1. Who We Are
Velorai is an AI-powered companion application operated by Velorai ("we," "us," or "our"). We are the data controller responsible for your personal data collected through the Velorai mobile application and related services (collectively, the "Service").
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. It applies to all users worldwide and complies with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA) as amended by the CPRA, and other applicable privacy laws.
By accessing or using Velorai, you acknowledge that you have read this Privacy Policy and understand its contents. If you do not agree with our practices, please do not use the Service.
2. Information We Collect
2.1 Information You Provide Directly
- Account Information: Email address, encrypted password, display name, and profile preferences when you register.
- Conversation Data: Text messages you send to AI characters, selected recent conversation history, conversation summaries and memories derived from your chats, AI-generated responses, and any feedback or reactions you provide.
- Voice Data: Voice recordings you choose to send, their file URLs and technical metadata, speech-to-text transcripts, and synthesized AI voice replies.
- Payment & Transaction Information: Subscription plan details and transaction receipts processed through Google Play Billing or Apple App Store. We do not collect or store full credit card numbers.
- Customer Support Communications: Any messages, emails, or feedback you send through our support channels.
- User-Generated Content: Any custom character settings, preferences, or content you create within the App.
2.2 Information Collected Automatically
- Device Information: Device type, model, manufacturer, operating system version, unique device identifiers, and system language settings.
- Usage Data: App features used, session duration, interaction frequency, in-app navigation patterns, and crash/error reports.
- Network Information: IP address, connection type (Wi-Fi/cellular), and approximate geographic location (country/city level).
- App Performance Data: App version, loading times, response latency, and error logs.
2.3 Data Sent to Third-Party AI and Voice Providers
Velorai first receives your data on its servers and then transmits the data described below to third-party providers. Routing the data through Velorai does not change the fact that the data is sent to and processed by those providers.
- AI text conversation: the message you submit, selected recent messages, relevant conversation summaries and memories, and character instructions may be sent to Volcengine (including Ark, a ByteDance-affiliated service) or OpenAI to generate, evaluate, format, or safety-check an AI reply and to maintain conversation context.
- Speech recognition: when you send a voice message, the recording or a temporary download URL for the recording is sent to Volcengine/ByteDance speech services, or to OpenAI when that provider is configured, to convert the recording into text. The transcript is then processed as conversation data.
- Text-to-speech: the AI reply text and limited voice-delivery instructions may be sent to Volcengine/ByteDance speech services or OpenAI to create the audio reply.
- Image generation: image prompts and, where a feature uses one, a reference image may be sent to OpenAI or Volcengine Ark to generate an image.
These transfers are used only to provide the AI conversation, speech recognition, voice synthesis, image generation, safety, and conversation-context functions you request. Velorai does not intentionally include your account password, payment card details, email address, or phone number in an AI request. However, anything you type, say, or upload—including personal or sensitive information you include yourself—may be contained in the request.
Use of these third-party AI features requires a separate, explicit in-app consent. If you decline or later withdraw consent, Velorai will not make new third-party AI transmissions for your account and the affected AI features will be unavailable. A materially different provider, data type, or purpose will require an updated disclosure and, where required, renewed consent.
Provider privacy information: Volcengine and OpenAI.
2.4 Information from Third-Party Platforms
If you sign in via a third-party account (e.g., Google Sign-In), we may collect your name, email address, and profile picture as authorized by your privacy settings on that platform.
3. How We Use Your Information
We use the collected information for the following purposes:
- Service Delivery: To provide, operate, and maintain the Service, including generating AI-powered conversations and personalized content;
- Account Management: To create, manage, and authenticate your account;
- Payment Processing: To process subscription payments and manage billing via Google Play or Apple App Store;
- Service Improvement: To monitor and analyze usage patterns and improve Service functionality;
- Safety & Security: To detect, prevent, and address technical issues, fraud, abuse, and security vulnerabilities;
- Communications: To send service-related announcements, security alerts, and administrative messages;
- Marketing (with consent): To send promotional messages where you have opted in. You may opt out at any time;
- Customer Support: To respond to your comments, questions, and support requests;
- Legal Compliance: To comply with applicable legal obligations;
- AI Quality & Safety: To evaluate response quality, prevent prohibited content, troubleshoot failures, and maintain conversation summaries and memories needed for continuity. We will not use your conversation or voice data for a materially different purpose, such as advertising or training a general-purpose model, without a separate disclosure and consent where required.
4. Legal Basis for Processing (GDPR/UK GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:
- Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Service;
- Legitimate Interests (Art. 6(1)(f)): Processing for service improvement, fraud prevention, security, and analytics;
- Consent (Art. 6(1)(a)): Processing based on your explicit consent for marketing communications. You may withdraw consent at any time;
- Legal Obligation (Art. 6(1)(c)): Processing necessary to comply with applicable laws.
5. How We Share Your Information
We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:
5.1 Service Providers (Data Processors)
- Volcengine/ByteDance: Receives the AI and voice data described in Section 2.3 to provide text generation, speech recognition, and text-to-speech services;
- OpenAI: Receives the AI, image, or voice data described in Section 2.3 when an OpenAI-powered route is used;
- Alibaba Cloud OSS: Stores and delivers generated images and voice files. A voice-recording URL may be supplied to the configured speech-recognition provider so it can retrieve and transcribe the recording;
- Other Cloud Hosting Providers: For server infrastructure, data storage, and content delivery;
- Analytics Providers: For usage analytics and crash reporting;
- Payment Platforms: Google Play Billing and Apple App Store handle all payment processing;
- Email Service Providers: For sending transactional and verification emails.
5.2 Legal Compliance & Safety
We may disclose your information if required by law, court order, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Velorai, our users, or the public.
5.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.
5.4 With Your Consent
We may share information with third parties when you give us explicit consent to do so.
6. Third-Party Services & SDKs
The Service integrates with the following third-party services and SDKs, each with its own privacy policy:
These third-party services may collect, use, and share data in accordance with their own privacy policies. We encourage you to review them.
7. International Data Transfers
Your information may be transferred to and processed in countries outside your country of residence, including the United States and China where our service providers operate. When we transfer data internationally, we implement appropriate safeguards, including Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.
8. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy. Specific retention periods:
- Account Information: Retained for the duration of your account. Permanently deleted within 30 days of account deletion;
- Conversation Data: Retained for the duration of your account. Deleted or fully anonymized within 30 days of account deletion;
- Payment & Transaction Records: Retained for 7 years (or as required by applicable tax regulations);
- Usage Logs & Analytics: Anonymized within 90 days. Fully deleted within 26 months;
- Support Communications: Retained for 3 years after resolution;
- Marketing Consent Records: Retained for the duration of your account plus 5 years for compliance.
9. Data Security
We implement comprehensive technical and organizational measures to protect your personal information:
- Encryption in Transit: All data transmitted between the App and our servers is encrypted using TLS 1.2 or higher;
- Encryption at Rest: Sensitive data stored in our databases is encrypted using AES-256 encryption;
- Password Security: Passwords are hashed using bcrypt with unique salts;
- Access Controls: Employee access to personal data is restricted on a need-to-know basis with role-based access controls;
- Infrastructure Security: Servers are hosted in secured data centers with firewalls and intrusion detection systems;
- Incident Response: We maintain a data breach response plan and will notify affected users and supervisory authorities within 72 hours as required by GDPR.
10. Your Privacy Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Right of Access: Request a copy of the personal data we hold about you;
- Right to Rectification: Request correction of inaccurate or incomplete data;
- Right to Erasure: Request deletion of your personal data ("right to be forgotten");
- Right to Restrict Processing: Request that we limit how we use your data;
- Right to Data Portability: Receive your data in a structured, machine-readable format;
- Right to Object: Object to processing based on legitimate interests;
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent;
- Right to Lodge a Complaint: File a complaint with your local data protection authority.
How to Exercise Your Rights
- In-App: Go to Settings → Account → Delete Account to delete your data;
- Email: Contact us at support@velorai.cc with your request.
We will respond to verifiable requests within 30 days. We may need to verify your identity before processing your request.
11. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:
- Right to Know: Request disclosure of personal information collected and shared;
- Right to Delete: Request deletion of personal information, subject to certain exceptions;
- Right to Correct: Request correction of inaccurate personal information;
- Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information;
- Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your privacy rights.
12. Cookies & Tracking Technologies
While the Velorai mobile app does not use traditional browser cookies, we and our third-party service providers use similar tracking technologies:
- Device Identifiers: Android Advertising ID (AAID), Apple IDFA, and other unique device identifiers for analytics;
- Local Storage: We use on-device storage to store app preferences, theme settings, and authentication tokens;
- SDKs: Third-party SDKs may use their own tracking technologies to collect usage data.
Managing Tracking
- Android: Go to Settings → Privacy → Ads → Opt out of Ads Personalization;
- iOS: Go to Settings → Privacy & Security → Tracking → disable "Allow Apps to Request to Track".
13. Children's Privacy
The Service is not intended for individuals under the age of 13. We do not knowingly solicit or collect personal information from children under 13.
If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately at support@velorai.cc. We will promptly delete the child's personal information in accordance with applicable law, including COPPA.
14. Advertising & Analytics
Analytics: We may use analytics tools to understand how users interact with the Service. These tools collect usage data, device information, and crash reports to help us improve the App.
Advertising: If the free version of the Service displays advertisements, these may be served by ad networks. You can opt out of personalized advertising through your device settings as described in Section 12.
We do not share your personal conversation data with advertising partners.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the "Last updated" date at the top of this page;
- Provide prominent notice via in-app notification or email at least 30 days before the changes take effect;
- Where required, re-obtain your consent for any new processing activities.
Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.
1. 我们是谁
Velorai 是一款由 Velorai（以下简称"我们"）运营的 AI 伴侣应用程序。我们是负责通过 Velorai 移动应用程序及相关服务（统称"服务"）收集的您的个人数据的数据控制者。
本隐私政策说明我们在您使用服务时如何收集、使用、披露和保护您的信息。本政策适用于全球所有用户，并遵守欧盟《通用数据保护条例》(GDPR)、英国 GDPR、《加州消费者隐私法》(CCPA)（经 CPRA 修订）以及其他适用的隐私法律。
通过访问或使用 Velorai，您确认已阅读本隐私政策并理解其内容。如果您不同意我们的做法，请勿使用本服务。
2. 我们收集的信息
2.1 您直接提供的信息
- 账户信息：注册时的电子邮件地址、加密密码、显示名称和个人偏好设置。
- 对话数据：您发送给 AI 角色的文本消息、选取的近期对话历史、根据聊天生成的对话摘要与记忆、AI 生成的回复，以及您提供的反馈或反应。
- 语音数据：您主动发送的语音录音、录音文件地址及技术元数据、语音转文字结果，以及合成的 AI 语音回复。
- 付款与交易信息：通过 Google Play 或 Apple App Store 处理的订阅套餐详情和交易收据。我们不收集或存储完整的信用卡号。
- 客户支持通信：您通过支持渠道发送的任何消息、电子邮件或反馈。
- 用户生成内容：您在应用内创建的任何自定义角色设置、偏好或内容。
2.2 自动收集的信息
- 设备信息：设备类型、型号、制造商、操作系统版本、唯一设备标识符和系统语言设置。
- 使用数据：使用的应用功能、会话时长、交互频率、应用内导航模式和崩溃/错误报告。
- 网络信息：IP 地址、连接类型（Wi-Fi/移动网络）和大致地理位置（国家/城市级别）。
- 应用性能数据：应用版本、加载时间、响应延迟和错误日志。
2.3 发送给第三方 AI 与语音服务商的数据
Velorai 会先在自己的服务器接收您的数据，再将下述数据传输给第三方服务商。即使数据先经过 Velorai 服务器，再转发给第三方，仍属于由该第三方接收和处理数据。
- AI 文本对话：您提交的消息、选取的近期消息、相关对话摘要与记忆，以及角色指令，可能发送给火山引擎（包括字节跳动关联服务方舟 Ark）或 OpenAI，用于生成、评估、格式化或安全检查 AI 回复，并维持对话上下文。
- 语音识别：当您发送语音消息时，录音文件或该录音的临时下载地址会发送给火山引擎/字节跳动语音服务；配置为 OpenAI 时则会发送给 OpenAI，用于将语音转换为文字。转写文字随后作为对话数据继续处理。
- 语音合成：AI 回复文本及有限的声音表达指令，可能发送给火山引擎/字节跳动语音服务或 OpenAI，用于生成语音回复。
- 图片生成：图片提示词，以及相关功能使用的参考图片，可能发送给 OpenAI 或火山引擎方舟 Ark，用于生成图片。
上述传输仅用于提供您请求的 AI 对话、语音识别、语音合成、图片生成、安全检查和对话上下文功能。Velorai 不会故意在 AI 请求中加入您的账户密码、支付卡信息、电子邮箱或电话号码；但您自行在文字、语音或上传内容中提供的任何信息（包括个人或敏感信息）可能包含在请求中。
使用这些第三方 AI 功能需要您在应用内另行作出明确同意。如果您拒绝或之后撤回同意，Velorai 将不再为您的账户发起新的第三方 AI 数据传输，相关 AI 功能将无法使用。如服务商、数据类型或用途发生实质变化，我们将更新披露，并在需要时重新征得同意。
服务商隐私信息：火山引擎和 OpenAI。
2.4 来自第三方平台的信息
如果您通过第三方账户（如 Google 登录）登录，我们可能会收集您在该平台隐私设置中授权的姓名、电子邮件地址和个人头像。
3. 我们如何使用您的信息
我们将收集的信息用于以下目的：
- 服务提供：提供、运营和维护服务，包括生成 AI 对话和个性化内容；
- 账户管理：创建、管理和验证您的账户；
- 支付处理：通过 Google Play 或 Apple App Store 处理订阅付款和管理账单；
- 服务改进：监控和分析使用模式，改进服务功能；
- 安全保障：检测、预防和解决技术问题、欺诈、滥用和安全漏洞；
- 通信：发送服务相关公告、安全警报和管理消息；
- 营销（经同意）：在您选择加入的情况下发送促销消息。您可以随时选择退出；
- 客户支持：回应您的评论、问题和支持请求；
- 法律合规：遵守适用的法律义务；
- AI 质量与安全：评估回复质量、防止违禁内容、排查故障，并维护对话连续性所需的摘要与记忆。未经另行披露并在需要时取得同意，我们不会将您的对话或语音数据用于广告或训练通用模型等实质不同的目的。
4. 处理的法律依据（GDPR/英国 GDPR）
如果您位于欧洲经济区 (EEA) 或英国，我们基于以下法律依据处理您的个人数据：
- 合同履行（第 6(1)(b) 条）：提供服务所必需的处理；
- 合法利益（第 6(1)(f) 条）：用于服务改进、欺诈预防、安全和分析的处理；
- 同意（第 6(1)(a) 条）：基于您对营销通信的明确同意进行的处理。您可以随时撤回同意；
- 法律义务（第 6(1)(c) 条）：遵守适用法律所必需的处理。
5. 我们如何共享您的信息
我们不会将您的个人信息出售、出租或交易给第三方。我们仅在以下情况下共享您的信息：
5.1 服务提供商（数据处理者）
- 火山引擎/字节跳动：接收第 2.3 节所述 AI 与语音数据，用于提供文本生成、语音识别和语音合成服务；
- OpenAI：在使用 OpenAI 路由时，接收第 2.3 节所述 AI、图片或语音数据；
- 阿里云 OSS：存储和分发生成图片及语音文件。为使配置的语音识别服务商能够获取并转写录音，我们可能向其提供录音文件地址；
- 其他云托管提供商：用于服务器基础设施、数据存储和内容分发；
- 分析提供商：用于使用分析和崩溃报告；
- 支付平台：Google Play 和 Apple App Store 处理所有付款处理；
- 电子邮件服务提供商：用于发送交易和验证电子邮件。
5.2 法律合规与安全
如果法律、法院命令要求，或者我们善意认为披露对于保护 Velorai、我们的用户或公众的权利、财产或安全是必要的，我们可能会披露您的信息。
5.3 业务转让
在合并、收购或资产出售的情况下，您的信息可能会被转让。在您的信息受到不同隐私政策约束之前，我们会通知您。
5.4 经您同意
在您给予我们明确同意的情况下，我们可能会与第三方共享信息。
6. 第三方服务与 SDK
本服务集成了以下第三方服务和 SDK，每个都有其自身的隐私政策：
这些第三方服务可能会根据其自身的隐私政策收集、使用和共享数据。我们建议您查阅这些政策。
7. 国际数据传输
您的信息可能会被传输到您所在国家/地区以外的国家进行处理，包括我们的服务提供商所在的美国和中国。在国际传输数据时，我们会实施适当的保障措施，包括标准合同条款 (SCC) 和充分性决定（如适用）。
8. 数据保留
我们仅在实现本隐私政策所述目的所需的期限内保留您的个人信息。具体保留期限：
- 账户信息：在您的账户存续期间保留。账户删除后 30 天内永久删除；
- 对话数据：在您的账户存续期间保留。账户删除后 30 天内删除或完全匿名化；
- 付款与交易记录：保留 7 年（或适用税务法规要求的期限）；
- 使用日志与分析：90 天内匿名化。26 个月内完全删除；
- 支持通信：解决后保留 3 年；
- 营销同意记录：在您的账户存续期间加 5 年内保留，以满足合规要求。
9. 数据安全
我们实施全面的技术和组织措施来保护您的个人信息：
- 传输加密：应用与我们服务器之间传输的所有数据均使用 TLS 1.2 或更高版本加密；
- 静态加密：存储在我们数据库中的敏感数据使用 AES-256 加密；
- 密码安全：密码使用 bcrypt 和唯一盐值进行哈希处理；
- 访问控制：员工对个人数据的访问基于按需知密原则，并采用基于角色的访问控制；
- 基础设施安全：服务器托管在具有防火墙和入侵检测系统的安全数据中心；
- 事件响应：我们维护数据泄露响应计划，并将在 GDPR 要求的 72 小时内通知受影响的用户和监管机构。
10. 您的隐私权利
根据您所在的司法管辖区，您可能对您的个人数据享有以下权利：
- 访问权：请求获取我们持有的关于您的个人数据的副本；
- 更正权：请求更正不准确或不完整的数据；
- 删除权：请求删除您的个人数据（"被遗忘权"）；
- 限制处理权：请求限制我们使用您数据的方式；
- 数据可携带权：以结构化、机器可读的格式接收您的数据；
- 反对权：反对基于合法利益的处理；
- 撤回同意权：在基于同意的处理中随时撤回同意；
- 投诉权：向您当地的数据保护机构提出投诉。
如何行使您的权利
我们将在 30 天内回复可验证的请求。在处理您的请求之前，我们可能需要验证您的身份。
11. 加州隐私权利 (CCPA/CPRA)
如果您是加州居民，您根据《加州消费者隐私法》(CCPA)（经 CPRA 修订）享有额外权利：
- 知情权：请求披露收集和共享的个人信息；
- 删除权：请求删除个人信息，但受某些例外情况约束；
- 更正权：请求更正不准确的个人信息；
- 选择退出出售/共享权：我们不出售或共享您的个人信息；
- 不受歧视权：您不会因行使隐私权利而受到歧视性待遇。
12. Cookie 与追踪技术
虽然 Velorai 移动应用不使用传统的浏览器 Cookie，但我们和第三方服务提供商使用类似的追踪技术：
- 设备标识符：Android 广告 ID (AAID)、Apple IDFA 和其他唯一设备标识符，用于分析；
- 本地存储：我们使用设备端存储来保存应用偏好、主题设置和身份验证令牌；
- SDK：第三方 SDK 可能使用自己的追踪技术来收集使用数据。
管理追踪
- Android：前往 设置 → 隐私 → 广告 → 选择退出广告个性化；
- iOS：前往 设置 → 隐私与安全 → 追踪 → 关闭"允许 App 请求追踪"。
13. 儿童隐私
本服务不适用于 13 岁以下的个人。我们不会故意 solicite 或收集 13 岁以下儿童的个人信息。
如果您是父母或监护人，并认为您的孩子在未经您同意的情况下向我们提供了个人信息，请立即通过 support@velorai.cc 联系我们。我们将根据适用法律（包括 COPPA）迅速删除儿童的个人信。
14. 广告与分析
分析：我们可能使用分析工具来了解用户如何与服务交互。这些工具收集使用数据、设备信息和崩溃报告，帮助我们改进应用。
广告：如果免费版本的服务显示广告，这些广告可能由广告网络提供。您可以通过第 12 节中描述的设备设置选择退出个性化广告。
我们不会与广告合作伙伴共享您的个人对话数据。
15. 本隐私政策的变更
我们可能会不时更新本隐私政策。当我们进行重大变更时，我们将：
- 更新本页面顶部的"最后更新"日期；
- 在变更生效前至少 30 天通过应用内通知或电子邮件提供显著通知；
- 在需要时，重新获取您对任何新处理活动的同意。
在任何变更生效日期之后继续使用本服务，即表示您接受更新后的隐私政策。