Privacy Policy

1. Who is responsible

AIO Solution, [REGISTERED ADDRESS], is the data fiduciary (under India's Digital Personal Data Protection Act 2023) and data controller (under the UK and EU GDPR) for personal data processed through Selfcast.

2. What we collect

Account data

Email address, name, and authentication identifiers if you sign in with Google.

Biometric-derived data

If you create a character from your own photographs, a selfie video, or a voice sample, we process facial and vocal characteristics. We treat this as sensitive personal data:

• it is encrypted at rest and in transit;
• we do not use it to train any model, ours or a provider's;
• we record your consent with a timestamp and the exact policy text shown to you;
• you can delete it at any time, and we complete deletion within 7 days.

Routes offered by AI providers on free tiers may permit the provider to train on submitted data. Those routes are disabled by default for user content and we do not send your uploads to them.

Content you create

Episode descriptions, attached images and clips, generated scripts, stills and video, and the metadata around them.

Usage and billing data

Which models ran, what they cost, credits spent, and technical logs including IP address and device information for security and abuse prevention. Payment card details are handled by our payment processors and never reach our servers.

3. Why we process it

• To provide the service — performance of our contract with you.
• To bill you — performance of our contract, and legal obligation for tax records.
• To keep the service safe — legitimate interests in preventing abuse and fraud.
• To process face and voice data — your explicit consent, which you can withdraw.

4. Who we share it with

Generation happens on infrastructure we do not own. To produce an episode we transmit your description, reference images and voice samples to the providers below, each of which acts as a processor on our instructions.

[Processing regions are stated to the best of our current understanding and are subject to confirmation against each provider's data-processing agreement before launch. Providers are added and removed as models change; this table is maintained against our provider registry.]

5. International transfers

Most providers process outside India, the UK and the EEA. Where we transfer personal data internationally we rely on the provider's standard contractual clauses or equivalent safeguards. [The specific transfer mechanism for each provider requires confirmation.]

6. How long we keep it

• Raw generations — 30 days, then deleted automatically.
• Finished episodes — while your subscription is active, plus a 90-day grace period.
• Face and voice data — until you delete it or close your account.
• Billing records — as required by Indian tax law.
• Audit logs — retained for security investigation.

7. Your rights

You can access, correct, export or delete your personal data, and withdraw consent for biometric processing. Use the settings in your account, or the data deletion request form — which is also open to people who are not users, if someone has uploaded your face or voice.

Under the DPDP Act you may raise a grievance with our Grievance Officer: [GRIEVANCE OFFICER NAME], [GRIEVANCE OFFICER EMAIL]. If unsatisfied you may complain to the Data Protection Board of India, or to your local supervisory authority in the UK or EEA.

8. Children

Selfcast is not for anyone under 18. We do not knowingly collect data from children, and we do not permit characters depicting minors.

9. Cookies

See our Cookie Policy.

10. Security and breaches

Provider API keys are held under envelope encryption and every use is audited. Uploads are encrypted at rest. If a breach affects your personal data we will notify you and the relevant authority within the periods the DPDP Act and GDPR require.

11. Changes

We will give notice before a material change takes effect. The version and date at the top of this page identify the current text.