Viko Privacy Policy

This Policy applies to the Viko website, Chrome extension, Viko Cloud, paid features, and support services operated by VESCEND TECHNOLOGY LIMITED (collectively, the “Services”). It describes the data we process, why we process it, where it is stored, who receives it, and the choices available to users.

• Third-party websites, models, platforms, and local applications that you choose to access are also governed by their own privacy policies.
• If you use the Services for an organization, you must be authorized to submit the relevant content and provide any required notices.

We process only data needed to provide, protect, and improve disclosed functionality. Different features process the following data.

• Account and authentication: account identifiers, email, username, avatar, sign-in method, authentication status and session, language, and account settings.
• Content you submit: images you select or upload, persistently stored character-face images, selected text, prompts, palettes, pose references, tags, generated results, task history, and saved items.
• Source and browsing information: only when you start an analysis, generation, collection, or save action, Viko records the related page's origin + pathname and removes query parameters, fragments, embedded usernames, and passwords. Viko does not collect general browsing history.
• Task and usage information: task and run IDs, selected models and settings, status, timestamps, credit changes, subscription entitlements, feature events, and stable error codes.
• Transaction information: plan, billing interval, purchase, renewal, cancellation, refund, dispute status, transaction identifiers, and limited payment-method details returned by a payment processor. Viko does not store full card numbers or security codes.
• Technical and communications information: IP address, device and browser type, performance, crash, security and abuse-prevention logs, and support requests, feedback, and related correspondence you submit.

Viko content scripts can display the floating orb, image-hover controls, and text-selection controls on ordinary webpages. Page load, image hover, and text selection are handled locally in the current tab and do not, by themselves, upload current-page content.

• Viko processes the data required for an action only after you explicitly click analyze, generate, batch process, collect, save, send, sign in, or another disclosed control.
• A visible-image batch runs only after you start it and processes at most six qualifying images in the current viewport. Viko does not upload a full DOM, whole-page text, every page image, passwords, or payment details found on a page.
• Selected web images are retrieved with credentials: omit, without webpage cookies or HTTP authentication data. A task-scoped image copy may remain in your browser for recovery or retry and is removed when you delete the related task.
• The temporary imageFetchUrl used to retrieve a selected image is not written to task history or diagnostic logs and is not sent to Viko Cloud, model providers, ChatGPT, or Eagle.
• After sign-in, when you open a Viko cloud surface or use a cloud-backed feature, Viko may synchronize account status, credits, subscriptions, model options, task history, generated results, and saved items. This synchronization excludes current-page content that you have not submitted.

We use data to perform our contract, provide features you request, protect the Services, comply with legal obligations, or act on consent where required.

• Create and manage accounts and provide reverse prompting, generation, batch tasks, sync, collections, history, subscriptions, credits, and support.
• Send the images, text, prompts, references, and settings required for a reverse-prompt or generation action to the selected model provider.
• Verify transactions, deliver entitlements, and handle cancellations, refunds, disputes, accounting, and tax records.
• Maintain, troubleshoot, and improve functionality, measure reliability, and prevent fraud, abuse, unauthorized access, and security incidents.
• Send necessary service, transaction, and policy notices and marketing communications that you choose to receive.

Viko stores different data in your browser and in Viko Cloud according to the data type.

• Browser storage: extension settings, language and model preferences, authentication sessions, task queue state, local task history, thumbnails, task image caches, generated-asset records, and Eagle configuration. Data remains until you delete the related task or setting, sign out, clear extension data, or uninstall the extension; task image caches are removed with the related task.
• Viko Cloud: account profile, authentication records, credits and subscription status, task history, generated results, saved assets, character-face originals, manually confirmed identity crops, and sanitized page-source URLs. Character faces persist until you delete the asset, request account deletion, or they are no longer needed; task history does not store face-image bytes or signed URLs.
• Transaction, security, fraud-prevention, refund, chargeback, dispute, tax, and legal records may be retained after account deletion as required or permitted.
• Deleted information may remain in restricted backups for a limited period until overwritten through normal backup cycles. Aggregated or de-identified data that cannot reasonably identify you may be retained where lawful.

Viko does not sell personal information or use User Content for third-party targeted advertising. We share only the data needed in the following circumstances.

• Viko Cloud and infrastructure: Supabase provides authentication, databases, task history, and saved-item storage; Vercel and cloud-storage providers support the website, APIs, runtime, and necessary asset storage.
• AI model services: depending on the feature you select, APIMart, AICOMING, Volcengine (Ark), or comparable model providers process the images, text, prompts, references, and generation settings you explicitly submit. Reverse prompting processes only the source image; when generation starts, only the manually confirmed identity crop is sent as the facial-identity reference, not the character-face original.
• Google OAuth: used only when you choose Google sign-in and only for information required to authenticate you.
• Stripe: processes payment information when you purchase a subscription or credits. Viko receives only limited records needed to complete transactions and provide entitlements.
• OpenAI/ChatGPT: only after you click the ChatGPT button is the current prompt sent to OpenAI and filled into ChatGPT.
• Eagle: only when you explicitly save to Eagle are the image, prompt, tags, and sanitized page-source URL sent to your local Eagle service.
• We may also disclose necessary information to comply with law, investigate fraud or security incidents, enforce our terms, or complete a financing, reorganization, merger, acquisition, or asset transaction subject to appropriate protection.

We use safeguards proportionate to the risk, including HTTPS transport, account isolation, server-side access controls, permission separation, limited logging, and security monitoring.

• Ordinary diagnostic logs do not store full prompts, selected text, page-source URLs, image bytes, signed image URLs, character names, facial descriptions, model responses, access tokens, refresh tokens, API keys, cookies, or payment credentials.
• Human access to user data is limited to support you explicitly request, legal requirements, security or abuse investigations, and necessary internal operations using aggregated and anonymized data.
• No system can guarantee absolute security. Protect your account credentials and contact us if you notice suspicious activity.

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent, obtain a copy or data portability, and complain to a regulator.

• Tasks, history, and saved items can be deleted through product controls. You can also disable the floating entry point, disable extension features for particular sites, sign out, or uninstall the extension.
• For account deletion, bulk removal of cloud data, or information you cannot remove yourself, contact support@vescend.com.
• We may verify your identity before completing a request and may decline requests that are manifestly unfounded, repetitive, excessive, or harm another person's rights where permitted.

Viko's use of information obtained from browser platforms, Chrome APIs, or Google APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

• Viko collects, uses, and transfers only data necessary to provide or improve its disclosed single purpose and user-facing features.
• Viko transfers this data only to provide requested features, protect security, comply with law, or complete an appropriately protected corporate transaction.
• This data is not used for personalized advertising, retargeting, credit-worthiness, data brokerage, or information resale.

Viko serves users in different locations, so personal information may be processed or stored outside your region. Where required, we use contracts, access controls, or other lawful mechanisms to protect international transfers.

• The Services are not directed to children below the age at which they can independently consent to data processing in their location. Contact us if you believe a child submitted information without appropriate authorization.
• We update this Policy when the Services, providers, law, or data practices change and post a new effective date. We provide additional notice for material changes and obtain consent again where legally required.