Draft for review. Highlighted text is a blank to fill in or a statement to confirm. Nothing highlighted may remain when this page is published.
Privacy Policy
This policy explains what information the Vizae app collects, why, who processes it, where, how long it is kept, and how you can exercise your rights. It applies to the Vizae mobile app and this website. Vizae is an invitation-only beta for adults aged 18 or older located in India.
1. Who we are
Vizae is operated by Renjith Sasidharan, proprietor trading as Vizae, B012, Euphoria, Iblur, Bangalore, India ("we", "us"). We decide how and why your personal data is processed.
- Privacy questions and requests: privacy@xalgox.site
- Grievance officer: Renjith Sasidharan, privacy@xalgox.site
2. What we collect
Your sign-in account
You sign in with Google. Google shares your Google account identifier and email address with our sign-in service (Amazon Cognito), which keeps them so you can sign in. The Vizae account itself stores an internal account number linked to that sign-in identifier, not your email address. We do not receive your Google password.
Face images and facial information
- Photo and video face swaps: the source photograph and the photo or video you choose, the transformed result, and basic file details such as type, size and dimensions.
- Live camera: your selected source photograph and live camera frames while a session runs. Live sessions do not use your microphone.
- Facial information: to transform a face, our processing software detects faces and computes facial features from these images. This happens in memory during processing, and those features are not stored.
Face images and the facial information derived from them are sensitive. We use them only to produce the result you ask for.
Service records
- Start and stop times of live sessions and of photo or video jobs, whether a job succeeded, the processing machine and region used, and how many minutes you used.
- For each signed-in device: a device name, platform and app version, so you can see and sign out your devices.
- Which version of our terms you accepted and when, and the consent you gave for face processing.
- Safety reports you send us, and a record of what we did about them.
- Server logs used for security and troubleshooting, which may include your IP address. Logs never contain your photos, videos or sign-in tokens.
Messages you send us
If you email us, we receive your email address, your message and anything you attach.
What we do not collect
We do not collect your contacts, precise location, or microphone audio. The app contains no advertising or third-party analytics code. We do not sell your personal data or use it for advertising.
3. How we use it
- To create the face swaps and live previews you request, and show them to you.
- To run your account: sign-in, devices, usage limits and minutes.
- To keep Vizae safe: to investigate faults, misuse and safety reports, and to enforce our terms.
- To show which terms you accepted and that you gave consent.
- To answer your messages and requests.
- To meet legal obligations.
We process face images only with your consent, which you give separately from accepting our terms. We rely on your consent for the rest too, and on the legitimate uses that Indian law allows, such as complying with the law.
4. Who processes your information, and where
| Provider | What they do | Location |
|---|---|---|
| Amazon Web Services | Hosts our servers, database, file storage, sign-in (Amazon Cognito) and logs | United States (us-east-1) |
| Vast.ai and the independent hosting providers who operate the rented machines | Rented GPU machines that transform faces in photos, videos and live sessions | Any country where Vast.ai offers machines, except countries to which the Government of India restricts transfers. The country can vary between sessions. |
| Signs you in with your Google account | Global | |
| ImprovMX | Forwards email sent to our xalgox.site addresses, holding each message only until it is delivered | France and the United States |
| Google (Gmail) | Stores the email you send us, and our replies | Global |
These providers process information only on our instructions. A rented GPU machine receives only the images needed for the job. It deletes photo and video files as soon as the job ends, and handles live camera frames in memory without saving them. After use, the machine is kept ready for a few minutes and then terminated. A live machine is only ever used for one person. A photo or video machine may process another job, including another user's, before it is terminated.
We do not share your information with anyone else except where the law requires it, for example in response to a valid order from a court or authority.
5. Transfers outside India
Your information is stored in the United States and may be processed in the other countries listed above. We only transfer data to countries the Government of India has not restricted, and we apply the same safeguards wherever it is processed.
6. How long we keep it
| Information | How long |
|---|---|
| Live camera frames and the source photo used in a live session | In memory only. Released when the session ends. Never saved. |
| Photos and videos you upload for a face swap, and the results | Deleted automatically. The files you upload are deleted within 3 days. Results are shown in the app for about a day and deleted within 10 days. Save a result to your device if you want to keep it. |
| Account and profile data, including the sign-in record with your email | Removed from our systems within 30 days of account deletion. |
| Session, job and usage records | While your account is open. Deleted or anonymised when your account is erased. |
| Server logs | 14 days, then deleted automatically. |
| Terms acceptance and consent records | Three years after your account is closed, so we can show what you agreed to. |
| Safety reports | One year after the report is closed. |
| Email correspondence | One year after your last message. |
| Backups | Deleted account data expires from backups within 90 days. Restoring a backup never reactivates a deleted account. |
7. Your rights and choices
- Access: download a copy of your account data from Account → Export my data in the app, or ask us by email.
- Correction: ask us to correct information that is wrong.
- Deletion: delete your account from Account → Delete account in the app, or follow the steps on our account deletion page.
- Withdraw consent: you can stop a live session or cancel a job at any time. To withdraw consent to face processing, email privacy@xalgox.site. After you withdraw, face features are unavailable. Processing done before you withdrew stays lawful.
- Nominate: you may nominate someone to exercise these rights for you if you die or become unable to act.
- Complain: contact our grievance officer (section 1). We respond within one month. If you are not satisfied, you may complain to the Data Protection Board of India.
Some records must be kept even after deletion or withdrawal, for the periods in section 6 or as the law requires.
8. Children
Vizae is only for adults aged 18 or older. Do not use images of anyone under 18. If we learn that we hold a child's information, we delete it.
9. Security
We encrypt data in transit and in storage, keep sign-in tokens in your phone's secure storage, give rented machines only short-lived access to the files a job needs, and limit access to our systems to the people who run Vizae. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.
10. Changes to this policy
We will post any change on this page with a new effective date. If a change affects how we process face images, we will ask for your consent again in the app before you use face features.
11. Contact
Renjith Sasidharan, proprietor trading as Vizae, B012, Euphoria, Iblur, Bangalore, India. Privacy: privacy@xalgox.site. Grievance officer: Renjith Sasidharan, privacy@xalgox.site.