Privacy Policy of the “Virola” service

1. General provisions and terms

1.1. This Privacy Policy (the “Policy”) applies to all information that the Operator of the “Virola” service (the “Service”) may obtain about a user while they use the virola.pro website, its services and features.

1.2. The Policy has been developed pursuant to the requirements of paragraph 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (“Law 152-FZ”) and defines the Operator's policy regarding the processing of personal data.

1.3. Use of the Service constitutes the user's unconditional consent to this Policy and the personal data processing conditions specified in it. If the user does not agree with the terms of the Policy, they must refrain from using the Service.

1.4. The following key terms are used in this Policy:

“Personal data” — any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).

“Personal data processing” — any action (operation) or set of actions performed with or without automation tools on personal data, including collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer, anonymization, blocking, deletion, destruction.

“Operator” — an organization that, independently or jointly with other persons, organizes and (or) carries out the processing of personal data, and determines the purposes of processing, the composition of the data processed and the actions performed with them.

“User” — a natural person aged 18 or over who uses the Service.

“Avatar” — the user's digital character, created from a text description or from a photograph of the user's face uploaded by the user.

“Reference” — a third-party publicly available video whose link the user provides to the Service to generate their own video.

“Tokens” — the Service's internal unit of account, purchased by the user and spent on video generation.

“Cookie” — a small piece of data sent by a web server and stored on the user's device.

2. Personal data operator

2.1. The Operator organizing and carrying out the processing of the Service users' personal data is:

[Operator's details to be inserted: full name of the legal entity / full name of the individual entrepreneur, OGRN/OGRNIP, INN, registered and postal address].

2.2. Email address for sending inquiries, requests and exercising the rights of personal data subjects: admin@hcohoco.com.

2.3. All matters relating to personal data processing, withdrawal of consent and exercising the subject's rights are addressed to the Operator at the email address specified in clause 2.2.

3. Categories of personal data processed

3.1. The Operator processes the following categories of user data:

3.2. Account data: email address, name or nickname, password in encrypted form, and data transmitted when signing in via third-party services (where such an option is used).

3.3. Uploaded facial photographs. If the user creates an avatar from their own photograph, the Operator processes the image of the user's face. A facial image processed for the purpose of creating and using a personalized avatar may qualify as biometric personal data within the meaning of Article 11 of Law 152-FZ. Such data is processed only with the user's separate written consent, executed as an electronic document when the photograph is uploaded. The user confirms that they upload an image of their own face only, or of a face for which consent has been obtained in accordance with section 3.4.

3.4. Consent of the person depicted. Uploading a photograph of another natural person's face is permitted only if the user holds that person's lawful consent to the processing of their image and the creation of an avatar. The user is responsible for the existence of such consent. Using images of persons without their consent, as well as images of public figures and celebrities, is prohibited.

3.5. Payment data. Bank card details and other payment data are entered by the user directly on the payment provider's side (Stripe, YooKassa, etc.) and are not collected, stored or processed by the Operator. The Operator receives from the payment provider only information about the fact, amount and status of the payment, necessary for crediting tokens.

3.6. User content: links to references, text descriptions of avatars and scenes, caption texts, as well as the final generated videos and intermediate generation materials.

3.7. Technical data: IP address, browser and operating system type and version, data on actions in the Service, date and time of requests, device and session identifiers, cookies.

3.8. The Operator does not process special categories of personal data (regarding race, ethnicity, political, religious or philosophical beliefs, health, intimate life) beyond the facial image processed in accordance with clause 3.3.

4. Purposes of personal data processing

4.1. The Operator processes the user's personal data for the following purposes:

registering and identifying the user, creating and maintaining the account, granting access to the Service's features;

creating avatars and generating videos using artificial intelligence technologies based on the materials provided by the user;

accounting for and charging tokens, processing payments, refunding funds for failed generations;

publishing a finished video on social networks (Reels/Shorts/TikTok) at the user's initiative and with their consent;

technical support, handling inquiries, sending service notifications;

ensuring the security of the Service, preventing fraud and abuse, enforcing usage prohibitions;

improving the quality of the Service, analyzing usage statistics in anonymized form;

complying with the requirements of the legislation of the Russian Federation.

5. Legal grounds for processing

5.1. Personal data is processed on the following legal grounds:

the personal data subject's consent to the processing of their personal data (paragraph 1 of part 1 of Article 6 of Law 152-FZ), and, with respect to biometric data, separate consent in accordance with Article 11 of Law 152-FZ;

the necessity of performing a contract (offer) to which the user is a party (paragraph 5 of part 1 of Article 6 of Law 152-FZ);

the necessity of exercising the Operator's rights and legitimate interests without violating the subject's rights and freedoms (paragraph 7 of part 1 of Article 6 of Law 152-FZ);

performing obligations imposed on the Operator by the legislation of the Russian Federation.

5.2. The legal basis for processing also includes the Civil Code of the Russian Federation (regarding the conclusion of the offer contract and the protection of a citizen's image under Article 152.1 of the RF Civil Code), Federal Law No. 149-FZ of 27.07.2006 “On Information, Information Technologies and Information Protection” and RF Law No. 2300-1 of 07.02.1992 “On Protection of Consumer Rights”.

6. Procedure, terms of processing and data storage

6.1. Personal data is processed with and without automation tools, subject to the principles of lawfulness and fairness.

6.2. Personal data is processed and stored for the duration of the user's account and use of the Service.

6.3. Uploaded facial photographs and avatars created from them are stored until deleted by the user or until consent is withdrawn, but no longer than necessary for the purposes of processing.

6.4. After the user stops using the Service, deletes the account or withdraws consent, personal data is subject to deletion or anonymization within no more than 30 (thirty) days, unless a different retention period is established by the legislation of the Russian Federation (including with respect to payment records and accounting documentation).

6.5. The Operator ensures the recording, systematization, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation, in accordance with part 5 of Article 18 of Law 152-FZ.

7. Transfer of data to third parties and cross-border transfer

7.1. To provide the services, the Operator engages third parties and transfers personal data to them to the extent necessary to perform the relevant functions:

to providers of AI generation services — uploaded materials, descriptions and links to references are transferred for creating avatars and videos;

to hosting and cloud infrastructure providers — for hosting and storing data;

to payment providers (Stripe, YooKassa, etc.) — for processing payments;

to social networks (Reels/Shorts/TikTok) — when publishing a finished video at the user's initiative.

7.2. The Operator transfers to third parties only the data, and only to the extent, necessary to achieve the relevant purpose, and ensures that its contracts with them include confidentiality and personal data protection terms.

7.3. Cross-border transfer. Certain services engaged by the Operator (in particular, AI generation and payment providers) may be located in foreign states. In that case, cross-border transfer of personal data is carried out in compliance with the requirements of Article 12 of Law 152-FZ, including with the user's consent to such transfer. Use of the Service and provision of data constitutes the user's consent to the cross-border transfer of their data to the extent necessary to provide the services.

7.4. The Operator may transfer personal data to authorized state bodies on the grounds and in the manner established by the legislation of the Russian Federation.

8. Personal data protection

8.1. The Operator takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, distribution, and other unlawful actions, in accordance with Article 19 of Law 152-FZ.

8.2. The measures applied include: encryption of passwords and data transmission channels, access rights segregation, use of secure connection protocols, regular backups, control of employee access to data.

8.3. The user must keep their account credentials (login and password) confidential and is liable for actions performed under their account.

8.4. If an incident involving unauthorized access to personal data is detected, the Operator takes measures to remedy it and notifies the authorized body in the manner and within the deadlines established by law.

9. Rights of the personal data subject

9.1. The user, as a personal data subject, has the right to:

receive information concerning the processing of their personal data, to the extent provided for by Article 14 of Law 152-FZ;

demand that their personal data be clarified, changed (updated, corrected) if it is incomplete, inaccurate or outdated;

withdraw consent to the processing of personal data, including the separate consent to the processing of biometric data (facial image);

demand the deletion (destruction) of their personal data, except where processing is required by law;

demand the blocking of personal data in the event of its unlawful processing;

appeal the Operator's actions or inaction to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.

9.2. Procedure for exercising rights. To exercise their rights, the user sends a request to admin@hcohoco.com with details allowing identification of the user and their account. Some rights (changing account data, deleting avatars, deleting the account) can be exercised by the user directly via the Service's interface.

9.3. The Operator reviews the request and provides a response within no more than 30 (thirty) days from its receipt, unless a different period is established by law.

9.4. Withdrawal of consent. Withdrawal of consent to the processing of personal data results in the cessation of processing and deletion of the data, unless retention is required by law. Withdrawal of consent to the processing of the facial image makes further use of the avatar created from it impossible.

10. Use of cookies

10.1. The Service uses cookies and similar technologies to keep the website working, sign the user in, save settings and collect anonymized usage statistics.

10.2. The user may disable cookies in their browser settings, but this may make certain features of the Service unavailable.

10.3. The detailed procedure for using cookies is defined by the separate Cookie Policy posted at virola.pro.

11. Age restriction (children)

11.1. The Service is intended solely for persons aged 18 or over. The Operator does not knowingly collect or process personal data of persons under 18.

11.2. By using the Service, the user confirms that they are 18 or older and have the legal capacity to accept the terms of this Policy.

11.3. If the processing of data of a person under 18 without the consent of their legal representatives is detected, the Operator deletes such data as soon as possible.

12. Changes to the Privacy Policy

12.1. The Operator may amend this Policy. The current version of the Policy is always available at virola.pro with the date of the latest update indicated.

12.2. Material changes affecting users' rights are communicated to users by posting a notice on the website or by sending a message to their email address.

12.3. Continued use of the Service after the changes take effect constitutes the user's consent to the updated version of the Policy.

13. Contact information

13.1. For all matters relating to personal data processing, exercising the rights of a personal data subject, withdrawing consent and other inquiries, the user may contact the Operator at: admin@hcohoco.com.

13.2. Full details of the Operator: [Operator's details to be inserted].

13.3. Inquiries are reviewed by the Operator in the manner and within the deadlines established by this Policy and the legislation of the Russian Federation.