This Privacy Policy explains how Axon AI Ltd ("HeyVigo," "we," "us," or "our") processes Personal Data when you use HeyVigo websites, applications, AI tools, workspaces, and related services (collectively, the "Services").
Axon AI Ltd is a company limited by shares licensed by the Ras Al Khaimah Digital Assets Oasis Authority under license number 07010797.
"Personal Data" means information relating to an identified or identifiable individual.
1. Our Role
Axon AI Ltd generally acts as the controller or equivalent responsible business for Account, website, billing, product-usage, and support data.
When an enterprise customer determines why and how HeyVigo processes Content or member data in its Workspace, Axon AI Ltd may act as that customer's processor or service provider. The applicable customer agreement and Data Processing Addendum govern that processing.
2. Personal Data We Collect
Account and identity data
We may collect your name, email address, Account identifier, language, region, profile information, organization, role, verification status, and sign-in records. If you choose Google sign-in, we may receive a Google account identifier and verified profile fields authorized through that sign-in flow.
Workspace and Content data
We process Workspace names, member roles, invitations, permissions, projects, prompts, scripts, images, video, audio, voice samples, reference materials, settings, generated Output, task records, and related metadata.
Content may include a person's face, voice, likeness, or other Personal Data. You are responsible for having a lawful basis and required permissions before submitting Personal Data about another person.
Usage, device, and security data
We may collect IP address, device and browser information, session and Account identifiers, timestamps, language, application events, model and feature selections, task status, error and diagnostic records, security events, and abuse-prevention signals.
After analytics consent is granted, Google Analytics 4 may collect a client identifier, session identifier, page URL and title, referral information, browser and device information, approximate location, timestamps, and interaction events for measurement ID G-YCER9DL6FQ.
Billing data
When paid services are available, we may process billing name and address, country, tax information, order and invoice identifiers, payment status, subscription status, Credit transactions, refunds, reversals, and payment disputes.
Payment credentials are collected by the payment provider presented at Checkout. HeyVigo does not receive or store the full card number or card security code.
Support and communications data
We process messages, attachments, complaint and appeal records, rights requests, identity or authority evidence, communication preferences, and service-notice delivery records.
Cookies and similar technologies
We process session, authentication, security, consent, language, Workspace, preference, and consented analytics information through cookies, local storage, and similar technologies as described in the Cookie Policy.
3. How We Use Personal Data
We process Personal Data to:
- Create, authenticate, secure, and manage Accounts;
- Provide AI generation, project storage, export, and Workspace collaboration;
- Process orders, subscriptions, Credits, taxes, receipts, refunds, and payment disputes;
- Provide support and handle complaints, appeals, and rights requests;
- Prevent fraud, abuse, security threats, and policy violations;
- Diagnose errors and maintain the reliability and security of the Services;
- Measure website visits, sessions, page usage, product interaction, and service performance after analytics consent is granted;
- Send transactional and service communications;
- Send marketing only where permitted and subject to an available opt-out; and
- Comply with law, valid legal process, and our contractual obligations.
We may use aggregated or anonymized information that cannot reasonably identify an individual for service planning, security research, analytics, and product improvement.
4. Legal Grounds
We process Personal Data only where permitted by applicable law. Depending on the processing, this may include:
- Contract: processing necessary to create and manage an Account, provide requested features, complete a purchase, or administer a Workspace;
- Consent: analytics technologies, optional communications, model training participation, or another activity for which consent is required;
- Legal obligation: tax, accounting, consumer-protection, security, regulatory, and lawful-request obligations;
- Legal claims and protected interests: processing necessary to establish, exercise, or defend legal claims, protect the Data Subject or another person, or address fraud and serious security threats where permitted by law; and
- Another legal ground: any other ground or exception expressly permitted under applicable law.
You may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully or processing based on another legal ground.
5. AI Model Processing and Training
To complete a generation request, we send the Input, settings, and technical data required for that task to HeyVigo systems and to ByteDance or MiniMax, depending on the model selected. The Services identify the provider associated with the selected model.
We do not use Content to train a general-purpose model for other customers unless you make a separate informed choice to participate and we obtain any consent required by law.
ByteDance and MiniMax may have different processing locations, retention rules, and content restrictions. A model-specific notice or terms applies when additional processing is required for the selected model.
6. When We Disclose Personal Data
We disclose Personal Data only as described below or with your direction.
Service providers
We use Google for Google sign-in and Google Analytics, Stripe for payment processing, and ByteDance and MiniMax for AI model processing. We also use infrastructure, storage, content delivery, communications, support, and security providers needed to operate the Services.
A provider may act as our processor or as an independent controller for a service it provides directly to you. Independent providers process data under their own privacy notices and terms.
Workspace administration
Workspace owners and authorized administrators may access member identity, role, activity, project, Content, and usage information within the Workspace. Their organization is responsible for its own use of that information.
Your instructions
We disclose data when you direct an export, invite a member, connect a service, share Content, or otherwise request disclosure.
Legal, safety, and business events
We may disclose Personal Data where reasonably necessary to comply with law or valid legal process, protect rights or safety, investigate fraud or abuse, enforce our agreements, or complete a merger, financing, acquisition, reorganization, or sale of assets. We will provide notice where required by law.
7. International Data Transfers
Personal Data may be processed in the United Arab Emirates and in countries where Google, Stripe, ByteDance, MiniMax, and the infrastructure providers used by the Services operate. Those countries may have different data-protection laws.
Where applicable law requires a transfer safeguard, we use the safeguard applicable to the transfer, which may include contractual protections, an approved transfer mechanism, security controls, or an applicable legal exception.
8. Data Retention
We retain Personal Data only for the period needed for the purpose described in this Policy and for legal, accounting, security, fraud-prevention, and dispute requirements.
- Account, profile, and Workspace records are retained while the Account or Workspace is active and for the limited closure period needed to complete deletion, recovery, or dispute handling.
- Project Content and generation records are retained until deleted by an authorized user, the Account or Workspace closes, or an enterprise agreement specifies another period.
- Payment, tax, invoice, and Credit-ledger records are retained for the period required by applicable financial-record laws.
- Security, abuse, complaint, support, and rights-request records are retained for the period reasonably needed to resolve the matter, prevent repeated abuse, and establish or defend legal claims.
- Google Analytics cookies are retained for up to two years unless consent is withdrawn, the cookies are deleted, or a shorter browser or service setting applies.
- Other device-stored information remains until it expires, is replaced, or is removed through the browser or product controls described in the Cookie Policy.
When Personal Data is no longer needed, we delete or anonymize it. If immediate deletion is legally restricted or technically impracticable, we isolate the data and limit further processing until deletion is possible.
9. Security and Incidents
We use administrative, technical, and organizational safeguards designed to protect Personal Data, including access controls, encryption in transit, monitoring, data minimization, and incident-response procedures.
No system is completely secure. You must protect your sign-in methods and promptly report suspected unauthorized access.
If a Personal Data incident occurs, we will investigate, take appropriate corrective action, and notify affected individuals and authorities where required by law.
10. Your Privacy Rights
Subject to applicable law, you may have the right to:
- Receive information about processing and recipients;
- Access or receive a copy of Personal Data;
- Correct inaccurate Personal Data;
- Delete Personal Data;
- Restrict or stop certain processing;
- Receive eligible data in a portable format;
- Withdraw consent;
- Object to or opt out of eligible marketing or targeted-advertising processing;
- Request review of an eligible automated decision; and
- Complain to a competent data-protection authority.
Submit a request by email using the contact below. We may verify your identity, Account, and authority before acting. We will respond within the period required by applicable law. A right may be subject to an exception where information must be retained to complete a transaction, protect security, comply with law, preserve another person's rights, or establish or defend a legal claim.
11. Automated Review
We may use automated tools to detect fraud, abuse, security threats, and content-policy violations. Where an automated decision produces a legal or similarly significant effect and applicable law grants additional rights, you may request information, human review, or another available remedy.
12. Age Requirement
The Services are not intended for anyone under 18. If we learn that Personal Data was collected from a person under 18 in connection with an Account, we will take appropriate steps to delete it and close the Account.
13. Third-Party Services
Websites or services linked from HeyVigo have their own privacy practices. This Policy does not govern a third-party service that you independently choose to use.
14. Regional Notices
A regional privacy notice may supplement this Policy for a supported market. It will control only to the extent of a direct conflict concerning that market and processing.
15. Changes to This Policy
We may update this Policy when the Services, providers, or legal requirements change. We will revise the date above and provide additional notice where a change materially affects your rights.
16. Contact Us
For privacy questions or requests, contact:
Axon AI Ltd
Licensing authority: Ras Al Khaimah Digital Assets Oasis Authority
License number: 07010797
Office A, RAK DAO Business Centre
RAK BANK ROC Office, Ground Floor, Al Rifaa
Sheikh Mohammed Bin Zayed Road
Ras Al Khaimah, United Arab Emirates
Website: https://www.heyvigo.ai/
Email: contact@heyvigo.ai
You may also complain to the competent privacy or data-protection authority available to you under applicable law.