Vugola Privacy Policy

1. Introduction

This is the Privacy Policy of Vugola, a product of Vugola LLC ("Vugola," "we," "our," or "us"). Vugola provides an AI-powered video clipping and social media automation platform, helping creators transform long-form content into engaging short-form clips. This Privacy Policy explains how we process personal data of individuals who use our services, including our platform, websites, and other products and services ("Services").

At Vugola, we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. By using or accessing our Services in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use, and share your information as described in this Privacy Policy.

Your use of Vugola's Services is at all times subject to our Terms of Service, which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Service.

Legal Entity: Vugola LLC
Contact: hello@vugolaai.com

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Name
• Password (stored securely using industry-standard encryption)
• Profile details you choose to provide

2.2 Social Media Connection Data

When you connect social media accounts for publishing, we collect:

• Account identifiers and usernames
• Profile information (such as display name and avatar)
• Authentication tokens (stored encrypted)
• Basic engagement metrics necessary to provide our Services

2.3 Content Data

To provide our video processing services, we collect:

• Videos you upload for processing
• Generated clips and outputs
• Captions, metadata, and transcripts
• Scheduling and posting preferences

2.4 Usage and Device Data

We automatically collect:

• Browser type and device information
• IP address and approximate location
• Usage patterns and feature interactions
• Performance and diagnostic data

Our analytics record statistics such as the pages you visit, the features you use, your browser and device type, and when you sign up. Our product analytics also record where your visit came from: the campaign tags in the link you followed (source, medium, campaign, content, and term), the creator's referral code if you followed a creator's link, and the domain of the site that referred you, never that site's full address. They do not record advertising click IDs. Our website does not use advertising pixels and does not share your information for targeted advertising. Ad measurement in our iPhone app is described in Section 2.5.

Once analytics are allowed, our product analytics use a random visitor ID that we create and store in a first-party cookie and in your browser's local storage. The ID stays the same across visits, so we can tell when the same browser comes back, until you sign out, turn analytics off, or clear your browser storage. When you are signed in, they also use an internal account ID that stands in for your account. Our product analytics also receive account, plan, billing, and product-use events from our servers (for example, that a trial started, that a payment was made and its amount, that a clip was finished, or the reason you select if you cancel), tied to that internal account ID, never to your name or email address. On our website, we do not send your name or email address to our product analytics provider, our product analytics record your country and nothing more precise (once analytics are allowed, our own domain works out the two-letter country code from your IP address and only that code is added to analytics events), and the tool is set not to store the IP address itself. The iPhone app is different: Section 2.5 says what it sends, including your email address and name, your IP address, and your approximate location down to your city.

Before you answer the cookie banner. Where we ask for your consent first (Section 11), two kinds of measurement run before you choose. Neither stores anything on your device or reads anything stored there. First, while you are signed out, we count visits to our pages without cookies. Our product analytics provider receives the page you opened, the campaign tags and referring domain described above, whether you are on a phone, tablet, or computer, and the user-agent text your browser sends. It counts visitors with a one-way code that it builds from your IP address, that user-agent text, and a secret value it replaces every day, and it does not store the IP address or the user-agent text with the visit. No visitor ID is stored on your device and the code changes every day, so a visit cannot be recognized on a later day or connected to an account. Second, once you have signed in from such a region, the server events described above are recorded against your account's internal ID until you answer, including at times when you are signed out. Choosing "Reject," or turning analytics off in "Cookie settings," stops the visit count in that browser at once and stops the server events for your account. If you choose while signed out, the choice reaches your account the next time you sign in from that browser. Choosing "Accept" replaces the cookieless count with the product analytics described above.

Session recordings. On our website, when you are signed in, we make masked session recordings of how the product is used, so we can find bugs and points of friction. All on-screen text and everything you type are masked, and media (video, audio, and images) is not recorded. Recordings never run on our public marketing pages. They are on by default for signed-in users where analytics are on by default, and run only after "Accept" where we ask for your consent first.

Our website analytics tool measures where visitors come from and which campaigns bring them. It runs by default wherever our product analytics run by default, and only after you choose "Accept" where we ask for your consent first. It records how you reached our site, including the site that referred you and any campaign tags (such as utm_source or utm_campaign) or creator's referral code in the link you followed, and your approximate location, such as your country or city, which is worked out from your IP address when the data is collected. If you later subscribe, it links your visit to your payment record so we can see which campaigns and creators bring people to Vugola. If you do not allow it, our website analytics provider may still receive the amount, date, and a transaction reference for each payment, with no visitor or customer ID attached, so our revenue totals are complete.

An error monitoring tool loads for every visitor and receives technical details about errors in the Services, along with an internal account ID when you are signed in. Our emails, including transactional and product emails, record whether they were delivered and opened and which links were clicked. Some analytics and error-monitoring requests may be routed through our own domain before they reach the provider. Section 11 explains when analytics run and how to turn them off.

2.5 Vugola iPhone App

When you use the Vugola app for iPhone, we also collect and use the following:

• Sign-in. Your email address and password, or Sign in with Apple or Google. With Apple, we ask only for your email address, and Apple may give us a private relay address instead.
• Videos you add. You choose videos with Apple's photo picker, which shares only the videos you select, or you record them in the app. The app asks for camera and microphone access only to record. After you add a video, the app uploads the original file as is, including details your iPhone stores with it (such as when it was recorded, and where, if location was on for your camera), to your Vugola account so it is backed up and ready for AI editing. You can stop an upload while it runs. If you use AI Edit, your video, its audio, and its transcript are processed as described in Section 5.2.
• Saving to Photos. To save an exported video, the app asks only for permission to add to your Photos library. It cannot see your library.
• Purchases. Apple processes App Store payments, and we never see your card details. We and our subscription service provider receive your subscription details (plan, dates, and transaction IDs), linked to your Vugola account ID. That provider also receives basic device details, such as iPhone model, iOS version, app version, and an Apple app-specific device identifier.
• Plans started on our website. If your App Store country or region is the United States, the app can open a checkout page on our website in your browser. When it does, the app sends us your App Store country or region, a random ID it creates for this install, and your checkout choices, such as the plan and whether you want a reminder before the trial ends. That reminder is scheduled on your iPhone, not sent from our servers. You pay by card or Apple Pay through our payment processor, and we never receive your full card number. At checkout, before you have an account, we store the email address you give, if you give one, and a card identifier from our payment processor. The identifier tells us when the same card has been used before, and it does not reveal the card number. We use the email and the identifier to stop repeat free trials and to attach your purchase to the right account. The app also keeps a one-time code in your iPhone's keychain so the purchase can be linked to the account you create or sign in to.
• Notifications. If you allow notifications, Apple gives the app a device token. We store it with your account to send you notifications, such as when an AI edit finishes and reminders about your videos and your streak, and we remove it when you sign out. Apple delivers these notifications, which may include your project's name. You can turn reminders off in the app's settings.
• Reports and requests. When you send a report or feature request, we receive what you pick and write, any screenshots or photos you attach (saved as new images without location data), and technical details: app version, iPhone model, iOS version, language and region setting, the screen you were on, your project and upload status, any error on screen, and the layout of the edit you had open, including its caption text. Reports are saved with your account and emailed to our support team.
• Usage statistics. Starting October 22, 2026, the app sends us statistics about how you use it and how features such as the welcome questions, AI Edit, and exporting perform, for example which screens you reach, the controls you tap, the answers you pick (such as the kind of videos you make and how you heard about Vugola), the settings used, how long it took, and whether it worked, and your activity in the app, such as when you open it and from where (the app icon or a notification), the videos you make, your streak, whether notifications are allowed, and how you respond to reminders, along with your IP address, your approximate location worked out from it (country, region, and city), basic device details, and a random ID the app creates for this install. We also record your sessions in the app: a replay of the screens you see and the controls you tap, with text you type, images, and your videos masked out. Statistics and recordings sent before you create an account are tied to the install ID. After you sign in, they are tied to your account, together with the email address and name on your account. They never include your videos, captions, titles, or anything you type. Our analytics provider and our crash-reporting provider process these statistics for us as service providers, only on our instructions. We may de-identify them and use the de-identified data for any lawful business purpose, such as understanding trends; we do not try to re-identify it. Our provider keeps the statistics for up to seven years and the recordings for up to 90 days, and we use them to find and fix problems, improve the app, and personalize it, including your reminders. Statistics and recordings are on for everyone, in every country, and you can turn them off in Settings > Share usage data.
• Ad measurement. We advertise Vugola in other apps and on other websites, including through Apple Ads, Meta (such as Facebook and Instagram), and TikTok, and the app helps us measure and improve those ads.
  • Apple Ads. The app collects Apple Ads' attribution token so we can measure which Apple Ads campaigns bring people to Vugola.
  • Our mobile measurement provider, Meta, and TikTok. From October 28, 2026, once you update the app, the app includes code from our mobile measurement provider. It is the only advertising code in the app. When you install and open the app, create an account, or start a free trial, that code tells our mobile measurement provider that it happened. With each event it sends an ID the code creates for this install, device and app details (such as iPhone model, iOS version, app version, language, and time zone), and your IP address. Our subscription service provider also sends your App Store trial and subscription events, such as a paid subscription starting, a renewal, or a cancellation, with the plan, the price, and your Vugola account ID (a random ID, not your name or email address), to our mobile measurement provider. The account ID stays with our mobile measurement provider and is not passed to Meta or TikTok. Our mobile measurement provider works for us as a service provider: it tells us which ads led to these events, and it passes our ad partners, Meta and TikTok, the results they need to measure and improve our ads. Meta and TikTok use what they receive under their own terms and privacy policies, which can include deciding who sees our ads.
  • Apple's reports. Apple can also send our ad partners its own SKAdNetwork and AdAttributionKit reports, which say that one of their ads led to an install or to an event such as a trial, without saying who you are. Apple sends these under its own privacy policy.
  • What is never included. Ad measurement never includes your videos, captions, titles, anything you type, your name, your email address, or your device's advertising identifier. The app does not ask for Apple's permission to track you and does not show ads.
  • Your choice. Starting with the iPhone app update that adds Settings > Ad measurement, if your App Store country or region is the United States, ad measurement is on by default; otherwise it starts off, and the app shares nothing for ad measurement, including the Apple Ads attribution token, unless you turn it on. In earlier app versions, the switch is called "Information collection," it is on by default in every country, and it controls only whether the app collects the Apple Ads attribution token. With that update, you can turn ad measurement on or off at any time in Settings > Ad measurement. Turning it off stops the app from collecting the Apple Ads token and from sending new ad measurement events, and stops our subscription service provider from sending your App Store events to our mobile measurement provider. With that update, when you are signed in, we save your choice with your account. Turning it off then turns it off on every iPhone with that update where you sign in to that account, the next time the app refreshes your session (usually within an hour of using the app) or when you next sign in; turning it on applies only to the iPhone where you turn it on. It does not recall information already sent, and it does not change Apple's own reports. Some U.S. state privacy laws treat this ad measurement as "sharing" or "selling" personal information, or as "targeted advertising"; Section 14 explains your rights.
• Your streak. When you're signed in, we keep a copy of your streak with your account so it carries over when you sign in on another iPhone. It has the days and times you exported a video, a random ID for each of those projects, how long each video was and whether it used captions or AI Edit, and the badges you earned. It never includes your videos, titles, or caption text. Deleting your account deletes it.
• Stored on your iPhone. Your projects, edits, settings, and sign-in session (kept in the iPhone keychain) stay on your iPhone. When you save a name or username in Account, we keep it with your account so it comes back when you sign in on another iPhone. Your profile photo stays on your iPhone. Signing out does not erase videos saved on your iPhone.

The iPhone app does not show ads, does not collect your device's advertising identifier, and does not ask for Apple's permission to track you. The only information it shares with ad partners is the ad measurement described above, which you control in Settings > Ad measurement once you update the app. Earlier app versions share nothing with Meta or TikTok, and their Settings > Information collection switch controls only Apple Ads' attribution token. Usage statistics, session recordings, and crash reports go only to our service providers, stay under our control, and are never shared with advertisers or data brokers.

3. How We Use Your Information

We process your personal data for the following purposes:

• Providing, maintaining, and improving our Services
• Processing videos and generating AI-powered outputs
• Scheduling and publishing content to connected platforms on your behalf
• Developing and enhancing our features and technology
• Ensuring platform security and preventing abuse
• Communicating with you about updates, support, and service-related matters
• Sending you product and marketing emails, such as getting-started tips and plan offers; each one has an unsubscribe link
• Measuring and improving our advertising, including, once you update the iPhone app, telling our mobile measurement provider and our ad partners which ads led to installs, sign-ups, trials, and subscriptions (Section 2.5)
• Complying with legal obligations and enforcing our terms

3.1 Our Legal Bases for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we only process your personal data where we have a lawful basis to do so under the GDPR (and the UK GDPR). The basis depends on the purpose:

Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal. Where we rely on a legitimate interest, you have the right to object, and you can contact us at hello@vugolaai.com to do so. We do not use your personal data to make decisions that produce legal or similarly significant effects about you without human involvement.

4. Data Security

Data security is of great importance to us. We implement appropriate technical, organizational, and administrative security measures to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. Our security measures include:

• Encryption of data in transit using HTTPS/TLS
• Encryption of sensitive data at rest
• Secure storage on industry-leading cloud infrastructure
• Restricted access controls for personnel
• Regular security assessments and monitoring

While we work to protect your data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining appropriate safeguards.

5. Third-Party Services and Subprocessors

We work with trusted third-party service providers (also called subprocessors) to deliver our Services. They process your data to provide their services to us, under our agreements with them and their own terms. The table below lists the categories of providers we currently rely on, what they process, and where they are primarily located.

Each category above may include one or more providers, each with its own privacy policy governing their handling of your data. We update these categories when our providers change. If you would like the names of the specific providers we currently use, contact us at hello@vugolaai.com.

Apple processes App Store payments, Sign in with Apple, and notification delivery for our iPhone app under its own privacy policy.

Our ad partners, Meta and TikTok, are not on this list because they are not our service providers for ad measurement: they use what they receive under their own terms. Section 6 explains what they receive.

5.1 Google API Services and YouTube

When you connect a YouTube channel, Vugola uses YouTube API Services to publish videos you create in Vugola to your own channel, to identify which channel you connected, and to show basic performance statistics for videos you published. By using Vugola's YouTube features, you agree to be bound by the YouTube Terms of Service.

Vugola's use of information received from YouTube API Services adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access your connected channel's identity and profile information, subscriber count, and recent uploads, including videos published outside Vugola. For these videos, we access metadata such as titles, thumbnails, publication dates and duration, together with available view, like and comment counts. We use this information solely to provide the publishing and analytics features you request, and we do not sell or transfer it.

You can revoke Vugola's access to your YouTube data at any time by disconnecting the account in Vugola or through your Google security settings. To delete YouTube data stored by Vugola, disconnect the account or delete your Vugola account. We process Google user data in accordance with the Google Privacy Policy.

5.2 AI Processing of Your Content

To create clips, captions, and transcripts, the videos and audio you upload (and the transcripts generated from them) are processed by the third-party AI providers we engage for transcription and content analysis (the AI category described above). This processing is necessary to provide the Services you request.

Video analysis. To edit and frame your videos, including videos from our iPhone app, we may send private copies of your videos to these providers. They describe what happens in a video, such as scene changes, where people and faces appear, and areas clear for text. We do not use this to recognize who anyone is. For visual analysis in Studio, we delete the temporary copies right after the analysis.

We send these providers only the content and information needed to perform the task, and they process it under our agreements with them and their own terms. We do not use your content to train any AI model of our own. If you do not want your content processed by these providers, please do not upload it, because this processing is core to how the Services work.

6. Data Sharing

We do not sell your personal data for money, and we do not show third-party ads in the Services. Our website does not share your personal data for cross-context behavioral advertising. Starting October 28, 2026, once you update the app, if your App Store country or region is the United States, our iPhone app shares the ad measurement information described in Section 2.5 with our ad partners, Meta and TikTok, through our mobile measurement provider, so we can measure and improve our ads. Under some U.S. state privacy laws, that counts as "sharing" personal information for cross-context behavioral advertising, as "targeted advertising," or as a "sale," even though no one pays us for it. You can opt out at any time, as described below and in Section 14.

We may disclose your information only in the following circumstances:

• With service providers and subprocessors who help us operate the platform (see Section 5)
• With our analytics providers, which act as our service providers to measure and improve the Services and are contractually restricted from using your data for their own purposes; on our website, where local law requires prior consent, including in the EEA, analytics cookies, session recordings, and our website analytics tool run only after you accept our cookie banner, while the cookieless visit count and server-recorded account events described in Section 2.4 run until you reject; everywhere else these run by default, and you can turn them off at any time through "Cookie settings" in our website footer or in your dashboard account menu; in the iPhone app they run in every country, and Settings > Share usage data turns them off; they are never shared with our ad partners
• With our mobile measurement provider and our ad partners, Meta and TikTok, for ad measurement in the iPhone app, as described in Section 2.5, starting October 28, 2026, once you update the app: on by default if your App Store country or region is the United States, otherwise off unless you turn it on, and Settings > Ad measurement turns it off
• With our affiliate tracking provider to identify the creator who referred a new subscriber and calculate commissions on eligible subscription payments made through our payment processor, when you arrive from a creator's referral link
• To the platforms you connect, when you ask us to publish or schedule content on your behalf
• With your explicit consent or at your direction
• To comply with applicable law, legal process, court orders, or governmental requests
• To protect the rights, privacy, safety, or property of Vugola, our users, or others, and to enforce our terms
• In connection with a merger, acquisition, financing, or sale of assets, with notice to you as required by law

To control analytics on our website, use "Cookie settings" in our website footer or in your dashboard account menu, or, where it appears, our cookie banner. In the iPhone app, use Settings > Share usage data for usage statistics and Settings > Ad measurement (in earlier app versions, Settings > Information collection) for ad measurement. We honor a Global Privacy Control (GPC) signal as an opt-out of analytics in the United Kingdom and wherever we ask for your consent first. Everywhere else, including the United States, GPC does not turn off our own first-party analytics; use "Cookie settings" instead. Our website does not sell your personal information or share it for cross-context behavioral advertising, and if that ever changes we will honor GPC as an opt-out of that selling or sharing. GPC is a browser signal, so the iPhone app cannot receive it; to opt out of the app's ad measurement, use Settings > Ad measurement or email us (in earlier app versions, use Settings > Information collection). We do not use Do Not Track as an opt-out signal. Affiliate referral tracking is not controlled by these choices; see Section 11. You can also contact us at hello@vugolaai.com.

7. Your Rights and How to Exercise Them

Depending on where you live, you may have some or all of the following rights regarding your personal data. We honor these rights for every user where the law requires it, and we extend the core rights below to all users as a matter of practice.

• Access: Request a copy of the personal data we hold about you, and information about how we use and share it
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Request a copy of your data in a portable, machine-readable format
• Withdrawal: Withdraw consent by disconnecting accounts, opting out of tracking, or contacting us
• Objection: Object to or restrict certain processing of your data
• Opt-out: Opt out of targeted advertising, the sale or sharing of your personal information, and certain profiling (for the iPhone app's ad measurement, turn off Settings > Ad measurement or email us, or in earlier app versions turn off Settings > Information collection; see Section 14)

How to Submit a Request

To exercise any of these rights, email us at hello@vugolaai.com with the subject line "Privacy Rights Request" and tell us which right you want to exercise. You may also use the account controls and the "Cookie settings" control described in this Policy to manage your data and opt-outs directly.

Identity Verification

To protect your privacy and security, we will take reasonable steps to verify your identity before acting on a request. Verification usually means confirming that you control the email address associated with your account, and for sensitive requests we may ask for additional information to match you to the data we hold. We will only use information you provide for verification to verify your identity and respond to your request.

Authorized Agents

You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof that you gave them signed permission to act for you, and we may still ask you to verify your own identity directly with us or to confirm that you authorized the request.

Response Times

We will respond to your request within the timeframe required by applicable law. For most US state privacy requests this is within 45 days of receipt. When reasonably necessary, we may extend this period by an additional 45 days (90 days total) and will tell you within the first 45 days if we need the extension and why. For requests under the GDPR and UK GDPR, we will respond within one month, extendable by up to two further months for complex or numerous requests, and we will notify you of any extension.

Right to Appeal

If we decline to act on your request, we will explain why. If you live in a state that grants an appeal right (including Colorado, Connecticut, Texas, and Virginia), you may appeal our decision by replying to our response or by emailing hello@vugolaai.com with the subject line "Privacy Request Appeal." We will respond to your appeal within the period required by your state's law (generally 45 to 60 days) and explain the actions we take or do not take and the reasons for our decision. If we deny your appeal, you may contact your state Attorney General to submit a complaint.

Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. We will not deny you our Services, charge you a different price, or provide you a different level of service because you exercised your rights.

8. Data Retention and Deletion

Retention Period

We retain your personal data for as long as necessary to provide our Services, fulfill the purposes described in this Privacy Policy, or as required by law. Specific retention periods are as follows:

• Account data: Retained for the duration of your account and up to 30 days after deletion request
• Uploaded videos and generated clips: Deleted within 30 days of account deletion or upon your request
• Payment and billing records: Retained for 7 years as required by financial regulations
• Checkout records for plans started on our website from the iPhone app: We keep the checkout email, the card identifier, and the record of the checkout for as long as we need them to stop repeat free trials and fraud and to meet our legal and accounting duties. This includes checkouts that were never linked to an account, and it continues after an account is deleted
• Usage and analytics data: Usage data that we store ourselves is retained for up to 24 months, then anonymized or deleted. Event data held by our product analytics provider is kept for up to seven years, the period set by that provider's plan, which we cannot shorten. Session recordings are kept by that provider for up to 90 days. For our website, event data collected after July 28, 2026 is stored against a random visitor ID, an internal account ID, or, for cookieless visit counts, a one-way code that changes every day, not your name or email address; older records that included an email address or an IP address are being deleted. iPhone app usage statistics are held by the same provider for up to seven years and its session recordings for up to 90 days, tied to an ID for your account together with your email address and name
• Ad measurement data from the iPhone app: Apple Ads' attribution token is kept by our product analytics provider with your iPhone app usage statistics. Our mobile measurement provider keeps what it receives only as long as we need it to measure our ads, within the retention period set by our agreement with it. Our ad partners keep what they receive under their own policies
• Support communications: Retained for up to 2 years, including reports and requests sent from the iPhone app and any images attached to them
• Videos uploaded from the iPhone app: Kept in your account, even after a subscription ends, until you ask us to delete them or you delete your account

When data is no longer needed, we securely delete or anonymize it.

How to Delete Your Account

You can request account deletion in the iPhone app from Settings > Delete account, including from the signed-in paywall, or on our website from Settings > Account > Security > Delete account, or the Choose your Vugola plan page if you do not have an active plan. Apple sign-in accounts must confirm with Apple in the iPhone app before deleting. If you cannot use either, email hello@vugolaai.com to request deletion.

When your request succeeds, we lock sign-in, cancel any Vugola website subscription immediately, and revoke Vugola's Sign in with Apple access if you used it. Completed website payments are not refunded except where the law requires otherwise. Deleting your Vugola account does not cancel an App Store subscription; cancel it separately in iPhone Settings > your name > Subscriptions.

We remove account data, owned workspaces, uploaded videos, and generated content within 30 days. You can check the deletion receipt after signing out. Deleting one project in the app removes it from your iPhone only; use account deletion to remove its uploaded copies. We retain billing records and other information only as described in this policy or required by law.

Upon account deletion:

• Personal data is removed within 30 days, and we ask our analytics provider to delete the profile, events and recordings tied to your account in the same period
• Uploaded videos and generated content are permanently deleted
• Aggregated, anonymized data may be retained for analytics
• Analytics event data may remain with our product analytics provider for the retention period above. For our website, event data collected after July 28, 2026 is stored against a random visitor ID, an internal account ID, or, for cookieless visit counts, a one-way code that changes every day, not your name or email address; older records that included an email address or an IP address are being deleted
• Checkout records for plans started on our website from the iPhone app are kept as described under Retention Period above
• Some data may be retained as required by law

9. Children's Privacy

Our Services are intended for users who are 18 years of age or older. The Services are not directed to children, and we do not knowingly collect personal information from anyone under the age of 18. If we learn that we have collected personal information from a user under 18, we will terminate the account and delete that information promptly. If you believe a minor has provided us with personal data, please contact us at hello@vugolaai.com.

10. International Data Transfers

Vugola is based in the United States, and the providers listed in Section 5 are located primarily in the United States. If you access the Services from outside the United States, your personal data will be transferred to, stored, and processed in the United States and potentially other countries, which may have data protection laws different from those in your country.

When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards, including:

• The European Commission's Standard Contractual Clauses (SCCs), together with any supplementary measures needed, for transfers from the EEA
• The UK International Data Transfer Addendum to the SCCs (or the UK IDTA) for transfers from the United Kingdom
• The Swiss addendum to the SCCs for transfers from Switzerland
• Where a provider is certified under the EU-US Data Privacy Framework (and its UK Extension and Swiss-US Framework), reliance on that certification for transfers to that provider

You can request more information about these safeguards, including a copy of the relevant clauses, by contacting us at hello@vugolaai.com.

11. Cookies and Tracking Technologies

We use cookies and similar technologies (such as local storage and tracking pixels) to operate, secure, analyze, and improve our Services. We group these technologies as follows:

• Essential cookies: Maintain your session, keep you logged in, protect the platform against abuse, and remember your analytics choice. These are strictly necessary for the Services to function and are always on.
• Preference cookies: Remember interface settings, such as whether the dashboard sidebar is open and your editor theme.
• Analytics and product cookies: Help us understand how visitors find and use the Services so we can improve them. We use a product analytics tool, which also makes the masked session recordings of signed-in use, and a website analytics tool. They collect what is described in Section 2.4.
• Affiliate referral cookies: When you arrive from a creator's referral link, in every region, our affiliate tracking provider and Vugola each store a first-party referral ID for up to 30 days so the creator can receive commission when a new customer subscribes through our payment processor. This happens without a banner click, and the cookie banner, "Cookie settings," and GPC do not turn it off. To avoid it, do not follow a referral link, or clear or block cookies in your browser. A creator campaign code can be kept longer, as described in our Cookie Policy. We do not use this browser tracking for App Store purchases.

Our emails, including transactional and product emails, record whether they were delivered and opened and which links were clicked. Opens are detected with a small tracking pixel in the email. The cookie choices in this section apply to our website and do not change this.

iPhone app. The iPhone app does not use cookies. Apart from the usage statistics, session recordings, crash reports, and ad measurement described in Section 2.5, it sends no usage analytics. The checkout pages the app opens in your browser are part of our website, so the analytics described in this section can run there. Those pages do not show the cookie banner or the one-line notice. The cookie choices in this section apply to our website.

Your Cookie Choices

How analytics cookies are handled depends on where you are:

• Where local law requires prior consent: This includes the European Union and the rest of the European Economic Area (including Norway, Iceland, and Liechtenstein) and other European countries outside the UK and Switzerland, Turkey, Nigeria, Vietnam, China, and Quebec in Canada where we can recognize it (a visitor in Quebec whose browser uses the Toronto time zone and a language other than French is treated as elsewhere in Canada), as well as any visit where we cannot determine your location. When you first visit, we show a consent banner with "Accept" and "Reject" options, and our analytics cookies, session recordings, and website analytics tool stay off until you choose "Accept." If you choose "Reject" or leave the banner untouched, they stay off. Until you answer, the cookieless visit count and the server-recorded account events described in Section 2.4 run, because neither uses cookies or anything else stored on your device; choosing "Reject" turns both off. You can change or withdraw your consent at any time through "Cookie settings" in our site footer or in your dashboard account menu; withdrawing consent stops future analytics.
• United Kingdom: We do not show a banner. On your first visit we show a one-line notice with an "OK" button, which works as described for other regions below. Our product analytics run by default to collect statistics that help us understand and improve the Services, as the Privacy and Electronic Communications Regulations 2003 (as amended by the Data (Use and Access) Act 2025) allow. Session recordings of signed-in use, our website analytics tool, including connecting your visit to a later payment, help video statistics, and the record of which onboarding steps and features you open are also on by default. You can object at any time through "Cookie settings" in our site footer or in your dashboard account menu, which turns all of these off.
• Everywhere else, including the United States and Switzerland: We do not show a banner. On your first visit we show the same one-line notice. Our product analytics, including the record of which onboarding steps and features you open, our website analytics tool, including connecting your visit to a later payment, help video statistics and session recordings of signed-in use run by default. Selecting "OK" dismisses the notice and is saved as "Accept." It does not change what runs. That notice and this section are our notice to you, and you can refuse or opt out at any time through "Cookie settings" in our site footer or in your dashboard account menu.

Global Privacy Control and Do Not Track. If your browser or extension sends a Global Privacy Control (GPC) signal, we honor it as an opt-out of analytics in the United Kingdom and wherever we ask for your consent first, and keep analytics off for that browser. Everywhere else, GPC does not turn off our own first-party analytics; use "Cookie settings" instead. Our website does not sell your personal information or share it for cross-context behavioral advertising, and if that ever changes we will honor GPC as an opt-out of that selling or sharing. The iPhone app's ad measurement is controlled in the app, as Section 2.5 explains. We do not use Do Not Track as an opt-out signal.

If you clicked "Reject" or turned analytics off, including before October 8, 2026, that choice stays in place until you change it. We estimate your region from your browser's time zone and, in eastern Canada, its language; we do not use your IP address for this. If we cannot determine it, we ask for your consent before any analytics cookies are set. Affiliate referral tracking, described above, applies in every region and is not affected by these choices. Existing subscription attribution remains in billing records for commission accounting.

Essential cookies cannot be disabled because the Services will not work without them. Disabling non-essential cookies may affect some features.

For full details on the specific cookies and trackers we use, their purposes, and how to manage them, please see our dedicated Cookie Policy. For information about how we handle the personal data these technologies collect, the rest of this Privacy Policy applies.

12. Security Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users and relevant authorities in accordance with applicable laws and regulations. We will provide information about the nature of the breach and steps you can take to protect yourself.

13. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR), including:

• Right to be informed about how your data is processed
• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

To exercise these rights or lodge a complaint, contact us at hello@vugolaai.com. You also have the right to lodge a complaint with your local data protection authority.

14. US State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Texas, or Virginia, your state's privacy law gives you specific rights over your personal information. We honor these rights for all residents of those states. To exercise any of them, follow the process in Section 7 (Your Rights and How to Exercise Them), including identity verification, the authorized-agent path, our response timelines, and your right to appeal.

Your Rights

Subject to your state's law and certain exceptions, you have the right to:

• Know and access: Confirm whether we process your personal information and obtain a copy of it
• Correct: Request that we correct inaccurate personal information
• Delete: Request that we delete personal information we collected from you
• Portability: Obtain a copy of your personal information in a portable, readily usable format
• Opt out of targeted advertising: Direct us not to process your personal information for targeted advertising
• Opt out of sale or sharing: Direct us not to sell or share your personal information
• Opt out of certain profiling: Direct us not to use your personal information for profiling that produces legal or similarly significant effects
• Non-discrimination: Not be discriminated against for exercising these rights
• Appeal: Appeal our refusal to act on your request, as described in Section 7

California residents also have the right to limit the use of sensitive personal information. We do not use or disclose sensitive personal information for purposes that require us to offer a "limit" option under the CCPA/CPRA.

Do Not Sell or Share My Personal Information; Your Privacy Choices

We do not sell your personal information for money. Starting October 28, 2026, once you update the app, if your App Store country or region is the United States, our iPhone app shares the ad measurement information described in Section 2.5 with our ad partners, Meta and TikTok, so we can measure and improve our ads. Under the CCPA/CPRA and other state privacy laws, that can count as "sharing" personal information for cross-context behavioral advertising, as a "sale," or as "targeted advertising." In the last 12 months we have shared, or may share, these categories with advertising networks: identifiers (an ID created for your app install and your IP address), commercial information (trials and subscriptions), and internet or other electronic network activity (installs, app opens, and sign-ups), together with device and app details. Our website does not sell or share personal information for advertising. We do not knowingly sell or share the personal information of anyone under 16, and the Services are for people 18 and older.

How to opt out. In the iPhone app, turn off Settings > Ad measurement (in earlier app versions, Settings > Information collection). In the updated app, when you are signed in, we save your choice with your account, so turning it off applies on every iPhone with the updated app where you sign in to that account. You can also email hello@vugolaai.com with the subject line "Do Not Sell or Share" from the email address on your account, and we will turn ad measurement off for your account; in the updated app, it takes effect the next time the app refreshes your session, usually within an hour of using the app, or when you next sign in. Earlier app versions do not read the choice saved with your account; in them, turn off Settings > Information collection. Opting out stops new sharing; it does not recall information already shared, which our ad partners handle under their own policies. You can still turn off our website analytics at any time through "Cookie settings" in our website footer or in your dashboard account menu. GPC is a browser signal, so the iPhone app cannot receive it. On our website, a GPC signal does not turn off our own analytics in the United States, and we do not use Do Not Track as an opt-out signal, as described in Section 11 (Cookies and Tracking Technologies). If our website ever sells or shares personal information or uses it for targeted advertising, we will honor GPC as a valid opt-out of that.

Categories of Information and How We Use It

The categories of personal information we collect, the purposes for which we use them, and the categories of recipients are described in Sections 2 (Information We Collect), 3 (How We Use Your Information), 5 (Third-Party Services), and 6 (Data Sharing) of this Privacy Policy. We collect this information from you directly, from your use of the Services, and from the social and content platforms you choose to connect.

How to Exercise Your Rights and Verification

To submit a request, email hello@vugolaai.com with the subject line "Privacy Rights Request," or use the controls described above. We will verify your identity and respond as described in Section 7. You may also designate an authorized agent to act on your behalf, subject to the verification steps in Section 7.

Appeal

If we decline to act on your request, you may appeal as described in Section 7 (Right to Appeal). If you are a Colorado, Connecticut, Texas, or Virginia resident and we deny your appeal, you may contact your state Attorney General to submit a complaint.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. A change takes effect when we post the updated policy with its new effective date, unless the policy says a later date. When a change is material, we will also tell you by email or through a prominent notice on our platform. Using our Services after a change means the updated policy applies to you.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Vugola LLC
Email: hello@vugolaai.com
Website: https://vugolaai.com

Reports and requests sent from the iPhone app go to our support team at support@vugolaai.com.

By using Vugola, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.