Privacy Policy

1. Who this notice is from

This notice explains how the VIRTUALZ project team handles information through virtualz.app. For privacy questions or requests, contact hi@virtualz.app. It applies to our website and pilot application; external wallets, social platforms and blockchain services have their own privacy notices.

This notice describes the current pilot. TikTok and Instagram connections use Ayrshare as described below. We will update this notice before introducing materially different data uses.

2. Information we process

• Wallet and access information: your public Solana wallet address, a time-limited sign-in challenge, the signature supplied to verify it, a server-side session record and necessary authentication cookies. The private key and seed phrase stay with your wallet; we do not request them.
• Your launch drafts: character names, personality, lore, visual and voice directions, uploaded portraits and icons, intended social handles, token descriptions and links, planned budgets, content preferences and boundaries. An intended social handle is supplied by you and is not fetched from the platform.
• Operational information: your IP address as needed to process requests and apply rate limits, draft identifiers, timestamps, and selected account or security events needed to operate and diagnose the service.
• Support information: your email address and the contents of messages you choose to send us.

Public wallet addresses can become personal information when linked to a person. Avoid placing private information about yourself or others in prompts, character biographies or uploaded images. The current pilot does not perform facial identification or biometric matching.

3. Why we use this information

We use account and draft information to verify access, save and restore your work, deliver private image previews and exports, provide support, and operate the features you request. We use limited operational data to prevent abuse, enforce quotas and diagnose failures. We do not sell your personal information or use your drafts for advertising profiles.

Where data-protection law requires a legal basis, providing requested account and draft services relies on performance of our agreement with you; proportionate security and maintenance activities rely on our legitimate interests in a safe, functioning service; legal compliance relies on applicable obligations; and optional permissions rely on consent where required. You may object to processing based on legitimate interests, subject to the conditions of applicable law.

The current pilot does not send drafts or uploaded images to AI generation providers or use them to train our own AI models. Before enabling external AI generation, we will explain the providers and relevant processing. Current automated checks concern access, input validation, quotas and launch readiness; they do not make decisions intended to have legal or similarly significant effects on you.

4. Social account connections

Optional TikTok and Instagram account linking is provided through Ayrshare. When you choose Connect for a saved Virtual, we create a separate Ayrshare user profile identified by that Virtual’s random identifier, then open a short-lived account-linking page. Ayrshare and the selected social platform handle authorization; we do not receive your social-platform password.

VIRTUALZ stores the provider profile identifier, an encrypted profile access key, the associated wallet and Virtual identifiers, connection status, and available account usernames and display names. We use these records to maintain the correct character-to-account connection and show you which account is linked. Ayrshare handles platform authorization credentials. Its connection page and the selected platform process the browser and authorization information needed for that flow.

Live publishing is not activated in this pilot. When enabled for an approved test or production feature, publication sends the selected video URL, caption, destination and relevant publishing options to Ayrshare and the platform. Publication identifiers and status are retained to track the result and prevent duplicate sends. Connecting an account alone does not start posting.

You can decline linking and continue preparing drafts. Use Disconnect for an individual network or Remove social profile for all accounts linked to this Virtual. Existing posts remain on their platforms. You can also revoke permissions through the platform’s settings and request deletion of related VIRTUALZ records.

5. Service providers and disclosures

Our production pilot is hosted on a Hetzner server. Hosting infrastructure processes the information needed to deliver the website, database, uploaded media and backups. Authorized VIRTUALZ operators may access information as necessary for support, maintenance, security and deletion requests.

The website currently loads fonts from Google Fonts, which receives connection information such as an IP address and requested font URL when your browser contacts it. External wallet software handles wallet approval and signatures. Helius supplies our Solana RPC connection; the current integration performs a network-health check and does not submit your character content or wallet credentials to Helius.

Ayrshare provides social account linking and the publishing API. We share the profile and account-operation information described above when you use these features. Preparing a character draft alone does not send its content to Ayrshare.

We may disclose information if required by law, in response to a valid legal request, or when necessary to protect users and the service from abuse. AI generation providers do not receive a draft merely because you prepare a visual brief.

Hosting and third-party services may process information outside your country. Where applicable law requires international-transfer safeguards, we must use the relevant contractual or other lawful safeguards before such transfers. Contact us for information about the arrangements relevant to your data.

6. Cookies, browser storage and security

We use essential cookies for sign-in: the challenge cookie expires after five minutes and the login session normally expires after seven days. Signing out invalidates the current server session. The browser may also use session storage to carry a chosen character concept into the launch form. Unsaved form content remains in the page until exported or explicitly saved.

The current application does not use advertising cookies or a third-party analytics SDK. Blocking essential cookies prevents online sign-in and draft management, but public pages remain accessible.

We use HTTPS, server-side ownership checks, limited application privileges and protected runtime credentials. No system can eliminate every risk. Never send us a seed phrase, wallet private key, password or session token in a support request.

7. Retention and deletion

• Saved drafts and uploaded assets remain available until you delete them or request account/data deletion. Deleting a draft removes its database record; uploaded assets can remain separately stored, so request their deletion too if you want everything removed.
• Social connection records remain until the social profile is removed or you request deletion. Disconnecting one network updates its binding while retaining the profile for other networks. Pending or uncertain publication records must be resolved before profile removal; contact support for assistance.
• Sign-in challenges are valid for five minutes; sessions normally last seven days. Expired database records are removed by periodic cleanup.
• Operational records are retained as needed to maintain the service, investigate security issues and resolve disputes. Container logs rotate by size rather than a fixed number of days; short-term rate-limit records expire automatically.
• Local recovery backups normally rotate out within approximately nine days. Deleted information may remain in a restricted backup until that rotation completes. Where information must be retained to meet a legal obligation or handle a specific dispute, retention is limited to that purpose.

Information on a public blockchain cannot normally be erased by VIRTUALZ. Content independently held by a social platform is subject to that platform’s deletion process.

8. Your choices and rights

Depending on the law that applies to you, you may have rights to access, correct, delete or receive a portable copy of your personal information, restrict processing, object to processing, or withdraw consent. You can edit and export drafts in the application and request further assistance at hi@virtualz.app. Withdrawal does not affect processing already carried out lawfully.

See Data deletion for the request process. We may need to verify control of the relevant account using proportionate information or a wallet message; we will not ask for a private key. We will respond within the period required by applicable law and explain any exception. You may also complain to the data-protection authority in your jurisdiction.

9. Children and updates

VIRTUALZ is intended for adults aged 18 or older. We do not knowingly provide accounts to children. Contact us if you believe a child has provided personal information so that we can investigate and address it.

We will update this page when our practices change. The effective date identifies the current notice; material changes will receive additional notice where required.