e.g. Standard Contractual Clauses) ShengShu Technology or Alibaba Cloud has in place on their end for this transfer, beyond agreeing to their own platform terms as a paying API customer. If you're in the EU/UK and this matters to your decision to use Zhivo, please weigh that honestly — this is a real gap to close (via a proper Data Processing Agreement with Vidu, not just their standard terms) before Zhivo can make a stronger claim here, and it's on our list to do before treating this as settled.

By creating an account and starting a call, you're consenting to this transfer as necessary to provide the core feature of the product — a live AI video call. If you're not comfortable with your photo and live call audio/video being processed in China, Zhivo is not the right product for you right now.

5. Who else we share it with

Beyond the video-generation providers above, we use a small number of other third-party services, each only for what they need to do their job:

• OpenAI (United States) — screens uploaded photos and persona text before a character can go live, and helps summarize call content into the memories a character recalls later.
• Supabase — hosts our database, authentication, and file storage.
• Paddle.com Inc. — processes payments as our merchant of record and handles related tax/compliance obligations.
• Sentry — receives technical error reports (e.g. a crash log) to help us fix bugs; this can include the URL or request you were using when something broke, not your call content or persona text.
• PostHog — receives product usage events (e.g. that a call started, or a character was created) tied to your account so we can understand real retention, not your call content or persona text.

We don't sell your personal information, and we don't share it with anyone for their own independent marketing purposes.

6. How long we keep it

We keep your account, character, and memory data for as long as your account exists. Call-derived memories can be cleared on request without deleting the whole account — see Section 9. If you delete a character, its image and biometric data (Section 3) are deleted, not just hidden. If you delete your account, we delete the data described above, other than what we're required to keep for legal, tax, or fraud-prevention reasons (for example, billing records Paddle or applicable law requires us to retain for a period after a transaction).

7. Automated safety monitoring

We run an automated, deterministic check on your spoken words during a call for specific crisis-related language (for example, expressions of self-harm intent). If it matches, we show you a resources card (crisis line numbers) directly — this check does not modify, block, or get seen by the character's own AI response, and its only purpose is showing you that card. It isn't used to profile you, isn't shared with any third party beyond what's needed to run the check itself, and isn't retained separately from the normal call transcript described in Section 2.

8. Age

Zhivo is for people 18 and older. We ask for a self-reported date of birth at sign-up and don't currently verify it through any other method (like ID verification) — we're telling you this plainly rather than implying a stronger check than what actually exists. We don't knowingly collect data from anyone under 18, and we remove an account and its data promptly if we learn one belongs to a minor.

9. Your privacy rights

Regardless of where you live, you can ask us to: tell you what personal data we hold about you; correct it if it's wrong; delete your account, characters, and stored memories; or export a copy of your data. Zhivo doesn't yet have a self-service button for these — contact us at the address in Section 10 and we'll do it manually, normally within 30 days.

If you're in the EU, UK, or a similar jurisdiction, this also includes the right to object to or restrict certain processing, and the right to lodge a complaint with your local data protection authority if you're not satisfied with our response.

If you're a California resident, the CCPA/CPRA gives you the right to know, delete, correct, and opt out of the sale or sharing of your personal information, and the right not to be discriminated against for exercising these rights. We don't sell or share your personal information for cross-context behavioral advertising (as those terms are defined under the CCPA), so there's nothing to opt out of on that front today — the categories of personal information we collect, and why, are listed in Sections 2–5 above, which together serve as our notice at collection.

10. Changes to this policy, and contact

We may update this policy as the product changes, especially around the international transfer gap named honestly in Section 4. Material changes will be flagged on sign-in. Questions, or to exercise any right in Section 9, go to dbercaci@gmail.com — a dedicated address will replace this once Zhivo has its own domain.