Privacy Policy
This policy details our unwavering commitment to protecting your personal data and privacy when you use the Veyo platform. Your trust is paramount to us.
INTRODUCTION: This Privacy Policy explains how VeyoLabs AI ("Company," "we," "us," or "our") collects, uses, processes, shares, and protects information in relation to our services, including the Veyo AI platform, website, and applications (collectively, the "Service"). As a company based in Romania, we operate under the General Data Protection Regulation (GDPR), and this policy is designed to uphold its principles. For the purposes of GDPR, we are the "Data Controller" for the Personal Data described herein.
We collect Personal Data to provide and improve our Service. The types of data we collect depend on how you interact with us.
1.1. Data You Provide Directly to Us
- Account and Profile Data: When you register, we collect your name, email address, password, and account type. Creators may additionally provide a profile picture, portfolio links, social media handles, and professional biography. Brands may provide company name, website, and industry.
- Financial and Payment Data: To facilitate payments and payouts on the platform, we collect certain financial information.
- For Creators: To send you your earnings, we collect your bank account details, specifically your IBAN (International Bank Account Number). This information is stored securely and used exclusively for the purpose of processing payouts.
- For Brands: We do **not** collect or store your credit card details on our servers. All payments you make are processed directly through our secure third-party payment processor, Stripe. When you enter your payment information, it is sent directly to Stripe, and we receive a secure token to confirm the payment, not your sensitive card data.
- Identity Verification Data (KYC): To comply with financial regulations, prevent identity fraud, and enforce our content governance policies, we collect identity verification data through our tiered KYC (Know Your Customer) system:
- • Tier 1 (Basic): Email address, phone number, and age attestation.
- • Tier 2 (Enhanced): Where payment or law requires KYC, a third-party KYC service may request identity and address documents through its disclosed verification flow. That KYC process is separate from the optional real-person asset scan described in Section 1A; VeyoLabs does not receive the scan capture or biometric template from that asset-validation flow.
- • Tier 3 (Premium): Enhanced review may request relevant rights or consent records for a specific use case. Government ID copies, biometric scans, or notarized forms are not a standard prerequisite for general AI persona use; any feature-specific request must explain its purpose and handling.
- Content, Prompts, and AI Persona Data: We collect and process the text prompts, images, videos, brand assets, and other files you input into our AI tools ("User Input"). A face image is personal data; it is special-category biometric data only where technical processing is used to uniquely identify a person under applicable law. The optional provider-hosted liveness flow is described separately in Section 1A.
- TAR (The Artist Room) Data: When using our Music Video Generator tool (TAR), we collect and process audio voice files, song lyrics, and related musical content you provide. By submitting this content, you acknowledge and approve that the Company will process, store, and use this data to generate music video outputs.
- Voice Act & TalkDirect AI Data: These features process the text, images, and audio you submit to generate outputs. Voice recordings are personal data and are special-category biometric data under GDPR when processed for the purpose of uniquely identifying a person. Where a feature requires explicit consent for that processing, a separate notice and affirmative choice are required; using the feature does not itself consent to the optional liveness flow in Section 1A. Third-party service processing is subject to the applicable feature and provider notices.
- Content Scanning & Moderation Data: Automated safety systems may process User Inputs and AI-generated outputs and produce content classifications, flagged-content identifiers, prompt-risk assessments, and moderation decisions. A separate feature that performs likeness matching, if used, is not the hosted liveness flow described in Section 1A and is governed by its own applicable notice. Moderation records are handled under the retention rules applicable to the relevant safety or legal purpose.
- Protective Registry Data: Individuals who voluntarily register with our Protective Registry provide a government-issued photo ID and a liveness-verified selfie. From these submissions, we generate and store only a biometric hash (a mathematical representation) — not the original images — which is used to prevent unauthorized AI-generated depictions of the registered individual's likeness. Protective Registry data is processed based on explicit consent (Art. 9(2)(a) GDPR) and may be revoked and deleted at any time.
- Incident Response Data: In the event of a content security incident (such as detection of unauthorized deepfakes, NCII, or identity fraud), we collect and preserve additional data including: the flagged content, complete prompt history, account activity logs, IP addresses, device fingerprints, and payment information. This data may be shared with law enforcement authorities as required by law. Incident response data is retained for a minimum of five (5) years or longer if required by ongoing legal proceedings.
- VeyoTV Streaming Data: When you publish or view content on VeyoTV (veyolabs.com/tv), we collect viewing analytics, engagement metrics (views, likes, comments), publication metadata, and streaming quality preferences. This data is used to deliver the streaming service and prepare for future freemium advertising monetization features currently in development.
- Communications Data: We collect data from your communications with us (e.g., support tickets) and any communications exchanged between users on the platform (e.g., campaign messages between Brands and Creators).
1.2. Data We Collect Automatically
- Usage and Analytics Data: We automatically collect information about your interactions with the Service, such as the features you use, content generated, credits consumed, time spent, and other actions taken. This helps us understand user behavior and improve the platform.
- Technical and Log Data: We collect technical information from your device, including IP address, browser type and version, operating system, device identifiers, and log files generated during your sessions.
- Cookies and Tracking Technologies: We use cookies and similar technologies to operate and personalize the Service. For detailed information, please see Article 6: "Cookies and Tracking Technologies" below.
This section applies only to the optional third-party liveness flow used to activate selected provider-gated real-person asset workflows. You may decline it; only that specific workflow remains unavailable. The scan takes place on the provider-hosted page. VeyoLabs does not directly capture, receive, or store the raw scan image/video or a biometric template in its application database for this flow. VeyoLabs remains responsible for its own processing as required by law.
A. Definitions
- Provider liveness scan: A scan performed in the third-party provider's hosted flow. Depending on how the provider processes it, the scan may be biometric or other sensitive personal data under applicable law.
- Verification result: The completion result and provider asset-group identifier returned to VeyoLabs so the selected workflow can be enabled.
- Selected persona assets: Images or videos you previously uploaded or selected in VeyoLabs. After verification, these may be sent separately to the provider for asset validation; they are not the scan capture or a scan template.
B. Business Scenarios and Purposes
If you choose this flow, the third-party provider performs the liveness check. VeyoLabs uses the returned result and group identifier only to support asset validation and access to the selected provider-gated workflow, and records that you chose to proceed. The check does not establish copyright, authorship, ownership, consent to commercial use, or legal clearance.
C. Information Processed in This Flow
- Processed by the provider: the scan data submitted on its hosted page, under the provider's applicable notice and contractual role.
- Recorded by VeyoLabs: the provider result and group identifier, plus a consent audit event containing account ID, timestamp, event/source, notice version, and connection IP address.
- Sent separately to the provider: the persona/reference images you selected for the requested asset-validation workflow.
- VeyoLabs does not receive or store the scan capture or a biometric template in its application database for this flow.
D. How the Data Are Used
- The provider checks liveness and returns a result for the requested verification session.
- VeyoLabs stores the provider result/group identifier and the limited consent audit event to operate the selected feature and document the user's choice.
- VeyoLabs does not use the scan or scan-derived biometric data for its own model training, advertising, profiling, or public identity search.
E. Retention & Deletion
VeyoLabs does not retain the provider's raw scan capture or biometric template in its application database for this flow. We retain the verification result/group identifier and consent audit metadata for feature operation, security, and legitimate record-keeping. Persona images you uploaded remain subject to the Platform's ordinary content-retention rules and may be sent separately to the provider. You can withdraw consent for future use or request deletion of VeyoLabs-held records by contacting privacy@cibeeo.com. When a persona is deleted, VeyoLabs requests deletion of its associated provider asset group where supported. We cannot promise deletion of provider-held scan data or backups on a timeline we have not verified; provider retention follows its current terms and applicable law.
F. Third-Party Provider and Responsibility
The scan is hosted and performed by the third-party verification provider. Its current privacy notice and applicable terms govern its own processing. Review those materials for details such as its role, retention, location, and further uses. VeyoLabs does not make unsupported promises about provider-side retention or deletion. We remain responsible for processing we control, as required by law.
- The provider receives scan data directly through its hosted flow and receives selected persona assets separately if you continue to asset validation.
- Before starting the scan, review the provider's current privacy notice and terms for its processing, retention, and transfer details.
- VeyoLabs does not control provider-side copies, but will handle its own records and any assistance request in accordance with applicable law and the agreements in force.
G. Your Data Rights
Depending on the provider's processing and applicable law, the scan may be special-category biometric data. You may exercise GDPR rights over the personal data VeyoLabs controls—including the verification result, group identifier, and consent audit event—and withdraw consent for future use of this optional workflow:
- Access, correction, restriction, objection, and deletion: You may request these rights for personal data VeyoLabs controls, subject to applicable law and any lawful retention exception.
- Withdrawal: You may withdraw consent for future use of this verification-dependent workflow by contacting us. The feature may then be unavailable. Withdrawal does not affect the lawfulness of processing before withdrawal.
- Provider requests: You may also need to direct requests about scan data held by the provider to that provider. VeyoLabs will assist where required by law.
- Right to Lodge a Complaint: You may lodge a complaint with your national data protection authority if you believe our processing violates your rights.
To exercise any of the above rights, submit a request directly to VeyoLabs at privacy@cibeeo.com. We will respond within the timeframe required by applicable law (generally 30 days under GDPR).
H. No Sale or Misuse
VeyoLabs does not sell or use scan data or scan-derived biometric data for advertising, behavioural profiling, or its own model training. The selected provider processes the scan under its applicable terms. This statement does not describe separate KYC, Protective Registry, voice, moderation, or AI-generation workflows, which have their own purposes and disclosures.
Our use of your Personal Data is always justified by a "legal basis" under GDPR. Here is how we use your data and the legal grounds we rely on:
To Perform Our Contract With You (Art. 6(1)(b) GDPR):
We process your data to: create and manage your account; provide the core AI generation and marketplace functionalities; facilitate and enforce agreements between Brands and Creators; and process payments, subscriptions, and payouts.
For Our Legitimate Interests (Art. 6(1)(f) GDPR):
We process data to: monitor, maintain, and improve the Service; develop new features; ensure platform security and prevent fraud; and (where permissible) to communicate with you about service updates or features. You have the right to object to this processing.
To Improve Our Services (Legitimate Interest):
We may use your Inputs and Outputs to improve and develop our Services, including for AI model training. This helps us make the platform better for everyone. As described in our Terms of Service, you have the right to opt-out of this specific use at any time via your Account settings.
To Comply With Legal Obligations (Art. 6(1)(c) GDPR):
We process data as required by law, such as for tax accounting, financial reporting, and to respond to lawful requests from authorities.
With Your Explicit Consent (Art. 6(1)(a) & Art. 9(2)(a) GDPR):
Where a feature requires explicit consent for special-category data, we request a separate affirmative choice before the relevant processing begins. Uploading an image or generating an AI Persona does not, by itself, count as consent to a face scan or biometric identification. The optional third-party liveness flow is described in Section 1A; you may decline it, in which case that provider-gated workflow is unavailable. Other feature-specific data processing is disclosed separately.
Transparency in our AI practices is a core commitment. This section outlines how we handle your data in relation to improving our AI models.
3.1. Use of Data for Service Delivery: Your User Input and Co-Created Content are necessarily processed by our AI models to provide you with the Service. This processing is fundamental to our contract with you (Legal Basis: Art. 6(1)(b) GDPR).
3.2. Use of Data for Service Improvement (AI Training): To improve the accuracy, safety, and capabilities of our AI models, we may use eligible User Inputs and Outputs for training and development as described in the Terms and available privacy controls. We do not use liveness scan captures, scan-derived biometric templates, verification/consent records, or approved real-person likeness assets for VeyoLabs model training.
3.3. Your Right to Opt-Out: You may object to or opt out of eligible Company model-training uses through the available account controls or by contacting us. We will honor the applicable choice. Data from designated Enterprise accounts is not used for Company model training. External providers may process generation inputs under their own terms; this does not change the exclusion of the liveness scan itself from VeyoLabs training.
We do not sell your Personal Data. We may share your information with the following categories of third parties ("Data Processors") only for legitimate and specified purposes:
- Community Visibility: By registering as a Creator, you acknowledge and consent that your public profile information will be displayed in the VeyoLabs Creators Community directory. By registering as a Brand or Company, you acknowledge and consent that your company profile will be displayed in the VeyoLabs Brands directory. This visibility is essential to the marketplace functionality of our Service and enables connections between Creators and Brands.
- Between Brands and Creators: A Creator's public profile is visible to Brands to facilitate connections. When a Creator applies to a campaign, their full profile may be shared with that specific Brand. Brand profiles and campaign details are visible to Creators.
- Service Providers and Vendors: We engage trusted third parties to perform services on our behalf, such as payment processing (e.g., Stripe), identity verification, cloud infrastructure and hosting, and customer support tools. These processors are contractually bound to protect your data and may only use it as instructed by us.
- Cloud Infrastructure and Storage Providers: Your data, including media files and metadata, is stored and processed using the following third-party cloud service providers, all of which maintain industry-standard compliance certifications:
- • Amazon Web Services (AWS) - Primary cloud infrastructure and S3 storage (EU-North-1 region)
- • Neon PostgreSQL - Database services for application data
- • Google Cloud Platform - AI processing and Vertex AI services
- • Other ThirdParties - Video processing and enhancement computing (temporary processing only)
- Other ThirdParties Data Handling: Data processed through Other ThirdParties is used exclusively for video processing enhancements and is temporary in nature. Upon your request, any data stored with Other ThirdParties for processing purposes will be deleted within fifteen (15) calendar days. To request deletion, contact our Data Protection Officer at the email provided in Section 11.
- Legal and Safety Reasons: We may disclose information if we have a good-faith belief that it's necessary to comply with a law, regulation, or legal process; to protect the safety of any person; to address fraud or security issues; or to protect our rights or property.
- Business Transfers: In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you and provide you with choices before your Personal Data becomes subject to a different privacy policy.
- Third-Party AI Model Providers: To provide certain functionalities, our Service may integrate with or utilize AI models from third-party providers. In such cases, your User Input is sent to these providers for processing. These providers are contractually bound to specific privacy and security obligations. However, their processing of your data is also subject to their own terms and privacy policies, which we do not control.
As we operate under GDPR, you are afforded a comprehensive set of rights regarding your Personal Data:
- The Right to Access: You can request copies of your Personal Data.
- The Right to Rectification: You can request that we correct any inaccurate information or complete any incomplete information.
- The Right to Erasure ("Right to be Forgotten"): You can request that we delete your Personal Data, under certain conditions.
- The Right to Restrict Processing: You can request that we restrict the processing of your data, under certain conditions.
- The Right to Object to Processing: You have the right to object to our processing of your Personal Data when it is based on our legitimate interests.
- The Right to Data Portability: You can request that we transfer the data we have collected to another organization, or directly to you, in a structured, commonly used, and machine-readable format.
- The Right to Withdraw Consent: Where we rely on your consent to process data, you have the right to withdraw that consent at any time.
- The Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority (supervisory authority) if you believe our processing of your data infringes on your rights.
To exercise any of these rights, please contact our Data Protection Officer at the email provided in Section 11.
We use cookies, web beacons, and similar technologies. A "cookie" is a small text file that is stored on your device when you visit a website.
- Essential Cookies: These are necessary for the Service to function and cannot be switched off. They are usually set in response to actions made by you, such as logging in or filling in forms.
- Performance and Analytics Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site.
- Functional Cookies: These enable the website to provide enhanced functionality and personalization.
You can manage your cookie preferences through the consent banner provided on our website and through your browser settings.
Security Measures: We implement robust technical and organizational security measures—including encryption, access controls, and regular security audits—to protect your Personal Data. However, no electronic storage or transmission method is 100% secure.
Retention Policy: We retain your Personal Data for as long as your account is active or as necessary to provide the Service. Afterwards, we may retain data for a period necessary to comply with our legal obligations (e.g., 7-10 years for financial records), resolve disputes, and enforce our agreements. Data that is no longer needed for any of these purposes is securely deleted or anonymized.
Account Deletion Grace Period: As outlined in Article 39 of our Terms of Service, when you request account deletion, your data enters a "Soft Delete" state for 30 days (or a 15-day security hold for accounts created within the prior 15 days) to prevent fraud and accidental data loss. During this period, your data is not publicly visible but is retained on our servers. You may cancel the deletion and restore your account at any time during this grace period. Permanent erasure occurs automatically after this grace period expires, and your data is then irrecoverably deleted from our active systems.
As a global service, your information may be transferred to and processed in countries other than your own, such as the United States, where some of our third-party service providers (e.g., Amazon Web Services for data hosting) are located. When we transfer your Personal Data from the European Economic Area (EEA) to countries outside the EEA, we ensure a similar degree of protection is afforded to it by relying on appropriate legal safeguards, primarily the European Commission's Standard Contractual Clauses (SCCs).
Our Service is not directed to individuals under the age of 18. We do not knowingly collect Personal Data from children under 18. If we become aware that we have collected Personal Data from a child under 18, we will take steps to delete such information from our files as soon as possible.
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically.
If you have any questions, concerns, or requests regarding this Privacy Policy or your Personal Data, please do not hesitate to contact our appointed Data Protection Officer (DPO):
Email: privacy@cibeeo.com
Mailing Address:
VeyoLabs AI
Attn: Data Protection Officer
Prahova, Romania