Privacy policy
Written to be read: if anything is unclear, write to vimoshorts@outlook.com.
1. Who we are and our data protection officer
VimoShorts is operated by Agência Foccus Internet e Publicidade Ltda (trade name Agência Foccus), CNPJ 10.220.873/0001-63, headquartered at Rua Alberto José, 89, Sala 1, Jardim Salete, Taboão da Serra/SP, Brazil, ZIP 06787-370. We are the controller of your personal data under the Brazilian General Data Protection Law (Law 13,709/2018, the LGPD).
Our data protection officer can be reached at vimoshorts@outlook.com. Use this address to exercise your rights and to ask questions about this policy.
2. Data we collect
We collect only what the service needs to work:
- Account data: name, email, password (stored irreversibly), phone number if you provide one, company and business details, and Google or Apple sign-in if you choose it.
- Content you upload: photos, voice recordings, videos, texts, scripts, profile links and reference material.
- Payment data: plan, credits, coupons, purchase history and charge status. Card numbers stay with Stripe; we do not receive or store them.
- Usage data: screens visited, videos generated, credit consumption, error messages and support requests.
- Technical data: IP address, browser, device, language and access logs (date and time).
- Acceptance records: the version of the Terms, the Policy and the voice and image authorizations you accepted, with date and masked IP.
- Cookie and measurement data: only if you allow it (see section 9).
3. Voice and face: biometric data
To create your clone we process an image of your face and your voice in a way that can identify you. This is sensitive personal data (biometric data, LGPD art. 5, II). We therefore process it only with your specific and prominent consent, under art. 11, I, given at sign-up in two separate fields: one for voice and one for image. Without that consent we do not create a clone or a voice.
- Single purpose: to create and update your video and voice clone and to generate the videos you ask for inside VimoShorts. We do not sell or rent your face or voice, and we do not use them to train our own or third-party models, or for any other purpose.
- Who processes it: the image is sent to HeyGen, which generates the video avatar, and the voice is sent to ElevenLabs, which generates the cloned voice. They act on our behalf and only for this purpose.
- Where it is kept: original files are kept in private storage (Cloudflare R2) reachable only by the platform. The providers above keep the clone and voice in their own systems, partly outside Brazil (section 6).
- Only what is yours: you declare that the face and voice you upload are yours, or that you have written permission from the person shown. We do not accept cloning third parties without permission.
- Revocation: you can withdraw consent at any time under My account › Privacy and data (voice and image separately) or by emailing vimoshorts@outlook.com. Revocation does not affect what was done before it.
- Effect of revocation: the revoked clone or voice stops working immediately and is deleted from our systems and from our providers within 30 days. Without voice or image you cannot generate new avatar videos. Videos already generated and downloaded stay with you; copies you published on social networks cannot be withdrawn by us.
You can use parts of the service without providing voice and face (for example, scripts and editing of material that does not involve a clone). Refusing consent only blocks the features that depend on it.
4. Why we use data and legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Create and maintain your account; provide the service, generate videos, bill and give support | Performance of a contract (art. 7, V) |
| Process your face image and voice for the clone | Specific and prominent consent (art. 11, I) |
| Security, fraud and abuse prevention, access logs and product improvement | Legitimate interest (art. 7, IX) |
| Keep tax and payment records and access logs | Legal obligation (art. 7, II) |
| Measurement and marketing cookies | Consent (art. 7, I) |
We use data to send service notices (billing, security, changes to the Terms). Promotional messages are sent only with your permission, and you can opt out at any time.
5. Who we share data with
We do not sell your data. We share the minimum necessary with providers that run the service for us, under contract and for the purpose described:
| Provider | What for |
|---|---|
| Cloudflare (R2, Workers) | File storage and delivery of the site and the app |
| VPS server (Coolify) | Hosting of the API, the database and the video processing |
| HeyGen | Video avatar (face image) |
| ElevenLabs | Cloned voice and audio generation (voice) |
| OpenAI and Google Gemini, through LiteLLM | Text, image and transcription AI (scripts, analysis, captions) |
| Stripe | Payments and subscriptions |
| Resend | Service emails |
| Google and Apple | Sign-in, when you choose to use your account |
| Sentry | Error logging so we can fix failures |
| Google Analytics, Microsoft Clarity and Meta Pixel | Measurement of visits and ads, only if you allow cookies |
| Apify and YouTube | Search of public videos and profiles you point to as references |
| Pexels, Pixabay, NASA and Higgsfield | Video and image libraries and media generation; they receive only search terms or generation requests, without your personal data |
We may also share data under a court order or an order from a competent authority, or to defend rights in legal proceedings, to the extent required. If the company is sold or reorganized, data stays under this policy.
6. International transfers
Some of the providers above are outside Brazil, mainly in the United States. We carry out international transfers under LGPD art. 33, through contractual clauses and safeguards offered by those providers, and we send only the data needed for each task. You can ask for more information about the safeguards at vimoshorts@outlook.com.
7. How long we keep data
| Data | Period |
|---|---|
| Voice, face and clones | Until you revoke the authorization or delete the account; removed from our systems and our providers within 30 days |
| Videos, projects and uploaded files | While the account exists; deleted with the account |
| Account registration and usage data | While the account is active. Account inactive for 24 months: we notify you and then anonymize or delete it |
| Tax and payment data | 5 years (legal obligation) |
| Access logs (IP, date and time) | 6 months (Brazilian Internet Civil Framework, art. 15) |
| Support (messages and tickets) | 2 years after the request is handled |
| Acceptance and authorization history | As long as needed to prove consent and meet legal obligations |
| Cookie choice | 12 months or until you change it |
| Measurement and marketing cookies | As in the table in section 9, and only if you allow them |
After these periods data is deleted or anonymized, unless the law requires longer retention or it is needed to defend legal claims.
8. Your rights
Under art. 18 of the LGPD you may request, at any time and free of charge:
- confirmation that we process your personal data;
- access to the data;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
- portability of the data to another provider, upon express request;
- deletion of personal data processed with your consent;
- information about the public and private entities with which we share data;
- information about the possibility of refusing consent and the consequences of refusal;
- withdrawal of consent, at any time, through a free and easy procedure.
How to exercise them: most of this you can do yourself in the app, under My account › Privacy and data (download your data, revoke voice and image, delete the account). For anything else write to vimoshorts@outlook.com. We reply within 15 days. For your security we may ask you to confirm your identity.
If you believe the processing violates the law, you may also complain to the Brazilian National Data Protection Authority (ANPD).
9. Cookies
We use cookies and similar technologies. Necessary cookies are always on; measurement and marketing cookies are enabled only if you allow them in the cookie notice. Until then no third-party tracker is loaded. You can change your choice at any time under , in the site footer.
| Group | What it does | Who / duration |
|---|---|---|
| Necessary | Keep the site and sign-in working and store your cookie choice. Cannot be turned off | Us; session and up to 12 months |
| Measurement | Count visits and show how screens are used, so we can improve the product | Google Analytics (up to 24 months) and Microsoft Clarity (up to 12 months) |
| Marketing | Measure the results of our ads on Instagram and Facebook. Exists only when the Meta Pixel is enabled on the site | Meta Pixel (up to 90 days) |
You can also block cookies in your browser settings; some parts of the site may stop working.
10. Security
We use encrypted connections (HTTPS), role- and need-based access, separation between test and production environments, private file storage and backups. No system is completely secure, but we work to reduce risk. If an incident that may cause significant harm occurs, we will notify you and the ANPD within the legal deadlines.
11. Minors
VimoShorts is for people 18 or older. We do not create clones of minors and we do not knowingly collect data from minors. If we learn of such an account, it will be closed and the data deleted.
12. Changes to this policy
When we change something relevant we publish a new version on this page with the effective date, notify you by email and ask for a new acceptance when the law requires it (for example, if the purpose of voice and image processing changes). Earlier versions are available on request.
13. Connected social networks
The Publish feature lets you connect your Instagram, Facebook, YouTube, TikTok and LinkedIn accounts to publish your videos and track their performance. This section explains what happens to the data from those accounts.
- Connecting is your choice: the connection uses OAuth, on the social network's own screen, only after your first purchase and only when you decide to connect. VimoShorts never sees or stores your social network password.
- Publishing only on your action: we publish only when you choose publish now or schedule. We never publish anything without an action from you.
- Access tokens: stored encrypted (AES-256-GCM) and deleted when you disconnect the account.
Data we read and store, from your own account only:
- Profile: account identifier, name or username, profile picture and follower count.
- Posts: caption, link, thumbnail and public metrics for each post (likes, comments, views, reach, shares and saves), as far as the network provides them.
- Posts made through VimoShorts: we track their metrics for 30 days after publication.
- Aggregated audience for the last 30 days: gender, age range, country and city, as aggregate figures, and the follower count history, only where the network provides it (currently Instagram). We do not receive or store personal data about individual followers.
What we use it for: solely to show the account owner post performance, the publishing calendar and the media Hub. We do not sell this data, we do not share it with third parties for their own purposes and we do not use it for advertising.
How long we keep it: data from a connected account is kept for as long as your VimoShorts account exists, so you can keep your performance history, or until you ask for it to be deleted. When you disconnect, the access tokens are deleted immediately and we stop reading from the network. A request made through the data deletion page removes the connected network's data, and it is also removed when the company account is deleted.
How to revoke access: disconnect the account in Publish › Connected networks and, if you wish, also remove VimoShorts in the social network's own settings (on Instagram and Facebook: Settings › Apps and Websites).
Platform rules: we use data received from the Meta, Google (YouTube), TikTok and LinkedIn APIs in accordance with each platform's policies.
YouTube: VimoShorts uses YouTube API Services. By connecting YouTube, you agree to be bound by the YouTube Terms of Service and the Google Privacy Policy. You can revoke VimoShorts's access to your YouTube data at any time through the Google security permissions page.