Privacy Policy

Who we are

Velysaro is operated by the company below, which is the controller of the personal data described in this policy. Where this policy says "we", "us" or "Velysaro", it means that company.

Controller

STORYSTEPPER LIMITED

Business registration number

80655938-000-06-26-8

Registered address

Room 701, Unit 108, 7/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Kowloon, Hong Kong

Privacy contact

[email protected]

What this policy covers

This policy applies to the Velysaro website at velysaro.com, the waitlist, and the Velysaro application once you have an account. It does not cover the platforms you publish to (for example TikTok, YouTube or Instagram), which have their own privacy policies, or the websites we link to.

Velysaro is operated from Hong Kong and is subject to the Personal Data (Privacy) Ordinance (Cap. 486). We sell in the United States, Latin America and Indonesia, so this policy is also written to meet the United States state privacy laws (including the California Consumer Privacy Act as amended by the CPRA), Brazil's Lei Geral de Proteção de Dados (LGPD), Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, and Indonesia's Personal Data Protection Law (Law No. 27 of 2022). Wherever you are — including the European Economic Area and the United Kingdom — we extend the rights listed below to you as a matter of our own policy, alongside anything further your local law gives you.

What we collect

Waitlist

If you join the waitlist on the home page, we store your email address, the language you were reading the site in, which part of the page you signed up from, the page that referred you, your IP address at the time and the time you joined. This lives in our own Postgres database, not in any analytics provider. We use it to tell you about the launch and occasional progress, in your language, and to understand which parts of the page bring people in. If you unsubscribe we keep a record of that so the address is not added again by mistake.

Account data

When you create an account we store your email address, a cryptographic hash of your password (never the password itself), the display name you give us, your interface language and time zone, your chosen creation intent, whether your email is verified, the IP address you signed up from, and the time you signed up. Sign-in sessions are stored with the browser they were opened from so you can see and end them. Magic-link, verification and password-reset tokens are stored as hashes until they are used or expire.

Content you create

Everything you make in Velysaro is stored so that you can come back to it: channel profiles (niche, market, language, audience, style, voice), ideas, hooks, scripts, storyboards, generated scenes and videos, the edits you make to them, and your calendar. This content may contain personal data if you put it there, for instance your own name or voice in a script.

Product and brand facts

For the product flow you may upload product descriptions, verified facts, allowed and prohibited claims, offers, logos, product photos and brand rules. We store these in your product library and use them only to generate content for you.

Studio series

If you use the Studio, we store your series and what you make for them: characters' looks and sheets, locations, scripts, shot plans, keyframes, takes, finished episodes, music you upload and your chat with the Studio's agent. Studio characters are fictional and must not show a real person (see the Terms of Service).

Faces and voices

The AI presenter is a generated face, not a photo or recording of you, and narration uses AI voices from a fixed catalogue. We do not collect biometric data such as face geometry or voiceprints, and we do not clone anyone's face or voice. A mascot made from your photo is a cartoon; when you let it speak, it speaks with the video's AI narration voice, never yours. Do not upload photos, video or audio of a real person without their permission (see the Terms of Service).

Billing data

Payments are handled by Paddle, which acts as merchant of record and is the seller of the subscription and credit packs you buy. Paddle collects your payment details, billing address and tax information under its own privacy policy. We receive from Paddle the confirmation of what you bought, your customer and subscription identifiers, the country used for tax, and invoice references. We never receive your full card number.

Usage and credits

We record which generations you run, how many credits they consume and their status, so that we can show you your balance, prevent abuse and diagnose failures. We also keep a small log of product events against your account in our own database (for example that a first video was generated), without any content, to understand whether the product is working for people.

Server logs

Our servers automatically record technical information about each request: IP address, browser type, the page or endpoint requested, timestamps and error details. We use these logs to keep the service secure and running.

Analytics

We use PostHog to understand how the website and the product are used. Until you opt in, PostHog is configured to run without cookies and without persistent identifiers, and collects only aggregate page and event data. If you accept analytics, PostHog sets cookies so that visits can be linked into a session and a returning visitor can be recognised. Session recording is not enabled. See Cookies and analytics below.

Support and correspondence

If you email us, we keep the correspondence and any details you include in it for as long as it takes to resolve the matter and for a reasonable period afterwards.

Why we use it and on what basis

Every use of personal data needs a lawful basis — "dasar pemrosesan" under Indonesia's PDP Law, "bases legais" under Brazil's LGPD, the same idea under Hong Kong's PDPO and the US state laws. Ours are these:

• Performing our contract with you. Creating and securing your account, generating the content you ask for, storing your work, showing you your credits, billing through Paddle, and sending you transactional email such as verification links, password resets and receipts.
• Our legitimate interests. Keeping the service secure, preventing fraud and abuse, diagnosing errors from server logs, understanding aggregate use of the product so we can improve it, and defending our legal rights. Where we rely on this basis we have weighed our interest against your rights, and you may object at any time (see Your rights).
• Your consent. Joining the waitlist, receiving product news, and analytics cookies. You can withdraw consent at any time; withdrawing does not affect processing that already happened.
• Legal obligations. Keeping tax and accounting records, and answering lawful requests from authorities.

We do not train AI models of our own on your content, product facts or videos, and we do not sell or licence them to anyone else for training. We also do not make decisions about you by automated means that have legal or similarly significant effects.

Who we share it with

We do not sell personal data. We share it with the service providers below, who process it on our instructions under data processing agreements, and only as needed to run Velysaro. The country after each name is where the provider is based and mainly processes data.

• Paddle (United Kingdom)Billing and merchant of record. Paddle sells the subscription to you, collects payment, handles tax and issues invoices. For payment data Paddle is an independent controller under its own policy.
• PostHog (United States)Product and landing analytics. Cookieless and without persistent identifiers until you opt in; session recording is not enabled.
• Resend (United States)Transactional email: verification links, magic links, password resets, receipts and waitlist messages. Resend receives your email address and the content of each message.
• OpenAI (United States)AI writing: ideas, hooks, scripts, storyboards and publish packs, plus an automatic check that a generated picture carries no stray text. Receives the prompts, the channel or product facts and the pictures needed for the step you requested. In the Studio it also draws keyframe images from the shot's description and the character sheets, and writes the scripts, the shot plans and the Studio agent's replies from the series, its characters and places, and your chat messages.
• Runway (United States)AI pictures, motion and the AI presenter for your scenes. Receives the picture descriptions, images and narration audio for the scene being generated. In the Studio it also makes video clips and keyframe images from the shot's prompt and its keyframe images.
• ElevenLabs (United States)AI voice generation. Receives the script text to be voiced and the chosen voice settings. In the Studio it also voices the characters' lines and, if you choose a generated score, receives the music prompt.
• Google (United States)Studio video, keyframe images and generated music, through the paid Gemini API. Receives the shot's prompt, its keyframe images and character sheets and, for a generated score, the music prompt.
• BytePlus (Singapore)Studio video. Receives the shot's prompt and its keyframe images. BytePlus has not published where it processes this data.
• fal (United States)Studio video, keyframe image edits, upscaling and lip-sync. Receives the shot's prompt and keyframe images, or the clip to upscale or lip-sync with its voiced line. In the Studio it also makes clips with LTX and MiniMax and lip-syncs with LatentSync, and for Premium videos it may animate scenes with LTX. When you use "Remove background music" on a recording, it receives that recording's sound to separate the voice. It also makes channel mascots and Studio characters speak with Kling AI Avatar: it receives the mascot's or character's picture (which may be the cartoon made from your photo) and its voiced line. When the background is removed from a product photo (when you cut it out, or when a product video you make uses it), from a part of a recording or from a talking-head presenter, it receives that photo, that part of the recording without its sound, or the presenter's clip.
• Sync Labs (United States)Lip-sync for Studio shots. Receives the finished clip and the voiced line.
• OpenRouter (United States)Automated quality checks on generated scripts (claim safety and language). Receives the script text being checked.
• HostingOVHcloud (OVH US, United States) hosts our application, database and stored media.

The AI providers receive the material needed for the piece you are generating and nothing more: we do not send them your account details. Some of our providers may use the material they receive to train or improve their own AI models, under their own terms. Where a provider offers a setting that keeps your content out of training, we turn it on before sending anything real. The position differs per provider and we state it plainly: OpenAI does not train its models on business API inputs or outputs by default; ElevenLabs trains on content by default and offers an account-level opt-out, which we use; Runway's terms for our account permit it to use inputs and outputs to train and improve its models. As our use grows we intend to move to Runway's business terms, which forbid this, and we will update this policy when we do. For the Studio: Google's paid Gemini API does not use prompts or responses to improve Google's products, and keeps them for 55 days to detect abuse; BytePlus does not train models on its customers' data unless they opt in; fal keeps request inputs and outputs for 90 days by default and may use anonymised or aggregated data derived from them to develop its services and models; Sync Labs' terms give it a lasting licence to use what it receives to develop and improve its services, and its privacy policy lists training its AI models among those uses. The Studio runs each model with its own maker where we can; models we reach through a reseller such as Runway or fal, such as Seedance, Kling and Wan, are also covered by their makers' terms with that reseller. Studio characters must be fictional, and we send the providers only what the shot needs, never your account details. Beyond the terms a provider publishes we cannot control what it does, which is why the list above says exactly what each one receives. Their own terms also govern how long they retain requests for abuse monitoring.

We may also disclose personal data where the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of the business, in which case this policy will continue to apply until you are told otherwise.

Connections you enable

Some features send data to a service you choose to connect, at your direction. If you connect a social account and publish from Velysaro, we send that platform the video, caption and settings you picked. If you connect an AI assistant (for example Claude) under AI connections, it can read and act on your Velysaro account within the permissions you approve, and receives what those actions return. These services are not our processors: their own terms and privacy policies apply to what they receive. You can disconnect any of them at any time in your settings. What an AI connection can see and do, and what we keep about it, is set out in AI connections and your data.

International transfers

We are established in Hong Kong, our application, database and stored media are hosted in the United States, and the providers above process data in the United States and other countries. Your personal data will therefore cross borders, including out of the country you live in.

For every transfer we rely on written contracts with each processor that bind it to protect the data and to use it only on our instructions. That is the safeguard Indonesia's PDP Law requires for a transfer abroad where the destination has no equivalent level of protection, the international-transfer basis under Brazil's LGPD, and the contractual protection required by Hong Kong's PDPO. For anyone in the EEA or the United Kingdom we use the European Commission's Standard Contractual Clauses and the UK Addendum. You can ask us which safeguard applies to a given transfer.

How long we keep it

• Waitlist email: until launch communications end or you unsubscribe, whichever comes first, and at most 24 months after your last interaction with us.
• Account and content: for as long as your account exists. When you delete your account, or ask us to, we delete your account data and content within 30 days, except for copies in encrypted backups, which expire within a further 90 days.
• Studio series: for as long as your account exists; to delete a series sooner, write to [email protected]. Deleting your account deletes them as described above.
• Billing records: for as long as tax and accounting law requires — seven years after the transaction under the Hong Kong Companies Ordinance and Inland Revenue Ordinance.
• Server logs: 90 days, unless a specific log is needed to investigate a security incident.
• Analytics: PostHog keeps the events for as long as our plan's retention allows — up to seven years under PostHog's standard retention. An event is only tied to a persistent identifier if you opted in, and you can ask us to delete the events associated with you at any time.
• Support correspondence: up to 24 months after the matter is closed.

Your rights

You have the following rights over your personal data, subject to the conditions of the law that applies to you:

• Access: to be told whether we process your data and to receive a copy of it.
• Rectification: to have inaccurate data corrected and incomplete data completed.
• Erasure: to have your data deleted where we no longer need it, where you withdraw consent, or where you object and we have no overriding grounds to keep it.
• Portability: to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Restriction: to have processing limited while a dispute about accuracy or lawfulness is resolved.
• Objection: to object to processing based on our legitimate interests, and to object at any time to direct marketing.
• Withdrawal of consent: to withdraw consent at any time where consent is the basis, for instance for analytics cookies or the waitlist.
• Complaint: to complain to the data protection authority where you live — for example the Privacy Commissioner for Personal Data in Hong Kong, the ANPD in Brazil, the Secretaría Anticorrupción y Buen Gobierno in Mexico, the supervising ministry under Indonesia's PDP Law, or your state Attorney General in the United States. We would appreciate the chance to address your concern first.

If you are in the US, Latin America or Indonesia

United States. We do not sell your personal data and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of on that front; we run no targeted advertising and no profiling that produces legal effects. Californians may exercise the rights to know, delete, correct and limit through the same address below, may use an authorised agent, and will never be treated differently for asking. The categories we collect, why, and who receives them are the ones listed above.

Brazil and Latin America. Under the LGPD you may additionally ask us to confirm that processing exists, to anonymise or block data processed unnecessarily, and to be told with whom we have shared your data — the list of processors above answers the last one. Requests go to the same address; we act as controller and our processors act on our instructions.

Indonesia. Under Law No. 27 of 2022 you may withdraw consent, ask for your data to be corrected or erased, object to processing and ask us to delay or limit it. Your data is processed outside Indonesia, on the basis described under international transfers. Our privacy contact below is the point of contact for data-subject requests.

How to exercise them

Write to [email protected] from the email address on your account, or from the address you gave to the waitlist. We may ask for information to confirm your identity before acting on a request that concerns account data. We answer as fast as the strictest deadline that applies: within 15 days for requests under Brazil's LGPD, within 45 days for US state privacy requests (extendable once by a further 45 days), from 16 January 2027 within 72 hours for access, correction, deletion and portability requests under Indonesia's PDP Law, and within one month otherwise. If a request is complex we tell you before the deadline passes. Requests are free unless they are clearly unfounded or excessive.

Some things you can do yourself: change your email, name and locale in account settings, and withdraw analytics consent from the cookie banner or the Cookie Policy page.

Cookies and analytics

We use a small number of strictly necessary cookies to keep you signed in and to protect forms against cross-site request forgery. Those do not need consent.

Analytics cookies are different. PostHog runs in a cookieless mode by default and sets cookies only after you opt in through the cookie banner. In cookieless mode each page view still reaches PostHog with the usual technical details of a web request, such as your IP address and browser type, but nothing links one visit to the next. You can withdraw that consent at any time from the banner or from the Cookie Policy page, which also lists every cookie and storage item we use and what each one is for.

Security

We protect personal data with measures appropriate to the risk: encryption in transit, hashed passwords, access controls limited to the people who need them, separation of production and development environments, and logging of administrative access. No system is perfectly secure; if we learn of a breach that puts your rights at risk we will notify you and the relevant authority as the law requires.

Children

Velysaro is not directed at children and we do not knowingly collect personal data from a child — in the United States that includes anyone under 13 for the purposes of COPPA. You must be at least 18 years old to create an account or join the waitlist. If you believe someone under 18 has given us personal data, write to [email protected] and we will delete it.

Changes to this policy

We will update this policy as the product and the law change. The date at the foot of this page shows the latest version. For material changes, such as a new purpose or a new category of provider, we will tell account holders by email or with a notice in the product before the change takes effect.

Contact

Privacy questions and requests: [email protected]. Everything else is on the contact page.