VARDØGAVARDØGA
Sign inCreate a person

Last updated 31 August 2026

Privacy Policy

This policy describes personal data Vardøga processes. The controller is [TO CONFIRM]. To exercise your rights, write to [TO CONFIRM].

Where data lives

We intend to keep production data in the EU. The specific Supabase region, object-storage region, and where the ffmpeg worker runs are [TO CONFIRM]. This repository does not pin a region; do not treat any non-EU default as a decision.

What we store

  • Account. Email, password hash (held by Supabase Auth, not by us in plaintext), organisation name, membership role (owner / editor / viewer).
  • Personas. Name, identity type, status, version, optional voice id and wardrobe, and — for real-person types — a consent record: subject (self or a named person), confirming user, timestamp, optional evidence URL, withdrawal timestamp.
  • Reference media. Photographs and a reference video that lock a persona's appearance. Stored in a private bucket, served only via short-lived signed URLs (60 seconds). Image uploads are re-encoded so EXIF, GPS and XMP do not survive.
  • Generated media. Video, stills, thumbnails and the structured brief (hook, script, caption, hashtags, scenes). Private bucket, signed URLs.
  • Channels. Platform, external account id, handle, encrypted OAuth access and refresh tokens, token expiry, publish mode, connection status. We never store social passwords.
  • Schedules. When something was or will be published, platform, external post id if the platform gave us one.
  • Billing. Stripe customer and subscription ids, plan, payment state (ok / past due). Card details are held by Stripe, not by us. The credit ledger is append-only (grants, debits, refunds, expiry). Rows are not updated or deleted.
  • Erasure records. After a real-person persona is deleted, an erasure_requests row remains as evidence: who asked, when, which content items and published posts must be pulled from platforms we cannot reach, and how many media objects we deleted. It has no foreign key to the persona, so it survives the deletion it documents.
  • Early-access emails collected on the public site: storage of this list is [TO CONFIRM]. The form on vardoga.com does not write to our production database today.

How long

  • Abandoned uploads (intent recorded, file never confirmed): the object is deleted and the row marked failed after 60 minutes.
  • Ready assets, generated media, personas, campaigns and schedules: until you delete them or until erasure runs, whichever comes first. There is no automatic time-to-live on ready media in the current system.
  • Consent withdrawal does not delete existing content. New generation is blocked immediately; live campaigns stay, because you may be required to keep advertising records. We surface the withdrawn state rather than silently removing posts.
  • Persona deletion for a real person deletes our copies of the likeness and derived media immediately (see Consent). The erasure record itself is kept. Retention period for that record is [TO CONFIRM].
  • Credit-ledger rows are never deleted by persona erasure. Retention of billing records after an organisation is closed is [TO CONFIRM].
  • Whole-account deletion (remove the organisation, auth user, and leftover rows in one action) is not implemented as a customer-facing operation yet. [TO CONFIRM] the process and the time we take to complete it.

Processors

  • Supabase — authentication, PostgreSQL, private object storage.
  • Stripe — subscriptions, invoices, checkout, customer portal.
  • Generation provider — image and video models. Vendor name is [TO CONFIRM]. The codebase currently runs stub adapters; production traffic will leave our worker for this vendor.
  • Voice provider — speech for the persona. Vendor name is [TO CONFIRM].
  • LLM provider — campaign planning (scenes and scripts), not on-screen text. Vendor name is [TO CONFIRM].

Web hosting (planned: Vercel) and where the worker/ffmpeg process runs are [TO CONFIRM]. ffmpeg itself runs on infrastructure we control, not at the generation vendor.

Your rights

If GDPR applies, you can ask for access, rectification, erasure, restriction, portability, and to object to processing. You can also complain to [TO CONFIRM] (supervisory authority).

Erasure of a real person's likeness is implemented in the product, not as a ticket queue. deletePersona removes reference objects, generated media we store, the persona row (which is the consent record), and writes an erasure request listing every content item and every published/scheduled post you must take down on Instagram, Facebook, TikTok, YouTube or LinkedIn. We cannot reach those platforms to delete for you. An editor marks the task resolved when the external takedowns are done.

Fictional personas are not a data subject. Deleting one clears the persona and its reference pack; generated marketing assets stay, with the persona link set to null. No erasure request is created.

Cookies and session

We use cookies to keep you signed in (Supabase SSR). The public pages — this policy, the terms, the AI policy, the consent policy, and the landing page — do not require a session and do not query the database.