法律文本目前只有英文版本。
Privacy Policy
This Privacy Policy describes how [AvatarGo legal entity] (“AvatarGo”, “we”, “us”) collects, uses, discloses and protects personal data in connection with its website, documentation, console, API and SDKs (the “Service”). Capitalised terms not defined here have the meaning given in our Terms of Service.
1. Our role
1.1 Controller. AvatarGo is the controller of personal data relating to our customers and their authorised users (“Customer Data Subjects”) and to visitors of our website and documentation.
1.2 Processor. When a customer uses the Service in a Customer Application, AvatarGo processes the personal data of that customer’s End Users — including their voice, the content of their conversations and related technical data — solely on behalf of and on the documented instructions of the customer, who is the controller of that data. Such processing is governed by our agreement with the customer, including our [Data Processing Addendum]. This Policy does not describe the practices of our customers. End Users should direct requests concerning their data to the customer operating the Customer Application; we will assist the customer as required by law.
1.3 Customer obligations. Customers are responsible for providing End Users with all legally required notices and for obtaining any consents required for the processing of End Users’ voice, image and conversation data through the Service.
2. Personal data we process
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, organisation, role, hashed password, sign-in records | Customer |
| Billing data | Plan, transactions, balance, billing address; card brand, last four digits and expiry (full card details are held by our payment processor) | Customer, payment processor |
| Customer Content | Images of faces and the consent confirmation recorded with them, Character instructions, scripts, documents, tool and webhook configuration | Customer |
| Session data (as processor) | End User speech processed in real time, transcripts of spoken and typed turns, recordings of sessions (the avatar’s video and the audio of both sides), session timing, time zone, connection metadata | End User via Customer Application |
| Model request logs (as processor) | The inputs sent to language models during a session (conversation history and Character instructions) and the responses received | Generated by the Service |
| Usage and technical data | API requests, IP address, device and browser information, error logs, security events | Automatically |
| Enquiry data | Name, email, company, message and estimated usage submitted through the Contact page | Website visitor |
| Cookies | A cookie storing your language preference; session cookies for signed-in users; [analytics, if any] | Automatically |
Sessions are recorded by default. A recording holds the avatar’s video, the Character’s voice and the End User’s voice. The customer can turn recording off for any session and can delete a recording at any time. End User speech is also processed in real time to produce transcripts and responses.
3. Purposes and legal bases
| Purpose | Legal basis (where GDPR/UK GDPR applies) |
|---|---|
| Providing, operating and supporting the Service, including sessions, rendering, transcripts and storage of Customer Content | Performance of contract; for End User data, the customer’s instructions |
| Billing, payment and accounting | Performance of contract; legal obligation |
| Security, fraud and abuse prevention, rate limiting and enforcement of our Terms | Legitimate interests |
| Investigating and resolving service problems, including through model request logs | Legitimate interests; for End User data, the customer’s instructions |
| Responding to enquiries submitted through the Contact page | Legitimate interests; steps prior to entering into a contract |
| Service communications (sign-in codes, receipts, account and security notices) | Performance of contract |
| Compliance with legal obligations and the establishment, exercise or defence of legal claims | Legal obligation; legitimate interests |
We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use Customer Content or End User conversations to train artificial intelligence models.
4. Disclosure
4.1 Subprocessors. We disclose personal data to service providers that process it on our behalf under written agreements imposing confidentiality and data protection obligations, including providers of:
| Function | Provider |
|---|---|
| Real-time audio and video transport | [LiveKit, Inc.] |
| GPU computing for avatar rendering | [RunPod] |
| Speech recognition, language models and speech synthesis | [OpenRouter, Deepgram, Cartesia, Fish Audio — as configured] |
| Payment processing | [Stripe, Inc.] |
| Transactional email | [Resend] |
| Hosting, databases and storage | [provider, region] |
An up-to-date list is available on request [or: at a stated URL]. We may change subprocessors and will give customers notice of changes as provided in the Data Processing Addendum.
4.2 Other disclosures. We may disclose personal data (a) where required by law, regulation, legal process or enforceable governmental request; (b) to protect the rights, property or safety of AvatarGo, our customers, End Users or others, including to investigate fraud, abuse or breaches of our Terms; and (c) in connection with a merger, acquisition, financing or sale of all or part of our business, subject to appropriate confidentiality protections.
5. International transfers
Personal data may be processed in countries other than the one in which it was collected, including the United States, which may not offer an equivalent level of protection. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. [Primary data storage region: ___.]
6. Retention
We retain personal data only as long as necessary for the purposes described above, unless a longer period is required or permitted by law:
| Data | Retention |
|---|---|
| Account and Customer Content | For the life of the account, or until deleted by the customer; deleted within [30] days of account closure, save for backups overwritten in the normal cycle of [N days] |
| Session records and transcripts | Until deleted by the customer, or until account closure [or: N days] |
| Session recordings | 7 days from the end of the session, or until deleted by the customer if sooner |
| Model request logs | 30 days |
| Webhook delivery records | 30 days |
| Technical and security logs | [N days] |
| Billing and transaction records | As required by tax and accounting law [e.g. 7 years] |
| Enquiry data | [24 months] after our last communication |
7. Security
We implement appropriate technical and organisational measures designed to protect personal data, including encryption in transit, storage of API keys only as cryptographic hashes, encryption of third-party credentials at rest, two-factor authentication and audit logging for staff access, and access on a need-to-know basis. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify affected customers and authorities of personal data breaches as required by law.
8. Your rights
8.1 Subject to applicable law, you may have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time without affecting prior processing. California residents may have the right to know, delete and correct personal information, and not to be discriminated against for exercising these rights.
8.2 To exercise your rights, contact [contact@avatargo.ai]. We will verify your identity before responding and respond within the period required by law. You may lodge a complaint with your data protection supervisory authority.
8.3 Requests relating to End User data processed on a customer’s behalf will be referred to that customer.
9. Children
The Service is not directed to children, and we do not knowingly collect personal data of children under [16] for our own purposes. Customers must not use the Service to process children’s personal data except in compliance with applicable law, including obtaining verifiable parental consent where required.
10. Changes
We may update this Policy from time to time. We will post the updated version with a new “last updated” date and, for material changes, notify customers by email or through the console in advance.
11. Contact
[AvatarGo legal entity], [address]. Email: [contact@avatargo.ai]. [EU/UK representative and data protection officer, if required.]