Privacy Policy

This policy explains how Velvet Engine (“we” or “us”) handles personal data on the Velvet Engine website, in the app and in the other services described in our Terms of Service. Our contact details are at the end of this page.

It covers:

• people who use the app: customers and their team members;
• people who make an AI twin of themselves;
• people who buy from an AI creator’s store;
• people who comment on, message or email a persona;
• visitors to our website, and visitors to customers’ websites that use our tracking script (see Conversion tracking).

Account and workspace

• Your name, email address and password. Passwords are stored only as a hash, never in plain text.
• The workspaces you create or join, your team’s members, roles and invitations, and your settings.
• Sign-in sessions, including IP address and browser details, to keep your account secure.

What you make in the app

• Persona directions, offering briefs, uploaded files, and what autopilot makes from them: personas, scripts, images, videos, voices, store products and films.
• Your review decisions and edits, and your workspace’s activity log.

Social accounts and inbox

• The persona accounts you link through Zernio, the posts we publish and their analytics.
• Comments and DMs sent to a persona: the sender’s username, the message and the reply.

Persona email and saved logins

• Mail sent to a persona’s address on our domain: sender, subject, message, details of attachments (not the files) and any sign-up codes in it.
• Passwords saved for a persona’s social accounts, encrypted. We log who revealed or copied one and when, never the password itself.

AI twins

• A live selfie, up to 10 photos and, if you record one, your voice reading a consent sentence and a short passage.
• What’s made from them: a written description of your appearance, three AI reference images and, if you recorded, a clone of your voice.
• Your consent record: the consent text you agreed to (version likeness-consent-v1), your typed name, the time, your IP address and browser.

Credits and payments

• Credit purchases, grants, refunds and usage, with the price of each AI action.
• From Stripe: payment status, amounts and reference IDs. We never receive your card number.

Store orders

• The buyer’s email address, what they bought, the amount, currency and time, and which post and platform led them to the store.

Our website

• A cookie that keeps you signed in. We don’t use advertising cookies or third-party analytics on our website.
• Technical data such as IP addresses, used to run the service and limit abuse.

• To run the service: build personas, make and post videos, answer comments and DMs, run the store, deliver products and make films.
• To take payments, keep credit balances and handle refunds.
• To check content before it’s used, and to prevent fraud, abuse and security problems.
• To send service emails, such as password resets and order emails.
• To give support. Our platform admins can open a workspace as its user to help or to look into a problem; each time is recorded in our audit log.
• To keep records the law requires, such as payment and consent records.
• To see how the service is used overall, so we can improve it.

If you’re in the European Economic Area, the UK or another place with similar laws, we rely on:

• Contract: to provide the service you signed up for, and to deliver what store buyers paid for.
• Consent: for AI twins, and for tracking on customers’ websites where their visitors’ consent is needed. You can withdraw consent at any time.
• Legitimate interests: to keep the service secure, prevent abuse, handle comments and messages sent to personas, and improve the service.
• Legal obligations: to keep tax, payment and consent records and to answer lawful requests.

Your face and voice are sensitive, and some laws treat them as biometric or special category data. This is how we handle them:

• Only with your explicit consent, given by you, for yourself, in the app. You confirm that you’re 18 or older and that only you appear in the photos and recordings.
• Only for your AI twin: to make AI images, videos and audio of you for your workspace, when you, or the members you allow, choose to use it.
• Processed by three providers: Anthropic (Claude) checks that the photos show the same adult person and writes the appearance description; fal.ai runs the image and video models (from Google and Kling); ElevenLabs clones your voice and speaks with it. ByteDance models are never used with your likeness.
• Kept private: in private storage, shared with each provider only as needed, through links that expire within an hour.
• Never sold, and not used for anything else, such as identifying you elsewhere or advertising.
• Always labeled: every post made with your likeness has each platform’s AI-content setting on, and a persona made from it says in its bio that it’s your AI twin.

Revoking

You can revoke your likeness at any time on the Likeness page. Revoking deletes your photos, recording, reference images and cloned voice, pauses the personas that use it and deletes their copies of your face and voice, clears images of you in film roles, and stops new videos, images and films with it. If you leave a workspace or are removed from it, your likeness there is revoked automatically. Our platform admins can also revoke a likeness, for example after an abuse report.

Content already made stays with the workspace unless you ask for it to be removed: ask the workspace owner, or contact us. We keep your consent record as evidence, even after you revoke.

These providers help us run the service. Each gets only the data it needs for its part:

Anthropic (Claude)

Writes personas, scripts, replies and products, runs content checks and checks likeness photos.

fal.ai

Runs image and video models from Google, Kuaishou (Kling), ByteDance, Black Forest Labs and others. For AI twins, only the Google and Kling models.

ElevenLabs

Designs persona voices, turns scripts into speech and clones the voice of people who make an AI twin.

Google (Gemini)

A backup AI video model.

Zernio

Links persona social accounts, publishes posts, and reads comments, DMs and analytics.

Stripe

Payments for credits and store orders. Card details go to Stripe, never to us.

Resend

Sends our emails, such as password resets and store deliveries, and receives mail for persona addresses.

Cloudflare

DNS and network.

Our hosting provider

Hosts the servers the app runs on.

We also share personal data:

• With Instagram, TikTok and YouTube when we publish: posts become public there, under those platforms’ own policies.
• Inside a workspace: its members can see the workspace’s personas, content, inbox and orders, according to their role.
• When the law requires it, or to protect people’s safety, our rights or the service.
• With a buyer or successor if Velvet Engine is sold or merged. This policy keeps applying to your data.

Our providers may process data in the United States and other countries. Where the law requires it, we use recognized safeguards for these transfers, such as standard contractual clauses.

When you buy from an AI creator’s store, you buy from Velvet Engine, and we’re responsible for your data. We use it to deliver your product by email, with a private download link that works for 72 hours, to give support and handle refunds, to keep sales records and to see which posts lead to sales.

The workspace that runs the AI creator can see your order in the app, including your email address, so its team can resend your download link. Stripe processes your payment under its own privacy policy.

When you comment on or message a persona on Instagram, TikTok or YouTube, we receive your username and message through Zernio. AI may write or send a reply, and automated DMs say in the first message that they come from an AI character. The conversation appears in the inbox of the workspace that runs the persona.

Mail sent to a persona’s email address is stored and shown in that persona’s workspace, mainly so sign-up codes appear in the app.

Customers can put our tracking script on their own website to measure visits, clicks and conversions for offerings their personas promote. The customer is in charge of that data (the controller), and we process it on their behalf. If you visited such a site, ask its owner about your data first.

• When someone clicks a persona’s tracked link, we record the click with a salted hash of the IP address (never the address itself), browser details, country and referring page, then send them on to the site.
• On the site, the script keeps the click ID in a first-party cookie and local storage for the site’s attribution window, at most 90 days. It reports landing visits and the conversions the site sends, such as a signup or purchase, its value and the site’s own order ID.
• It sets no third-party cookies and doesn’t fingerprint visitors.
• A site can make the script wait for its visitors’ consent. Customers are responsible for their own cookie banner and privacy notice.

• Account and workspace data: while your account is open. After it’s closed, we delete or anonymize it within a reasonable time, except what we must keep.
• Payment, credit and order records: as long as tax and accounting laws require.
• Face and voice data: until you revoke your likeness, leave the workspace or close your account. Your consent record is kept after that, as evidence.
• Download links expire after 72 hours; the order itself stays in our sales records.
• Tracking click IDs stay in the visitor’s browser for the site’s attribution window, at most 90 days.
• Security and audit logs: as long as needed to protect the service and look into problems.

• Passwords are stored as hashes, never in plain text.
• Saved social logins and the platform’s service keys are encrypted at rest.
• Likeness files and store products are kept in private storage and shared only through links that expire.
• Card details never reach us; Stripe handles them.
• Workspaces are open only to their members and our platform admins, and admin actions are logged.

No system is perfectly secure. If a breach affects your personal data, we’ll tell you as the law requires.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, and to withdraw consent. You can also complain to your local data protection authority.

• Many things you can do in the app yourself: change your settings, unlink social accounts, archive products and revoke your likeness on the Likeness page.
• For anything else, including closing your account, contact us. We may need to confirm your identity, and we’ll answer within the time the law requires.
• If you live in California, you have the right to know, delete and correct your personal information, and not to be treated differently for using these rights. We don’t sell or share personal information for cross-context behavioral advertising.
• If you visited a customer’s website that uses our tracking script, contact that site’s owner; we’ll help them with your request.

Velvet Engine is only for adults. You must be 18 or older to use it, only adults can make an AI twin, and personas must not depict or target children. We don’t knowingly collect personal data from anyone under 18; if we learn that we have, we delete it.

We update this policy when the service or the law changes, and the date at the top shows the latest version. If a change matters, we’ll tell you in the app or by email before it applies.

Except where a customer is in charge of the data (see Conversion tracking), the company responsible for your personal data, and the one to contact about it, is: