Viko Privacy Policy

This Policy applies to the Viko website, browser extension, cloud services, and related features operated by VESCEND TECHNOLOGY LIMITED (collectively, the “Services”). It explains how we collect, use, disclose, retain, and protect personal information.

• By using the Services, you acknowledge that you have read this Policy. Where consent is legally required, we request it separately, and you may withdraw it where permitted.
• Third-party websites, models, platforms, and local applications that you choose to access are governed by their own privacy practices.
• If you use the Services for an organization, you are responsible for required notices and authorization.

We collect information to the extent needed to provide and protect the Services. If you do not provide certain information, some account, sync, generation, or paid features may not be available.

• Account information: account identifiers, email, sign-in method, authentication status, language, and settings.
• User Content: images, text, prompts, references, tags, results, and related metadata that you choose to select, upload, enter, generate, save, or sync.
• Transaction information: plan, billing interval, purchase, renewal, cancellation, refund, and dispute status, together with transaction identifiers and limited payment-method details supplied by a payment processor. We do not store full card numbers or security codes.
• Usage and technical information: feature events, tasks and credit changes, device and browser type, IP address, time, performance, crashes, security events, and limited diagnostics.
• Communications and local data: support requests, feedback, related correspondence, and cookies, local storage, or similar technologies used for sign-in, settings, and temporary tasks.

Information may be supplied directly by you, generated when you use the Services, or provided through sign-in, payment, and other third-party features that you choose. The browser extension processes webpage information only as needed for disclosed functionality.

• When you invoke analysis, generation, saving, sync, or external-send features, we process the selected image, text, prompt, and settings needed for that action.
• Routine account sync is not collection of the current webpage. Ordinary browsing does not cause us to upload an entire page, every image, complete browsing history, or passwords and payment details found on a page.
• We may automatically record access and task events for security, abuse prevention, and reliability.
• Information obtained through third-party sign-in or authorization is limited to the scope shown in that flow.

Where applicable, we process information to perform our contract, provide requested features, pursue legitimate interests, comply with legal obligations, or act on your consent.

• Create and manage accounts and provide analysis, generation, sync, collections, history, subscriptions, credits, and support.
• Verify transactions, deliver benefits, and handle cancellations, refunds, disputes, and financial records.
• Maintain, secure, troubleshoot, and improve the Services and prevent fraud, abuse, unauthorized access, and security incidents.
• Send service notices, transaction messages, policy updates, and marketing communications that you choose to receive.
• Enforce terms, address complaints, protect Viko, users, and the public, and create aggregated or de-identified information where permitted.

To perform an AI feature that you request, we transmit the necessary User Content and parameters to technology providers processing data on our behalf. Different features may use different models or processing routes.

• We require providers to process information under instructions, contracts, and applicable law and to use protections proportionate to risk.
• We do not use User Content to train general-purpose AI models without separate, explicit consent.
• Viko does not use User Content to make solely automated decisions that produce legal or similarly significant effects about you.
• Do not submit content you are not entitled to process or sensitive personal information unnecessary for the selected feature.

We do not sell personal information or use User Content for third-party targeted advertising. We disclose necessary information only in the following circumstances and use appropriate contractual, access, or other safeguards.

• Service providers: vendors acting for us in cloud computing, data storage, AI processing, authentication, payments, communications, security, analytics, and support.
• Payment processing: payment credentials are processed directly by a payment processor, currently Stripe. We receive only limited records needed to complete transactions, deliver benefits, handle refunds, and meet financial obligations.
• At your direction: when you enable an external platform, sharing destination, or local-application feature, we send the information needed to complete your action.
• Legal and safety: to comply with legal process, enforce terms, investigate fraud or security events, or protect Viko, users, and the public.
• Corporate transactions: in connection with financing, reorganization, merger, acquisition, asset sale, or a similar event, subject to continued appropriate protection.
• Aggregated or de-identified information: for lawful analytics, research, and business purposes where an individual cannot reasonably be identified.

Viko serves users in different locations, and personal information may be processed or stored outside your region. Where required, we use contractual terms, risk assessments, access controls, or other lawful transfer mechanisms. We apply reasonable protections consistent with this Policy regardless of processing location.

We retain information only as long as needed to provide the Services, maintain records, resolve disputes, enforce agreements, protect security, and meet legal obligations. Retention depends on the nature, purpose, risk, and legal requirements of the information.

• You may delete certain content through product controls or contact us to request account deletion and removal of information not available through those controls.
• After deletion, information may remain in backups for a limited period until overwritten through normal cycles.
• Information required for tax, accounting, fraud prevention, security, disputes, refunds, chargebacks, or legal requests may be retained after account deletion.
• De-identified information that cannot reasonably be re-associated with an individual may be retained where permitted.

We use safeguards proportionate to the nature and risk of information, including encryption in transit, access controls, permission separation, limited logging, and security monitoring. No system can guarantee absolute security, and you should protect your credentials and contact us about suspicious activity.

• If a personal-data incident requires notice under applicable law, we will notify affected persons or authorities as required.

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent, obtain a copy or data portability, and complain to a regulator.

• Account settings may allow you to manage certain information, sync, cookies, and communication preferences. Disabling processing may make related features unavailable.
• We may verify identity and may decline requests that are manifestly unfounded, repetitive, excessive, or adversely affect another person's rights, where permitted.
• For an authorized-agent request, we may require proof of authority and direct identity verification.
• We do not discriminate in a manner prohibited by law because you exercised a privacy right.

Information obtained from browser platforms or related APIs is used only to provide or improve clearly disclosed functionality, consistent with applicable Chrome Web Store User Data Policy and Limited Use requirements.

• Such information is transferred only to provide requested features, protect security, comply with law, or complete a lawfully authorized corporate transaction.
• It is not used for personalized advertising, retargeting, credit-worthiness, data brokerage, or information resale.

The Services are not directed to children below the age at which they may independently consent to data processing in their location. We do not knowingly collect their personal information. Contact us if you believe a child provided information without appropriate authorization.

We may update this Policy to reflect changes in the Services, law, risk, or business practices. The revised version will be posted here with a new effective date. We will provide additional notice of material changes by reasonable means and obtain consent again where legally required.