Privacy Policy

vly is operated by vly Inc. ("we", "us"). This Privacy Policy explains what personal information we collect, how we use it, and the choices you have.

• Account data — your email address and any display name and avatar you provide when signing up via OAuth.
• User content — audio you upload, transcripts we derive from it, generated audio clips, character profiles you create, and chat messages you exchange with characters.
• Usage data — basic logs of your interactions with the Service (timestamps, feature names, IP address, browser user agent) used for security, debugging, and product analytics.
• Payment data — handled by Stripe. We store the Stripe customer id, subscription status, and a credit ledger; we do not see or store your card number.

• to operate the Service (accounts, generation pipelines, billing, support);
• to enforce our Terms of Use and applicable law;
• to debug, secure, and improve the Service;
• to communicate service-related notices.

We do not sell your personal information. We do not use your User Content to train third-party foundation models without your explicit opt-in.

We share data with the minimum set of processors needed to run the Service. As of the date above:

• Hosting: Vercel, Cloudflare R2, Supabase (Postgres).
• Authentication: the OAuth providers you choose when signing in.
• Real-time voice: LiveKit Cloud.
• AI inference: Google (Gemini), Z.AI (GLM), and OpenRouter for text generation; an internal VoxCPM service for voice synthesis; Deepgram for upload transcription.
• Rate limiting: Upstash Redis.
• Payments: Stripe.

We keep account data while your account is active. User Content is retained until you delete it or close your account; Generated Content artifacts may persist in derived form (e.g. cached waveforms) for up to 90 days after deletion. Billing records are retained for the period required by U.S. federal and Delaware state tax law (currently seven years).

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, contact us at privacy@vly.live.

The Service is not directed to children under 13 (or the age set by local law). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@vly.live and we will delete it.

We use industry-standard safeguards (TLS in transit, encrypted storage at rest with our processors, access controls). No system is perfectly secure; we cannot guarantee absolute security.

Our processors may host data in the United States and other countries. By using the Service you consent to the transfer of your information to those jurisdictions, which may have different data-protection laws than your own.

We may update this Policy from time to time. Material changes will be communicated by email or in-product notice. Continued use after the effective date constitutes acceptance of the updated Policy.

Questions about this Policy: privacy@vly.live.