Privacy Policy

1. About This Policy

1.1. This Privacy Policy (the "Policy") explains what personal data the operator of the VSL·TOOLS service ("we", "us", the "Operator") collects, why, who it is shared with, how long it is kept and what rights you have. The Policy covers the websites vsl.tools and my.vsl.tools, the Telegram bot and all tools of the service (together, the "Service").

1.2. The Operator is the controller of personal data processed in connection with the Service. Contact for data matters: [email protected].

1.3. This Policy is part of the Terms of Service. By using the Service you confirm that you have read this Policy.

2. What Data We Process

2.1. Account data: email address, password (stored only as a cryptographic hash), name (if provided), interface language, balance state. When signing in via Google — your Google account identifier, name and email. When connecting Telegram — your account and bot-chat identifiers and username.

2.2. Your content: video, audio, images, voice samples, photos of people and texts that you upload or enter, as well as materials generated by the Service, transcripts and project metadata (names, settings, operation history).

2.3. Payment data: amounts, currency, status and technical identifiers of transactions passed to us by the payment provider (for crypto payments — including wallet addresses and transaction hashes). We do not collect or store bank card data.

2.4. Technical data: IP address, browser and device type, activity logs in the Service (request times, performed operations, errors), cookies (see Section 8).

2.5. Communications: your support requests (email, Telegram) and our replies, the history of service notifications.

3. Faces and Voices in Your Content

3.1. The content you upload may contain images of faces and voice recordings — data that can identify a person. We process them solely to perform the operation you have ordered: speech recognition, voice cloning for dubbing, lip synchronisation, speaker replacement and the like.

3.2. We do not use this data to establish the identity of people in videos, do not build a biometric identification database, do not use your content to train our own AI models and do not share it with third parties for training their models.

3.3. By uploading content containing other people's likeness or voice, you confirm that you have obtained their consent (see clause 5.4 of the Terms of Service). If you believe your face or voice is being processed in the Service without your consent, write to [email protected] — we will review the request and, if substantiated, delete the materials.

4. Purposes and Legal Bases

4.1. We process data in order to:

• provide the Service — registration, running generations, storing projects, balance accounting (basis: performance of the contract — the Terms of Service);
• process content containing faces and voices in the operations you order (basis: performance of the contract and your consent, expressed by uploading the content and starting the operation);
• ensure security — protection against hacking, fraud and abuse, logging, access control (basis: our legitimate interest in protecting the Service and its users);
• comply with the law — transaction records, responses to lawful requests from authorities (basis: legal obligation);
• send service messages — operation statuses, balance, account security (basis: performance of the contract);
• send news and marketing messages about the Service (basis: legitimate interest / your consent). You can opt out at any time: write to [email protected] and we will exclude your address from mailings; Telegram notifications can be turned off in your account settings.

4.2. We do not make automated decisions about you with legal or similarly significant effects — decisions to restrict an account are made by a human — and do not profile you for advertising.

5. Who Data Is Shared With

5.1. We share data only to the extent necessary for the Service to operate, with the following categories of recipients:

• cloud compute and storage providers — media processing (GPU generations) runs on their servers and files are stored there; media is passed to isolated compute environments under our control and deleted after processing;
• AI text-processing providers — individual text fragments (for example, for utterance markup or translation) may be processed by third-party APIs;
• payment providers — to process balance top-ups;
• Google — if you sign in with a Google account;
• Telegram — if you have connected the bot (notifications, support, sign-in);
• Cloudflare — content delivery, protection against attacks and bots, Turnstile verification;
• email providers — to send Service emails.

5.2. We may disclose data where required by law or a valid request from a competent authority, and to protect the rights and safety of the Service or third parties.

5.3. In the event of a reorganisation or business transfer, data may pass to a successor subject to this Policy; we will notify you.

5.4. We do not sell personal data and do not share it with third parties for their advertising.

6. International Transfers

6.1. The servers of the Service and its suppliers are located in various jurisdictions, including the European Union and the United States. When transferring data outside your country, we limit it to the minimum necessary and apply reasonable contractual and technical safeguards.

7. Retention

7.1. We keep data for the following periods:

• Project files (uploaded and generated video/audio/images) are stored for a limited time — currently 7 days by default from the project's creation; the deletion date is shown in your dashboard and the period may change. After it expires, the files are deleted automatically; project settings, texts and operation history are retained, and the project can be revived with a new generation — the file retention period then starts anew.
• Voice samples and speaker photos saved in a project for repeat generations are kept until you delete them or the project, or request deletion of your account.
• Account data — for as long as the account exists.
• Financial records (balance history, payments) — for the periods required by accounting law.
• Technical logs — for a limited period necessary for security and diagnostics.

7.2. After account deletion we delete or anonymise your data, except data the law requires us to keep longer (in particular, financial records).

8. Cookies

8.1. We use only technically necessary first-party cookies: session and request-forgery protection (CSRF), colour theme, "remember me", service preview cookies. Cloudflare may set its own service cookies for bot protection (including during Turnstile verification).

8.2. There are no advertising trackers or third-party analytics on the Service's websites. If this changes, we will update this Policy and, where required by law, ask for consent.

9. Security

9.1. Data is transmitted over secure channels (TLS), passwords are stored only as hashes, access to data is restricted, and media processing runs in isolated environments. However, no system guarantees absolute security; report any concerns to [email protected].

9.2. If a data breach creates a high risk to your rights, we will notify you and, where required, the competent authority.

10. Your Rights

10.1. You have the right to:

• know what data of yours we process and obtain a copy of it;
• correct inaccurate data;
• delete data (including individual projects, voice samples or the entire account);
• restrict processing or object to it, including to marketing messages;
• withdraw consent — this does not affect the lawfulness of processing before withdrawal;
• receive the data you provided in a structured, machine-readable format where technically feasible.

10.2. To exercise your rights, write to [email protected] from the address your account is registered to. We will reply without undue delay and no later than within 30 days.

10.3. You also have the right to complain to a supervisory authority: in Ukraine — the Ukrainian Parliament Commissioner for Human Rights; in EEA countries — your national data-protection authority.

11. Children

11.1. The Service is intended for persons aged 18 and over. We do not knowingly collect children's data. If you become aware that a child is using the Service, let us know — the account will be closed and the data deleted.

12. Changes to This Policy

12.1. We may update this Policy. We will announce material changes in advance — by email, in Telegram or in your dashboard. The date of the current version is shown on this page.

13. Language and Contact

13.1. This Policy is drawn up in Ukrainian; the Russian and English translations are provided for convenience. In case of discrepancies, the Ukrainian version prevails.

13.2. Data questions: [email protected] or the support Telegram bot in your dashboard.