Consent to Personal Data Processing for the “Virola” Service

1. Operator to whom the consent is given

1.1. This Consent is given to the Administration of the “Virola” Service — the operator processing my personal data (the “Operator”).

1.2. Operator's details: [Operator's details to be inserted: full name of the legal entity/individual entrepreneur, OGRN/OGRNIP, INN, registered address].

1.3. The Operator's email address for inquiries, requests and notices relating to PD processing, as well as for withdrawing this Consent: admin@hcohoco.com.

1.4. PD is processed by the Operator in connection with granting me access to the “Virola” Service's functionality, which allows creating, based on a video reference of my choice and my AI avatar, a new video with a different character, environment, voiceover and caption text.

2. List of personal data to which this consent applies

2.1. I consent to the processing of the following categories of my PD, provided by me when registering and using the Service:

• the email address used for registration, sign-in and communication;
• the name and (or) nickname (display name) specified by me in my profile;
• technical data and Service usage data: IP address, device and browser identifiers, cookies, session data, actions in the interface, generation times and parameters, information about the token balance and spending;
• other data that I voluntarily include in caption texts, avatar descriptions and support requests.

3. Separate consent to the processing of the facial image and biometric personal data

3.1. This section contains a separate, standalone consent to the processing of a special category of data — biometric personal data, processed in accordance with Article 11 of Federal Law No. 152-FZ.

3.2. I knowingly and voluntarily consent to the processing of the photograph of my face uploaded by me, as well as data derived from it, including mathematical (vector) representations of facial features and other attributes used to form and retain a consistent character image (AI avatar) during video generation.

3.3. I confirm that the uploaded photograph is an image of my own face or of the face of another natural person from whom I have obtained duly executed consent to such processing. I undertake not to upload images of third parties' faces without their consent, or images of public figures, celebrities or any other persons in violation of their rights.

3.4. This consent to the processing of biometric data is granted solely for the purposes specified in section 5 and may not be used to identify me in other systems.

3.5. The consent to the processing of biometric data may be withdrawn by me separately from the consent to the processing of other PD, in accordance with section 9. The absence or withdrawal of the biometrics consent makes the photo-based video generation feature unavailable, but does not affect the use of the Service with an avatar generated from a text description.

4. List of actions with personal data

4.1. I consent to the Operator performing any actions (operations) or sets of actions on my PD, with or without automation tools, namely:

• collection and receipt of PD from me;
• recording, systematization and accumulation;
• storage;
• updating (renewal, modification);
• retrieval and use (including for video generation);
• transfer (provision, access) to third parties within the limits set by section 7;
• blocking, anonymization;
• deletion and destruction of PD.

5. Purposes of personal data processing

5.1. My PD is processed for the following purposes:

• registering, identifying and signing me in as a user, creating and maintaining the account;
• providing the Service's core functionality — creating a new video based on a reference of my choice and my AI avatar, including forming and storing the character image based on the uploaded photo and derived biometric data;
• operating the internal token system: accounting for token package purchases, generation charges and refunds for failed generations;
• technical support, handling my inquiries and resolving disputes;
• ensuring the security of the Service, preventing fraud and violations of the usage rules;
• complying with the requirements of RF legislation, including keeping the necessary records and providing information to authorized bodies in cases established by law;
• for the feature of publishing a finished video to social networks (Reels/Shorts/TikTok) — transferring the created video to the platform of my choice at my initiative.

6. Methods and legal grounds of processing

6.1. My PD is processed both by automated means (using computing equipment, software and artificial intelligence technologies) and by non-automated means.

6.2. I have been informed of, and agree with, the fact that to form the avatar, process the facial image and generate videos the Operator uses artificial intelligence software models, including those provided by third-party contractors (AI providers) in the manner provided for in section 7.

6.3. The legal basis for processing is this Consent (paragraph 1 of part 1 of Article 6 and Article 11 of Federal Law No. 152-FZ), as well as the requirements of the RF Civil Code and RF Law No. 2300-1 of 07.02.1992 “On Protection of Consumer Rights” as regards the performance of the contract (offer) for the Service's services.

6.4. Processing is carried out in compliance with the principles and conditions established by Articles 5, 6, 7 and 9 of Federal Law No. 152-FZ, and with ensuring the confidentiality of PD.

7. Transfer of personal data to third parties and cross-border transfer

7.1. I consent to the transfer (provision of access) of my PD, including the facial image and derived biometric data, to the following categories of third parties solely to the extent necessary to achieve the purposes specified in section 5:

• cloud infrastructure and hosting providers ensuring data storage and the operation of the Service;
• contractors providing artificial intelligence models and services for image and video generation;
• payment service providers (for example, Stripe, YooKassa) — to the extent necessary to process token package payments and refunds; full payment details are processed directly by the payment provider;
• social networks and platforms (Reels/Shorts/TikTok) — when I use the feature of publishing a finished video, at my initiative;
• authorized state bodies — in the cases and manner provided for by RF legislation.

8. Conditions of cross-border transfer

8.1. I have been informed that certain contractors of the Operator (including AI providers and infrastructure providers) may be located outside the territory of the Russian Federation, and therefore the processing of my PD may include cross-border data transfer to foreign states.

8.2. I consent to the cross-border transfer of my PD, including the facial image and derived biometric data, provided the Operator complies with the requirements of Article 12 of Federal Law No. 152-FZ, including first satisfying itself that the foreign state ensures adequate protection of the rights of PD subjects, or where other grounds provided for by law exist.

8.3. In the case of cross-border transfer, the Operator ensures the confidentiality and security of my PD, including by entering into appropriate PD processing and protection agreements with the data recipients.

9. Term of the consent and withdrawal procedure

9.1. This Consent takes effect from the moment of its acceptance (ticking the corresponding box) and remains in force until the purposes of processing are achieved, but in any case no longer than the retention period of the account and related data established by the Operator's Privacy Policy, or until the Consent is withdrawn.

9.2. I may withdraw this Consent in whole or in part (including separately withdrawing the consent to the processing of biometric data under section 3) at any time by sending a written withdrawal notice to the Operator's email address: admin@hcohoco.com.

9.3. The withdrawal notice must include details allowing my identification as a PD subject (the account email address and (or) name/nickname), as well as the scope of the consent being withdrawn.

9.4. The Operator ceases processing the PD and ensures its deletion (destruction) within no more than 30 (thirty) days from the date the withdrawal notice is received, except for data whose processing and storage after withdrawal is permitted by RF legislation (including for compliance with legal requirements, accounting and tax records, and protection of the Operator's rights and legitimate interests).

9.5. I understand that withdrawing the Consent makes it impossible to continue providing me with Service features that require processing of the relevant PD, and may result in termination of access to the account.

10. Rights of the personal data subject

10.1. My rights under Chapter 3 of Federal Law No. 152-FZ have been explained to me and are clear, including the right to receive information about the processing of my PD, and the right to demand its clarification, blocking or destruction if the data is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing.

10.2. To exercise my rights, or if I disagree with the Operator's actions, I may contact the Operator at admin@hcohoco.com, and may also appeal the Operator's actions or inaction to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.

11. Confirmation of voluntariness and awareness

11.1. I confirm that this Consent is given by me freely, of my own will and in my own interest, without coercion.

11.2. I confirm that before granting this Consent I have read the Privacy Policy, the User Agreement (offer) and the Rules of Use of the “Virola” Service, and that I understand the nature of the actions performed on my PD, the purposes and methods of processing, and the consequences of granting and withdrawing the Consent.

11.3. I confirm that all information I have provided is accurate and that the uploaded facial image has been obtained and is used by me lawfully, respecting the rights of third parties and the prohibitions established by the Service (no use of another person's identity without consent, no images of public figures and celebrities, no creation of disinformation or other unlawful content).

11.4. I confirm that I am of legal age and fully legally capable, or act with the consent of a legal representative, and that I give this Consent with respect to my own personal data.

11.5. This Consent is an electronic document accepted by implicative actions (ticking the box in the Service's interface) and is recognized as equivalent to a consent executed on paper.