Privacy Policy
Kasamila Effective date: 10/01/2026 Data controller and contact: Vatary Inc., kasamila-privacy-policy@vatary.com.
Kasamila Effective date: 10/01/2026 Data controller and contact: Vatary Inc., kasamila-privacy-policy@vatary.com.
Kasamila provides a browser-based real-time avatar inference API and SDK, a library of public avatars, and tools for customers to create private avatars. This policy explains how we process personal information when you visit our site, use an account or API, upload training material, or submit a rights request. Our inference API and SDK do not send an application's chat text, voice audio, or conversation content back to Kasamila. Customers control those application data flows and choose their own speech and conversational AI providers. If a customer embeds our technology in its own product, that customer determines how it collects and uses its end users' information and must explain those practices in its own privacy notice.
1\. Information we collect
- Account and business information: name, email, organization, login credentials or authentication identifiers, support requests, and account settings.
- Billing and usage information: purchases, package balances and expiration dates, payment status and transaction references, API key identifiers, token issuance, avatar-session start and end times, billable seconds, concurrency allocations, device/browser diagnostics, and security logs. Payment details are handled by Stripe.
- Private avatar material: the video you upload for avatar creation (up to one minute), information needed to assess quality and permission, the avatar template produced, and training materials or artifacts generated in that process. A video may contain a person's face, voice, or other identifying features. Depending on how it is processed and the applicable law, derived information may be treated as biometric or other sensitive personal information.
- Customer-provided support and rights materials: proof of authorization, consent records, complaint correspondence, and evidence submitted to investigate impersonation or infringement.
- Website information: IP address, browser and device type, essential cookies or similar identifiers.
Application content does not flow to Kasamila through the inference API or SDK. The customer's chat text, live voice input, generated voice output, prompts, and conversation history remain within the customer's application and the services the customer chooses. Our inference service receives the authorization and usage metadata described above, not the contents of those conversations. Kasamila does not access or store that application content through the inference service. This statement does not cover information a customer separately chooses to send to Kasamila, such as a private-avatar training video, a support attachment, or the text of a rights complaint. Providers selected by the customer have their own data practices, which the customer should review and disclose.
2\. How and why we use information
We use information to create accounts; authenticate short-lived browser tokens; deliver public and private avatar inference; process and validate avatar-training requests; maintain time balances and concurrency limits; take payments; prevent fraud and misuse; answer support and rights requests; secure and improve the service; and meet legal obligations. Where applicable law requires a stated legal basis, the relevant basis may be performance of a contract, legitimate interests in operating and securing the service, compliance with law, or consent for a specific optional activity or sensitive-data processing.
We do not use a customer's private avatar, uploaded video, or derived personal features to train an unrelated shared avatar or advertise another customer's product without a separate lawful permission.
3\. Public avatars
Kasamila makes selected public avatars available for testing and commercial applications while a customer has the required inference time and concurrency allowance. Use of a public avatar grants access to that avatar through the service; it does not transfer ownership of the avatar, underlying materials, or Kasamila's technology. We may replace, restrict, or withdraw a public avatar, including one used in a live product, at any time. Customers should maintain a fallback for production applications. If a change affects personal information, the data-handling provisions of this policy still apply.
4\. Private avatars, permissions, and ownership
Customers can purchase private-avatar creation credits, upload a qualifying video, and create a private avatar template. The customer retains its rights in the uploaded video and owns the private avatar video template and its associated intellectual property to the extent those rights can lawfully be owned or transferred. Creating a template does not give the customer rights over another person's face, voice, performance, or other protected material. The customer is responsible for obtaining all required permissions from people appearing in its materials and for its intended use.
Kasamila processes the uploaded video and training data or artifacts to create, maintain, troubleshoot, and deliver the customer's private avatar. Kasamila owns the technical training data and intermediate training artifacts that it independently creates for that process, to the extent such rights can be owned under applicable law, and retains its rights in its training methods, software, and inference engine. This does not transfer ownership of the customer's source video, the private template, or a real person's likeness to Kasamila, and does not limit any applicable personal-data rights. Any license Kasamila needs to process customer materials is limited to providing, securing, and supporting the service, subject to applicable law and the Terms of Service.
The customer hosts the streaming media for its private avatar template. Kasamila does not host that customer-managed stream as part of the standard private-avatar arrangement. Subject to a valid account, available inference time, technical support for the template, and the applicable Terms of Service, the customer may continue to use the private avatar for as long as Kasamila operates the relevant avatar inference service. This is not a promise of perpetual availability. The customer should retain its own copies of materials and templates.
5\. Rights complaints and misuse
Kasamila cannot independently establish that every person depicted in a submitted video is the customer or that the customer owns every right needed for training and use. We may request evidence of consent or authorization and may reject or suspend a submission or avatar when reasonably necessary.
A person claiming that a private avatar infringes their rights can contact kasamila@vatary.com with identification, the affected avatar or URL, a description of the claimed rights, and supporting evidence. After receiving a sufficiently substantiated rights-holder notice, Kasamila may pause inference for the identified avatar while reviewing the complaint, notify the customer when appropriate, and restore or permanently disable access according to the review outcome and applicable law. A notice is not, by itself, a final legal determination of ownership. Customers are responsible for the legality of materials they provide and how they use their avatars. This policy does not exclude liability that cannot lawfully be excluded.
6\. Browser processing, application content, keys, and security
Avatar visual inference runs in the browser on a supported device. The customer controls the path of its application data: chat text and voice audio are handled by the customer's own application and selected providers; our inference API and SDK do not transmit those contents to Kasamila. Kasamila therefore cannot inspect or retrieve an end user's conversation content from its inference service.
A customer's master API key remains on its backend; the browser uses a short-lived token to authenticate a session. Kasamila does process token, session, usage, and security metadata needed to authorize access, count active sessions, and apply purchased balances and concurrency limits. Browser-side inference does not mean that all related personal information stays on the device: uploaded training material, account information, token and usage logs, and information a customer voluntarily submits to support may be processed by Kasamila or its service providers.
We use appropriate technical and organizational measures to protect information. No system can guarantee absolute security.
7\. Sharing and international transfers
We share information only as needed with AWS,Microsoft,Google,Aliyun, Stripe, professional advisers, and authorities when required or permitted by law. We may also disclose information in a corporate transaction, subject to applicable safeguards.
We serve customers globally. State where personal information is stored and accessed and, where required, the mechanism used for transfers across borders: Data is stored on U.S. nodes and transmitted via encrypted channels. For information on obtaining copies through legally authorized means, please email: kasamila@vatary.com. We do not state that customer-created private avatars are public merely because their inference is available through an API.
8\. Retention and deletion
Kasamila does not retain application chat text, voice audio, or conversation history through its inference API or SDK because those contents are not transmitted to us. The customer determines retention of that application content in its own systems and selected third-party services. Complete the following schedule for information Kasamila actually processes with operational periods before publication:
- Uploaded training video: Videos that fail the training process are immediately deleted, while those that are successfully trained are retained until the user deletes the digital human template.
- Derived training data or artifacts: training outputs will be immediately cleared once the user deletes their account.
- Private avatar template metadata and inference configuration: these will be immediately cleared once the user deletes their account.
- Account, purchase, tax, and usage records: retain for one year from the date of purchase..
- Security logs, support tickets, and rights complaints: retain for one year.
When a period ends, we delete or de-identify information unless retention is needed for legal obligations, dispute handling, security, or another lawful reason. Ending inference service or using up purchased hours does not automatically delete the customer's template or any information for which another retention rule applies.
9\. Your choices and privacy rights
Subject to applicable law, individuals may request access to, correction of, or deletion of their personal information; object to or restrict certain uses; obtain a portable copy where applicable; and withdraw consent where processing relies on it. A person depicted in an avatar may raise a privacy or rights complaint even if they do not own the customer account. Contact kasamila-privacy-policy@vatary.com. We may verify identity and may need to direct an end-user request to the customer that controls the relevant application. You may also have the right to complain to a competent data protection authority.
10\. Children
The service is intended for businesses and developers, not for children to create accounts. Customers must obtain any required parent or guardian authorization before uploading a child's image or deploying an experience intended for children.
11\. Changes and contact
We may update this policy as the service changes. The effective date above identifies the current version; we will provide any additional notice required by law. Questions, privacy requests, and rights complaints may be sent to kasamila-privacy-policy@vatary.com or kasamila@vatary.com. Our legal name and mail address are Vatary Inc. and 343 Chung Yi Street, Kowloon, Hong Kong.