Privacy Policy

Thank you for choosing to be part of our community at Vitra.ai, operated by Apex Future Labs Pvt Ltd (“Company”, “Vitra.ai”, “we”, “us”, “our”), a company incorporated in India (CIN U72900KA2020PTC135076) with its registered office at 4th Floor, Gopalan Coworks, Banashankari 3rd Stage, Banashankari, Bengaluru, Karnataka 560085, India. We are committed to protecting your personal information and your right to privacy. If you have any question or concern about this notice or our practices, please contact us at contact@vitra.ai.

What this notice covers. This notice applies to all information collected through the vitra.ai website and the Vitra.ai Universe platform — including its video creation, video dubbing, video and image personalization, image creation, image and document translation, website and mobile app translation, hyperlocal and quality control capabilities (formerly offered as the separate products Short.video, Translate.video, Translate.photo and Translate.website) — and all related plugins, SDKs, APIs, CLI tools, MCP servers, Agentic Skills, connectors and dashboards (together, the “Services”), as well as any related sales, marketing, support and events.

Our two roles. We act in two distinct capacities, and it matters which one applies:

1. As a controller (data fiduciary) for account registration data, billing data, website visitor data, support interactions and marketing — that is, information about you as our customer or visitor. This notice governs that processing.
2. As a processor (data processor) for the content you upload to and generate on the Platform (“Customer Content”). Where that content contains personal data about your own employees, customers or other individuals, you are the controller and decide the purposes for which you use the Services. We process that content on your instructions to provide the Services. We may separately act as a controller or data fiduciary for security, legal compliance, abuse prevention and the training or improvement activities described in Section 5. Where an enterprise data processing agreement (DPA) is in place, that DPA prevails for the processing it covers.

If there are any terms in this notice that you do not agree with, please discontinue use of our Services immediately.

2.1 Information you provide to us

We collect personal information that you voluntarily provide when you register, express an interest in our products and Services, purchase a plan, request a demo, participate in activities on the Platform, or otherwise contact us. Depending on the context, this may include: first and last name, email address, phone number, country, company name and job role, billing and address details, account credentials, support and sales correspondence, survey and marketing responses, and social login data.

Mandatory data. Name, email address, phone number and country are required in order to create and operate an account.

Payment data. Payments are handled by third-party payment processors. We receive confirmation of payment and limited billing metadata (such as the last four digits of a card and its expiry); we do not store full payment card numbers on our systems.

All personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes.

2.2 Customer Content

To deliver the Services we process the content you bring to the Platform and the content generated from it — videos, audio, images, designs and layered design files, documents, DITA maps, website and mobile app content, text and prompts, glossaries, translation memories, brand kits and style guides, voice samples, photographs and likenesses.

Customer Content may contain personal data — including voice recordings, facial images and other biometric-type attributes — of your employees, customers or other individuals. You control that data and are responsible for the lawful basis, notices and consents for it. See Section 5 and the voice and likeness obligations in our Terms & Conditions.

2.3 Information collected automatically

Some information — such as your Internet Protocol (IP) address and browser and device characteristics — is collected automatically when you visit or use the Services. This does not usually reveal your specific identity, but may include your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country and approximate location, information about how and when you use the Services, log and error data, timestamps, and — where our analytics tools are enabled — aggregated session activity such as page views, clicks and scroll behaviour. This information is primarily needed to maintain the security and operation of the Services, and for our internal analytics and reporting.

2.4 Information from third parties

We may receive information about you from social login providers; from platforms you choose to connect (such as Shopify, WordPress, Figma, the Adobe suite, Office 365, Google Drive, Dropbox, Box, HubSpot and similar); from payment processors; from partners and resellers; from business-contact and enrichment providers; and from publicly available sources.

2.5 Sensitive personal data

We do not intentionally collect special-category or sensitive personal data through our account and billing forms. Customer Content you upload may contain such data — most commonly voice and facial data used by voice cloning, avatar, lip-sync and face augmentation features. Where it does, you are responsible for establishing a valid legal basis and for obtaining explicit consent.

We use the information we collect to:

• create, authenticate, operate and administer your account;
• provide the Services and generate the content you ask us to generate, translate, dub, personalise or resize;
• process payments, manage plans, credits, invoices, renewals and collections;
• provide customer support, onboarding, training and account management, and respond to your requests;
• send service, security, transactional and administrative communications;
• monitor, secure, troubleshoot, debug and improve the Services, and detect, prevent and investigate fraud, abuse and security incidents;
• evaluate, test, train and fine-tune our models, datasets, safety systems and quality tools, and allow our providers to do so where their terms and our configuration permit, unless a signed enterprise agreement states otherwise;
• understand how the product is used so we can improve usability, performance, quality and feature design;
• produce aggregated and de-identified statistics, capacity planning and business reporting;
• send marketing communications where you have consented or where we are otherwise permitted to do so, and measure their effectiveness;
• comply with legal, tax, accounting and regulatory obligations, and to establish, exercise or defend legal claims; and
• enforce our Terms & Conditions and Acceptable Use Policy.

Where the GDPR applies, we process personal data under the following legal bases:

1. Consent (Article 6(1)(a)) — marketing communications, optional service features, placement of non-essential cookies, and content-training or other processing where we specifically tell you that consent is the legal basis.
2. Contract (Article 6(1)(b)) — account creation and management, delivery of the Services, billing and customer support.
3. Legitimate interest (Article 6(1)(f)) — security monitoring, fraud prevention, service improvement, model and quality-tool evaluation or training where permitted after balancing the affected rights, anonymised analytics, and business-to-business communications.
4. Legal obligation (Article 6(1)(c)) — tax and accounting records, regulatory compliance, and responses to lawful requests from authorities.

Where the DPDP Act applies, we process personal data on the basis of your consent or, where permitted, for certain legitimate uses recognised under that Act. You may withdraw consent at any time as described in Section 14.

5.1 Your content stays yours. We do not claim ownership of the content you upload to, or generate on, the Platform. Ownership is dealt with in our Terms & Conditions. This Section explains how that content is handled from a privacy standpoint.

5.2 Your content is sent to AI providers. To deliver features such as translation, dubbing, voice cloning, text-to-speech, transcription, lip-sync, image and video generation and quality checks, some or all of your content, prompts and related metadata are transmitted to, processed by and temporarily stored by third-party providers — including large language model providers, speech-to-text engines, voice generation and text-to-speech engines, image and video models, and cloud storage and compute providers. By using the relevant feature you instruct and authorise this transmission. The provider processes the data under our agreement with it or, where you use your own API key, under your agreement with that provider.

5.3 How we use your content. We process Customer Content to operate, secure, troubleshoot and support the Services; generate the outputs you request; produce aggregated and de-identified statistics; comply with law; and evaluate, test, improve, train or fine-tune models, datasets, safety systems and quality tools. We do not sell your content. Reuse features such as translation memory and glossaries operate within your workspace unless you configure otherwise. Training and improvement use does not apply where a signed enterprise agreement expressly excludes it.

5.4 Model training by us and our providers. By default, Vitra.ai may use Customer Content, prompts, metadata, feedback and Outputs for the evaluation, training and improvement purposes described above. Third-party model providers may also use submitted data for evaluation, training or service improvement where their terms and our configuration permit. Enterprise customers that require no-training, limited-retention or other contractual controls must have those controls stated in a signed master service agreement or DPA, or use an approved bring-your-own-key configuration under Section 6.

5.5 Voice, face and biometric-type data. Voice samples used for voice cloning or text-to-speech, and facial images used for avatars, lip-sync, face augmentation and related realistic dubbing features, are treated as sensitive. We may process them to deliver those features and for the evaluation, training and improvement purposes in Sections 5.3 and 5.4. If you upload your own voice, face or likeness through a relevant feature, you instruct and authorise that disclosed processing. If you upload another person’s attributes, you must first obtain their explicit, documented consent covering provider processing and any permitted training or improvement use. You must delete the relevant assets and stop future use if that consent is withdrawn; prior model improvements may not be technically capable of being reversed.

5.6 Automated safety and quality checks. Content may be scanned automatically for quality and safety purposes, including prohibited synthetic media, impersonation, CSAM, non-consensual intimate imagery, false documents, profanity, NSFW material and quality-control checks. We may, and where applicable law requires will, deploy reasonable and appropriate technical measures for these purposes. These checks support review but are not a guarantee that every violation will be detected.

For customers who need a higher degree of privacy control, we offer enterprise-level white-labelling and access options:

• Bring your own API keys. Supply your own keys for third-party providers — LLMs, text-to-speech and voice engines, image and video models. Requests are then routed using your key, so the processing happens under your own contract and privacy terms with that provider. If you already have privacy-friendly terms with those providers, those terms apply to that processing.
• Bring your own storage. Supply your own AWS S3 bucket (or equivalent) so assets are stored in your own environment, in your chosen region, under your own access controls, encryption and retention rules.
• White-labelled and dedicated access under a separate written agreement.
• Data processing agreements, standard contractual clauses, region pinning and custom retention schedules on enterprise plans.

Where you supply your own keys or storage, you are the controller for the resulting processing at that provider and we act only as your processor to the extent we transmit content there on your instruction. You are responsible for the configuration, access control, encryption, region, retention and cost of the environments you supply. To arrange any of these options, contact contact@vitra.ai.

We use third-party providers to run the Services. The categories are:

• cloud hosting, compute, object storage (including AWS S3) and content delivery networks;
• large language model (LLM) providers;
• speech-to-text and transcription engines;
• text-to-speech, voice generation and voice cloning engines;
• image, video, avatar and lip-sync generation models;
• payment processing and invoicing;
• email, newsletter and transactional messaging;
• product analytics, tag management and behaviour analytics (including Google Analytics, Google Tag Manager and Microsoft Clarity);
• live chat, helpdesk and customer support tooling;
• CRM, sales and marketing platforms;
• error monitoring, logging and security tooling.

We select providers with reasonable care and impose confidentiality and security obligations where commercially practicable. We may add, replace or remove providers at any time. A current list of sub-processors is available on request from contact@vitra.ai. We do not control these providers and are not responsible for their acts or omissions; we recommend that you review their own privacy notices where relevant to you.

In short: we use cookies and similar technologies (such as web beacons and pixels) to run the site, remember your preferences and understand how the product is used.

We use three broad categories:

• Strictly necessary — authentication, session management, security and load balancing. These cannot be switched off.
• Analytics — understanding user behaviour: which pages and features are used, where users struggle, and how flows perform, so we can improve the product. We use Google Analytics, Google Tag Manager and Microsoft Clarity, among other tools.
• Marketing and attribution — measuring campaign performance and, where permitted, showing relevant advertising.

Non-essential tags are held until the corresponding choice is stored. Cookie choices expire after six months and can be changed at any time through the cookie-preferences control in the website footer. Withdrawing a category stops future loading of that category and clears supported first-party identifiers; browser or provider controls may also be needed for identifiers set outside our domain. You can also opt out of Google Analytics using Google’s browser opt-out add-on.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email or home address. We, or service providers on our behalf, may then send communications and marketing to those addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

In short: if you register or log in using a social media account, we receive certain profile information from that provider.

The profile information we receive varies by provider but often includes your name, email address, profile picture and other information you have chosen to make public on that platform. We use it only for the purposes described in this notice or otherwise made clear to you at the time.

We do not control, and are not responsible for, other uses of your personal information by your social media provider. We recommend reviewing their privacy notice to understand how they collect, use and share your information and how to set your preferences. We maintain appropriate agreements with such platforms where required for GDPR compliance.

In short: we share information only with your consent, to comply with law, to provide the Services, to protect rights, or to fulfil business obligations. We follow the principle of data minimisation and collect only what is necessary for the purposes described.

We may share personal information in these situations:

• Service providers and sub-processors — as described in Section 7, to deliver, secure and support the Services.
• Business transfers — in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business.
• Affiliates — with our parent company, subsidiaries, joint venture partners and companies under common control, who must honour this notice.
• Business partners and resellers — to offer or deliver products, services or promotions to you.
• Other users — when you share content or interact with public areas of the Services, such personal information may be viewed by other users and may be made publicly available outside the Services.
• Legal and safety — where required by law, regulation, court order or a lawful request from a public authority, or where we believe disclosure is necessary to investigate, prevent or act on suspected fraud, security or technical issues, or to protect the rights, property or safety of Vitra.ai, our users or the public.
• Professional advisers — auditors, lawyers, accountants and insurers under duties of confidentiality.

We do not sell your personal information, and we do not sell your Customer Content.

In short: we may transfer, store and process your information in countries other than your own.

Our servers and those of our providers are located in the United States, the European Union, India and the United Arab Emirates. If you access the Services from elsewhere, your information may be transferred to, stored in and processed in those countries, and in other countries where our sub-processors operate (see Section 10).

If you are resident in the European Economic Area or the United Kingdom, these countries may not have data protection laws as comprehensive as those in your own. Where required, we rely on appropriate safeguards for such transfers, including the European Commission’s Standard Contractual Clauses, and we take all necessary measures to protect your personal information in accordance with this notice and applicable law. Enterprise customers may request region pinning or bring-your-own-storage so that assets remain in a chosen region — see Section 6.

In short: we keep information only as long as necessary for the purposes set out in this notice, unless a longer period is required or permitted by law.

• Account and profile data — for as long as your account is active, and for up to twenty-four (24) months after closure, to handle disputes, prevent fraud and enforce our terms.
• Customer Content — for as long as your account is active or until you delete it. Deleted content is removed from active systems within approximately thirty (30) days and expires from routine backups in the ordinary backup cycle, typically within ninety (90) days, except for evidence preserved as described below and model or dataset improvements already created under Section 5.
• Billing, tax and accounting records — for the period required by applicable law, which in India is generally up to eight (8) years.
• Logs, security and analytics data — typically up to twenty-six (26) months.
• Complaint, takedown and registration records — removed or disabled content and associated records, and registration information following account cancellation or withdrawal, may be preserved for at least one hundred and eighty (180) days or longer where a court or lawfully authorised agency requires it.
• Marketing data — until you unsubscribe or withdraw consent, after which we keep a minimal suppression record so we do not contact you again.

Where we have no ongoing legitimate business need to process your personal information, we will delete or anonymise it or, if that is not possible (for example because it is held in backup archives), securely store it and isolate it from further processing until deletion is possible.

In short: we protect your personal information through a system of organisational and technical security measures.

We take reasonable and appropriate measures to safeguard personal data from unauthorised access, collection, use, disclosure, copying, modification or disposal. These include, but are not limited to:

• Encryption — encryption in transit (SSL/TLS) and, where appropriate, at rest; robust password hashing.
• Authentication and access control — role-based access control (RBAC), least-privilege access, and support for password-less authentication. Access to sensitive personal data is restricted to authorised personnel with a legitimate need.
• API security — secure API authentication, API key management and rate limiting.
• Network security — firewalls, segmentation and other controls to protect our systems from unauthorised access.
• Data minimisation — collecting and retaining only the personal data necessary for the purposes in this notice.
• Testing and audits — regular security audits, vulnerability assessments and penetration testing.
• Secure development — a secure software development lifecycle (SSDLC) to reduce vulnerabilities in our applications.
• Employee training — data protection training and confidentiality obligations for our personnel.
• Backup and disaster recovery — secure backups and recovery plans supporting business continuity and data availability.

While we take reasonable steps to secure the personal information you provide, no security measure is perfect or impenetrable and no method of transmission can be guaranteed against interception or misuse.

By registering, clicking “I agree” or “Sign up”, and using the Vitra.ai Services, you make one affirmative account acceptance: you acknowledge this notice and authorise the collection and processing of your account data and the Customer Content you submit for the following purposes:

• providing and managing your account;
• communicating important service-related information;
• delivering the Services you request, including transmission to the third-party providers needed for those features;
• the evaluation, training and improvement uses described in Section5, unless a signed enterprise agreement states otherwise;
• fulfilling legal and compliance obligations.

This single account acceptance does not replace a separate choice where law requires one for optional cookies, direct marketing or a materially different purpose. Nor can you consent for another person merely by accepting our Terms; for third-party content, your acceptance is a warranty that you already hold the authority and consent required by the Terms.

You may withdraw consent by contacting us at contact@vitra.ai. Withdrawal of optional cookies or marketing does not deactivate your account. Where the withdrawn processing is necessary to provide the account or a requested voice, face, avatar or similar feature, we may have to disable that feature or close the account and delete the relevant data, subject to legal preservation, backups, and the limitations on reversing model improvements already created. Withdrawal does not affect processing already carried out lawfully.

In short: we do not knowingly collect data from, or market to, children under 18 years of age.

By using the Services you represent that you are at least 18. A person under 18 may not create, hold or directly use an account, including through an adult’s account. If we learn that account data from a user under 18 has been collected, we will deactivate the account and take reasonable measures to delete it, subject to legal preservation requirements. Contact contact@vitra.ai if you believe a minor is directly using an account.

Children under the DPDP Act. Where the Digital Personal Data Protection Act, 2023 applies, we do not process the personal data of a child except with verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children, or any processing likely to cause a detrimental effect on a child’s wellbeing.

Children in your content. If Customer Content you upload contains the image, voice or other personal data of a child — for example in a video you are dubbing or a creative you are localising — you are the controller of that data and are responsible for holding verifiable parental or guardian consent for it, as required by our Terms & Conditions.

In short: you may review, change or terminate your account at any time, and you have rights over the personal data we hold about you.

16.1 If the GDPR applies to you

1. Right of access (Article 15) — a copy of your personal data, information about the processing, and details of recipients and retention.
2. Right to rectification (Article 16) — correct inaccurate information and complete incomplete data.
3. Right to erasure (Article 17) — deletion where data is no longer necessary, where you withdraw consent, or where processing is unlawful.
4. Right to restrict processing (Article 18) — limit processing while accuracy is verified, or in place of deletion.
5. Right to data portability (Article 20) — receive your data in a machine-readable format and transfer it to another controller.
6. Right to object (Article 21) — object to processing based on legitimate interests, and an absolute right to object to direct marketing.
7. Rights related to automated decision-making (Article 22) — not to be subject to decisions with legal or similarly significant effects taken solely by automated means, and to request human intervention.

16.2 If the DPDP Act applies to you

As the relevant provisions come into force, eligible data principals will have the rights provided by the DPDP Act, including access to a summary of personal data and processing, correction and erasure, nomination, withdrawal of consent and grievance redressal. We are preparing our processes for those phased obligations. Our Grievance Officer’s details are in Section 22.

16.3 If you are a US resident

Depending on your state, you may have the right to know what personal information we collect and how it is used and shared, to request deletion or correction, to opt out of the sale or sharing of personal information and of targeted advertising, and not to be discriminated against for exercising these rights. We do not sell Customer Content. Our marketing and identity-resolution providers may receive website and device information as described in Section 8; some laws may characterise that disclosure as a sale or sharing for advertising purposes.

16.4 How to exercise your rights

• Email contact@vitra.ai with the details of your request.
• We respond within 30 days, which may be extended by a further 30 days for complex requests.
• We may need to verify your identity before acting on a request.
• There is no fee unless the request is manifestly unfounded or excessive.
• If we process your data as a processor on behalf of an enterprise customer, please direct your request to that customer; we will forward it and support them in responding.
• We may decline or limit a request where the law permits — for example where it would adversely affect the rights of others, where we are required to retain the data, or where it relates to information we need to establish, exercise or defend a legal claim. We will tell you if we do.

16.5 Grievances and statutory response times

A grievance about the Services or about content on the Platform is handled separately from a data-rights request above. Our Grievance Officer will acknowledge a grievance within twenty-four (24) hours of receipt and dispose of a general grievance within seven (7) calendar days. We ordinarily target an initial review within three (3) business days, but applicable two (2), three (3) and thirty-six (36) hour deadlines for specified complaint or order categories prevail. Consumer complaints under the Consumer Protection (E-Commerce) Rules, 2020 are acknowledged within forty-eight (48) hours and resolved within one month of receipt.

16.6 Complaints to a regulator

If you are resident in the European Economic Area and believe we are unlawfully processing your personal information, you have the right to complain to your local data protection supervisory authority; contact details are available at the European Commission’s directory. If you are resident in Switzerland, contact details for the data protection authorities are available at https://www.edoeb.admin.ch/edoeb/en/home.html. In India, you may raise a complaint with our Grievance Officer and, if unresolved, with the Data Protection Board of India.

16.7 Opting out of marketing

You can unsubscribe from our marketing email list at any time by clicking the unsubscribe link in our emails or by contacting us. You will then be removed from the marketing list — however, we may still send you service-related emails necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Our AI features generate and transform content; they do not make decisions about you. We do not make decisions producing legal or similarly significant effects concerning you solely by automated means. We do use automated systems for security, fraud detection, abuse prevention and usage-limit enforcement; where such a system results in suspension or restriction, you may contact us at contact@vitra.ai to request human review.

We maintain incident response procedures. In the event of a personal data breach, we will notify the relevant supervisory authority and affected individuals or customers where and within the timeframes required by applicable law — including reporting to CERT-In under Indian rules and, where the GDPR applies, notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where we act as a processor for an enterprise customer, we will notify that customer without undue delay so they can meet their own obligations.

Most web browsers and some mobile operating systems and applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in future, we will inform you about that practice in a revised version of this notice.

In short: yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this notice from time to time. The updated version will be indicated by an updated “Last updated” date and will be effective as soon as it is accessible. If we make material changes, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this notice frequently to stay informed about how we protect your information.

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, to change that information, or to delete it in some circumstances. To make such a request, email contact@vitra.ai from the address registered on your account. We will respond within 30 days.

On your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information for as long as reasonably necessary to prevent fraud, troubleshoot problems, assist with investigations, respond to a complaint, takedown notice or regulatory enquiry, establish, exercise or defend a legal claim, enforce our Terms & Conditions and comply with applicable legal requirements.

If you have questions or comments about this notice, you may email us at contact@vitra.ai. For data protection matters, you can contact our Data Protection Officer directly. For any grievance, you can reach our Grievance Officer, appointed in accordance with the Information Technology Act, 2000 and the DPDP Act, 2023.

To escalate an unresolved grievance, email the Grievance Officer at keshav.k@vitra.ai with the original ticket or complaint reference, the response you challenge, and supporting evidence.