Privacy Policy

This Privacy Policy describes how Rolio Intelligence LLC (“we”, “us”, or “our”), a Wyoming limited liability company, collects, uses, discloses, and protects information about you when you use the Veltake mobile application, the website at veltake.ai, and any related services (collectively, the “Service”).

By using the Service, you acknowledge this Privacy Policy. If you do not agree with it, please do not use the Service. Capitalized terms not defined here have the meanings given in our Terms of Service.

1. Information We Collect

We collect the following categories of information:

• Account information. Your email address (or the identifier shared by your sign-in provider, such as Google or Apple), authentication credentials, display name, language preference, and account settings. Guest accounts are keyed to a device identifier until they are upgraded to a full account. If you sign in through your organization's single sign-on (SSO), we receive the identifier and email address your organization's identity provider shares with us. Your organization controls access to the account it provisions: it can require addresses on its domain to sign in through it and remove you from its team, which ends your sessions. If it does, the account stays yours — your purchases, coins, and creations stay with it, and you can sign in the ordinary way to use, export or delete it.
• Content you provide. Photos, prompts, and other media you upload to create generations, and the resulting images and videos stored with your account. Photos that include a person's face are addressed separately in Section 2 (“Face Data”).
• Purchase and wallet information. When you buy coin packs or subscriptions, the purchase is processed by Apple, Google, or our payment processor. We receive transaction records (such as the product, price, currency, time, and a store receipt or token — never your full card number) and we maintain a ledger of your coin balance and transactions. On web purchases we also receive, from our payment processor, the email address you give at checkout, and we use it to send your receipt, the order confirmation with the Terms you accepted, and renewal reminders for your subscription.
• Device and usage data. App version, device model and operating system, language and region, IP address, time zone, identifiers assigned by your device or by us, diagnostic and crash logs, and how you interact with the Service (such as features used and templates viewed).
• Communications. Messages you send us, such as support emails, together with any diagnostic details you choose to include.
• Voice input. If you dictate a message with voice input, the recording is sent to our speech-to-text provider, which processes it on our behalf only to produce the text. We delete our copy right after and do not keep it.

We do not collect government identification numbers, precise geolocation, health information, or financial account numbers.

2. Face Data

Some features of the Service work with photos that include a person's face — for example, swapping a person from your photo into a video template. We treat this data with particular care:

• What we collect. The photos you choose to upload and the images and videos generated from them. We do not build biometric templates or “faceprints” to identify people, and we do not use facial recognition to determine who appears in a photo.
• Why we collect it. Solely to fulfill the generation requests you make in the app. Face data is never used for advertising, profiling, or identification of any person.
• How long we keep it. Your uploaded photos are deleted automatically from our production systems about 30 days after their last use — and sooner if you delete the upload, the creation, or your account. A photo is kept longer only when you choose that: when you save it to My uploads, with the separate consent the app asks for first, it is kept until you remove it, withdraw that consent, delete your account, or go a year without using the Service; when you use it in something you keep — a character, a product, or a Studio project — it is kept for as long as that item and deleted after you delete it. The generated results are stored with your account so you can revisit and manage them, and are deleted when you delete the individual creation or your account, and in any event no later than three years after your last interaction with the Service.
• ReCast (an exception to the period above). No AI processing of your photos or clip happens before you agree to the AI-processing consent. When a ReCast is checked, we make a copy of the clip and photos you chose. If the ReCast succeeds, that copy is kept with the result for as long as the result exists in your Creations. The inputs of a run that failed or was canceled, and copies made for a quote that was never run, are deleted on the normal schedule above (about 30 days after their last use). Deleting the result deletes its inputs within about an hour, and deleting your account deletes them too. The one exception is an open report about the result: we keep the result and its inputs until the report is reviewed, and then delete them on these same rules (see Section 6).
• Who it is shared with. Only the AI providers that process your specific request — our AI processing provider fal.ai and the AI model providers behind each model (such as Google, OpenAI, xAI, ByteDance, Kuaishou, PixVerse, and DeepSeek) — together with our cloud storage providers. Face data is never sold. Neither we nor — under our contractual terms — our providers use it to train AI models, with one exception: DeepSeek, which processes data in China, receives a photo only when you choose a DeepSeek model and give it a picture to read (for example in the Agent), and its terms do not include that commitment. If that matters to you, choose a different model; every other model remains available.

The app asks for your consent before face data is processed — everywhere, not only where the law of your state or country requires it (for example, Illinois, Texas, or Washington) — and asks again, separately, before it keeps an upload beyond the default period. You must also have the consent of any other person who appears in photos you upload, as required by our Terms of Service.

3. How We Use Information

• To provide the Service: authenticating you, running your generation requests, delivering and storing results, and syncing your account across devices.
• To operate your wallet: crediting purchases, deducting coins for generations, automatically refunding reserved coins for failed jobs, and maintaining purchase records.
• To provide support and to send transactional communications, such as verification codes and service announcements.
• To secure the Service: detecting and preventing fraud and abuse, enforcing our Terms of Service, and protecting users and third parties.
• To comply with legal obligations, including tax, accounting, and lawful requests from authorities.
• To improve the Service, using aggregated or de-identified data that does not identify you.
• To measure marketing performance and personalize the feeds, as described in Section 4 (“Analytics, Advertising Attribution, and Personalization”).

4. Analytics, Advertising Attribution, and Personalization

We use analytics services (Google Firebase, Google Analytics, and PostHog) to understand app performance, crashes, and feature usage. We may also use advertising attribution partners (Meta, TikTok, and AppsFlyer) to measure whether our advertising campaigns led to app installs and purchases. These partners may collect device identifiers and app events through SDKs in the app, subject to their own privacy policies.

In regions where the law requires opt-in consent (including the European Economic Area, the United Kingdom, and Brazil), these analytics and advertising services set no cookies and collect no identifiers until you agree — Google's measurement tags may load in a cookieless consent mode that sends only anonymous, aggregated signals used for conversion modeling — and your choice is saved to your account. You can change it at any time — in the app under Settings → Privacy, and on the web via the cookie banner or the Your Privacy Choices page. You can additionally limit measurement through your device settings: on iOS, via App Tracking Transparency and “Allow Apps to Request to Track”; on Android, by resetting or deleting your advertising ID and opting out of ads personalization. Where these disclosures qualify as a “sale”, “sharing”, or “targeted advertising” under applicable state law, Section 10 explains your opt-out rights.

Personalized recommendations. We use a recommendation service (Recombee) to rank the template and community feeds around what you engage with — a form of profiling based on your activity in the Service. You can object to it at any time by turning off personalized recommendations in Settings → Privacy: the feeds then show everyone the same content, and your recommendation profile — including its interaction history — is deleted from the recommendation service.

5. How We Share Information

We do not sell your personal information for money. We share information only:

• With service providers that help us run the Service — cloud hosting, object storage, the AI generation providers that process your requests (our AI processing provider fal.ai and the AI model providers behind each model, such as Google, OpenAI, xAI, ByteDance, Kuaishou, PixVerse, and DeepSeek), payment processors, email delivery, analytics (PostHog), and recommendations (Recombee) — each bound by contract to use the information solely on our behalf, except DeepSeek, which processes what you send to its models under its own terms (see Sections 2 and 8).
• With app stores and payment processors (Apple, Google, or our payment processor Stripe) to process and validate purchases.
• With advertising attribution partners as described in Section 4, to the limited extent needed to measure campaign performance.
• For legal reasons, if we believe in good faith that disclosure is required by law, subpoena, or other legal process, or is necessary to protect the rights, property, or safety of our users, the public, or Rolio Intelligence LLC.
• In a business transfer, such as a merger, acquisition, financing, or sale of assets, in which case this Policy will continue to apply to your information until you are notified otherwise.
• Within your team, if you join one: its other members can see your name, email address, and role, and what you spend from the team's coins and with which tools; the team's owner and admins can also see previews of what you made with the team's coins.
• At your direction, when you ask us to share something or consent to a disclosure.

6. Data Retention

• Account data is kept for as long as your account is active.
• Your uploaded files are deleted automatically about 30 days after their last use, or sooner if you delete them, the creation, or your account. Files you save to My uploads are kept until you remove them, withdraw your consent to keeping them, delete your account, or go a year without using the Service; files used in something you keep (a character, a product, a Studio project) are kept for as long as that item. Your generated creations are kept until you delete them or delete your account. The clip and photos used for a ReCast follow the separate rule in Section 2.
• When you delete a creation or your account, the associated personal data and stored media are removed from our production systems promptly and purged from backups within approximately 30 days, except for the limited records described below.
• We retain limited records longer where required for legal, accounting, tax, security, or fraud-prevention purposes — for example, the ledger of purchases. While a content report about a creation is open, we keep that creation and the files it was made from — even if its owner deletes it — until the report is resolved, so that we can investigate possible abuse.
• Welcome-bonus abuse prevention. When an account receives the welcome bonus, we keep keyed one-way hashes (pseudonymised values that are not stored alongside the original identifiers) of the sign-in account identifier, the email address and the device identifier used, and, for seven days, of the network address. We use them only to check whether a new registration has already received the bonus. They are kept for up to two years — including after the account is deleted, which is what stops the offer being claimed again by deleting and re-registering — and then deleted.
• Security and audit logs (for example sign-in and administrative activity records, which can include IP addresses) are kept for up to 24 months; aggregated activity records used for usage statistics are kept for up to about 13 months.
• Face data, including the clip and photos used for a ReCast, follows the schedule described in Section 2 and its ReCast exception; the open-report exception above applies to it too, and once the report is reviewed the inputs are deleted on Section 2's rules.

7. Security

We use technical and organizational measures appropriate to the risk — including encryption in transit, access controls, and segregated object storage — to protect your information. Your data is stored on servers located in the United States. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; if a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by applicable law.

8. International Data Transfers

We are based in the United States, and your information is processed and stored in the United States and in other countries where our service providers operate. These countries may have data protection laws different from those of your country. Where required, we use appropriate safeguards (such as standard contractual clauses) for these transfers.

DeepSeek models (China). When you choose a DeepSeek model, what you send to it — your messages and prompts, the text of documents you attach, and any pictures you give it to read — is processed and stored by DeepSeek in the People's Republic of China under DeepSeek's own terms and privacy policy. DeepSeek does not offer standard contractual clauses or a commitment not to use that content to improve its models, so this transfer does not have the safeguards described above. It happens only when you choose a DeepSeek model; if you do not want your data transferred on these terms, choose a different model.

9. Your Rights and Choices

• On our website: the Your Privacy Choices page lets you manage analytics and advertising-attribution preferences for your browser, opt out of “sharing”, and reach every right described below.
• In the app: you can delete individual creations, and you can delete your entire account (Profile → Settings), which removes your personal data and stored media as described in Section 6. Settings → Privacy also carries the analytics, advertising, and personalized-recommendations switches (Section 4).
• By email: you can ask us to access, correct, export, or delete your personal data by contacting [email protected]. We will verify your request (for example, by confirming control of the account email) and respond within the time required by applicable law.
• Authorized agents may submit requests on your behalf where applicable law allows; we will require proof of authorization.
• We will not discriminate against you for exercising any privacy right. If we decline a request, we will explain why, and you may appeal by replying to our decision.

10. United States State Privacy Rights

If you live in California, Colorado, Connecticut, Virginia, Utah, or another state with a comprehensive privacy law, you may have rights to know, correct, delete, and obtain a portable copy of your personal data, and to opt out of “sales”, “sharing”, targeted advertising, and certain profiling.

In the preceding 12 months we have collected the categories of information described in Section 1, and disclosed them to the categories of recipients described in Section 5. We do not sell personal information for money and do not knowingly sell or share the personal information of consumers under 16 years of age. The only practice that may qualify as “sharing” or “targeted advertising” under some state laws is the advertising attribution described in Section 4 — you can opt out on our Your Privacy Choices page, via your device settings, or by emailing [email protected] with the subject “Do Not Share”. We also honor the Global Privacy Control (GPC) browser signal as a valid opt-out of “sharing” and targeted advertising.

11. Users in the EEA, United Kingdom, and Other Regions

Where the GDPR, UK GDPR, or a similar law applies, Rolio Intelligence LLC is the controller of your personal data, and we process it on these legal bases: performance of our contract with you (providing the Service, running your generation requests, operating your wallet); your consent (face data where required, AI-generation processing, and the analytics and advertising measurement described in Section 4, which stays off in these regions until you opt in); our legitimate interests (securing the Service against fraud and abuse, first-party service analytics, and the personalized recommendations described in Section 4 — which you can object to at any time via the Settings → Privacy switch); and compliance with legal obligations (tax, accounting, lawful requests).

You may have additional rights, including the rights to object to or restrict processing (the personalization switch in Section 4 is the direct way to object to profiling), to withdraw consent at any time, and to lodge a complaint with your local supervisory authority. We encourage you to contact us first at [email protected] so we can address your concern directly.

12. Biometric Information

Some jurisdictions (such as Illinois, Texas, and Washington) regulate biometric identifiers and biometric information. As described in Section 2, we do not create faceprints or use facial recognition to identify individuals. To the extent any photo or derived data is nonetheless treated as biometric information under such a law: we collect it only with the consent obtained in the app and only to provide the feature you requested; we never sell, lease, or trade it; we do not use it to identify anyone; and we permanently destroy uploaded face photos about 30 days after their last use (sooner if you delete the upload, the creation, or your account) — except photos you chose to keep and the clip and photos of a ReCast that is still in your Creations (see Section 2), which we destroy when you remove them or the item that uses them, when you withdraw your consent to keeping them, or after one year without any interaction with the Service — and destroy any biometric information derived from a generated result when you delete it or your account, and in any event no later than three years after your last interaction with the Service. This paragraph serves as our publicly available retention and destruction schedule.

13. Children's Privacy

The Service is not directed to children under 13 (or the equivalent minimum age in your region), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us at [email protected] and we will delete it.

14. Third-Party Services

The Service links to or interoperates with third-party services we do not control, including the Apple App Store, Google Play, and sign-in providers. Their handling of your information is governed by their own privacy policies, which we encourage you to review.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the current version. If we make material changes, we will provide notice in the app or on this site before the changes take effect. Your continued use of the Service after the effective date constitutes acknowledgment of the updated Policy.

16. Contact Us

Questions or requests about this Privacy Policy can be sent to [email protected], or by mail to Rolio Intelligence LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA.