Privacy Policy
Last updated: 2026-08-11 · v2.0
1. Data Controller
NOCTURNA NETWORK LTD ("Virvid", "we") is the data controller for personal data collected via virvid.io and the Virvid mobile app. Registered in England & Wales. Contact: privacy@virvid.io.
2. Data we collect & why
- Account: email, hashed password, display name — to authenticate you.
- Subscription: plan tier, billing cycle, Stripe customer ID, invoice history — to manage your paid access.
- Content: video prompts, scripts, voice-clone samples (opt-in), generated media — to deliver the service.
- Usage (opt-in): PostHog event stream, session recording — to improve product.
- Technical: IP address, user agent, request metadata — for security, DDoS defense, rate limiting.
Legal bases (GDPR art. 6): contract (§2.1–2.3), legitimate interest (§2.5 security), consent (§2.4 analytics + all third-party sub-processors that are not strictly necessary).
3. Sub-processors
Virvid uses these third parties to deliver the service. All USA-based sub-processors are covered by Standard Contractual Clauses (SCCs) per Commission Implementing Decision (EU) 2021/914. Full list, updated on data changes:
| Sub-processor | Purpose | Data | DPA |
|---|---|---|---|
Stripe, Inc. USA · EU | Payment processing, subscription billing, invoicing | Email, name, card last-4, subscription status, invoice history | Link |
ElevenLabs Inc. USA | Text-to-speech, voice cloning | Audio recordings (voice clone opt-in), text prompts | Link |
Emergent (LLM proxy) Server dependent | AI script generation, prompt expansion | User prompts, project text (no voice biometrics) | Link |
Cloudflare, Inc. Global (EU + USA edge) | CDN, DDoS protection, edge analytics beacon | IP address, request metadata, edge cache | Link |
MongoDB Atlas EU / USA cluster | Primary database, user data storage | All account + project data | Link |
Pexels USA | Stock B-roll footage (Creative Commons fallback) | Search queries only (no user identifiers) | Link |
PostHog Inc. USA | Product analytics, session recording (opt-in only) | Session events, click tracks, page views | Link |
Google (Fonts CDN) Global | Web font delivery (Inter font) | IP address per request | Link |
Nocturna Network Ltd UK | Data controller (Virvid operator) | All above | Link |
4. International data transfers
Sub-processors in the USA (Stripe, ElevenLabs, Cloudflare, PostHog) receive personal data under Standard Contractual Clauses (SCCs) executed with the controller. We evaluate each vendor annually for adequacy per Schrems II.
5. Retention policy
- Active account data: for as long as your account is open.
- Video projects & generated media: 90 days after account deletion, then permanently purged from storage.
- Payment transactions / invoices: 7 years (EU fiscal obligation, art. 220 VAT Directive) — with PII redacted upon account deletion (email replaced with a non-reversible hash).
- Analytics (PostHog): 26 months rolling (default PostHog retention).
- Rate-limit & caching data: 1 h – 24 h TTL, auto-purged.
- GDPR audit log: 3 years (compliance evidence, email-hashed only).
6. Your rights (GDPR art. 15-22)
- Access (art. 15) — request a copy: Settings → Privacy → Export, or DSR form.
- Rectification (art. 16) — edit your profile in Settings, or DSR form.
- Erasure / "right to be forgotten" (art. 17) — Settings → Privacy → Delete my account.
- Portability (art. 20) — machine-readable JSON via Export my data.
- Restriction of processing (art. 18) — DSR form.
- Object (art. 21) — including opting out of analytics via Cookie preferences.
- Withdraw consent — at any time, footer → Cookie preferences.
- Lodge a complaint — with the Information Commissioner's Office (UK ICO, ico.org.uk) or your national supervisory authority.
Response window: 30 days from receipt (art. 12(3)), extendable by 60 days for complex requests with prior notice.
7. Cookies & local storage
We use only essential cookies by default: auth JWT, session, CSRF, language preference. Optional categories (analytics, marketing, third-party services) require your explicit consent via the Cookie banner.
Full technical breakdown in our Cookie Policy.
8. Contact & supervisory authority
- DPO / Privacy inbox: privacy@virvid.io
- DSR form: Contact page → Data Subject Rights
- Supervisory authority (UK): Information Commissioner's Office, ico.org.uk/make-a-complaint
9. Version
Privacy Policy v2.0 · Last updated 2026-08-11. Material changes are announced on the dashboard 14 days before they take effect.