Vugola Privacy Policy

Effective as of October 8, 2026

What changed in October 2026: this update is about the analytics on our website. Most of it took effect on October 6, 2026. The two points about what we measure before you answer the cookie banner took effect on October 7, 2026. The point about what no longer waits for "OK" took effect on October 8, 2026.

Except where local law requires your consent first, such as in the European Union, our product analytics now run by default. Where they do, first-time visitors see a one-line notice with an "OK" button instead of a cookie banner. Where consent is required, you still get an "Accept" and "Reject" banner, and analytics cookies stay off until you choose "Accept."
Where we ask for your consent first, we now count visits to our public pages without cookies before you answer the banner. The count stores nothing on your device, including no visitor ID, so it cannot recognize you from one day to the next or connect a visit to an account. Choosing "Reject" turns it off.
Where we ask for your consent first, once you have signed in, our servers now record account, plan, billing, and product-use events for your account before you answer the banner, tied to an internal account ID. Choosing "Reject" turns this off too.
Where analytics run by default, our website analytics tool runs by default too; where we ask for consent first, it runs only after you choose "Accept."
Where analytics run by default, three more things now run by default instead of waiting for you to select "OK": help video statistics, connecting a website-analytics visit to a later payment, and the record of which onboarding steps and features you open. Where we ask for your consent first, they still run only after "Accept." Turning analytics off in "Cookie settings" turns them off.
This policy now describes the masked session recordings we make of signed-in use of the product. They are on by default where analytics are on by default, run only after "Accept" where we ask for consent first, and never run on our public marketing pages.
A Global Privacy Control signal turns analytics off in the United Kingdom and where we ask for your consent first, but not elsewhere. We do not use Do Not Track as an opt-out signal.
Our product analytics now use a random visitor ID that stays the same across visits, and record when you sign up, the campaign tags in the link you followed, the creator's referral code if you followed a creator's link, and the domain of the site that referred you.
Our product analytics also receive account, plan, billing, and product-use events from our servers, such as a trial starting or a payment and its amount, tied to an internal account ID.
Event data held by our product analytics provider is kept for up to seven years. We previously said up to 24 months.
Our provider list now includes error monitoring, embedded video hosting, and font delivery, and this policy now says that our emails record opens and link clicks.
If you clicked "Reject" or turned analytics off before, you stay opted out. You can turn analytics off at any time through "Cookie settings" in our website footer or in your dashboard account menu.

These changes apply from the dates above onward. See Sections 2.4, 3.1, 5, 6, 8, 11, and 14.

1. Introduction

This is the Privacy Policy of Vugola, a product of Vugola LLC ("Vugola," "we," "our," or "us"). Vugola provides an AI-powered video clipping and social media automation platform, helping creators transform long-form content into engaging short-form clips. This Privacy Policy explains how we process personal data of individuals who use our services, including our platform, websites, and other products and services ("Services").

At Vugola, we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. By using or accessing our Services in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use, and share your information as described in this Privacy Policy.

Your use of Vugola's Services is at all times subject to our Terms of Service, which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Service.

Legal Entity: Vugola LLC
Contact: hello@vugolaai.com

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

Email address
Name
Password (stored securely using industry-standard encryption)
Profile details you choose to provide

2.2 Social Media Connection Data

When you connect social media accounts for publishing, we collect:

Account identifiers and usernames
Profile information (such as display name and avatar)
Authentication tokens (stored encrypted)
Basic engagement metrics necessary to provide our Services

2.3 Content Data

To provide our video processing services, we collect:

Videos you upload for processing
Generated clips and outputs
Captions, metadata, and transcripts
Scheduling and posting preferences

2.4 Usage and Device Data

We automatically collect:

Browser type and device information
IP address and approximate location
Usage patterns and feature interactions
Performance and diagnostic data

Our analytics record statistics such as the pages you visit, the features you use, your browser and device type, and when you sign up. Our product analytics also record where your visit came from: the campaign tags in the link you followed (source, medium, campaign, content, and term), the creator's referral code if you followed a creator's link, and the domain of the site that referred you, never that site's full address. They do not record advertising click IDs. We do not use advertising pixels, and we do not do targeted advertising.

Once analytics are allowed, our product analytics use a random visitor ID that we create and store in a first-party cookie and in your browser's local storage. The ID stays the same across visits, so we can tell when the same browser comes back, until you sign out, turn analytics off, or clear your browser storage. When you are signed in, they also use an internal account ID that stands in for your account. Our product analytics also receive account, plan, billing, and product-use events from our servers (for example, that a trial started, that a payment was made and its amount, that a clip was finished, or the reason you select if you cancel), tied to that internal account ID, never to your name or email address. We do not send your name or email address to our product analytics provider. Our product analytics do not record your location today. If that changes, they will record nothing more precise than your country, which our provider would work out from your IP address when the data arrives. The tool is set not to store the IP address itself.

Before you answer the cookie banner. Where we ask for your consent first (Section 11), two kinds of measurement run before you choose. Neither stores anything on your device or reads anything stored there. First, while you are signed out, we count visits to our pages without cookies. Our product analytics provider receives the page you opened, the campaign tags and referring domain described above, whether you are on a phone, tablet, or computer, and the user-agent text your browser sends. It counts visitors with a one-way code that it builds from your IP address, that user-agent text, and a secret value it replaces every day, and it does not store the IP address or the user-agent text with the visit. No visitor ID is stored on your device and the code changes every day, so a visit cannot be recognized on a later day or connected to an account. Second, once you have signed in from such a region, the server events described above are recorded against your account's internal ID until you answer, including at times when you are signed out. Choosing "Reject," or turning analytics off in "Cookie settings," stops the visit count in that browser at once and stops the server events for your account. If you choose while signed out, the choice reaches your account the next time you sign in from that browser. Choosing "Accept" replaces the cookieless count with the product analytics described above.

Session recordings. When you are signed in, we make masked session recordings of how the product is used, so we can find bugs and points of friction. All on-screen text and everything you type are masked, and media (video, audio, and images) is not recorded. Recordings never run on our public marketing pages. They are on by default for signed-in users where analytics are on by default, and run only after "Accept" where we ask for your consent first.

Our website analytics tool measures where visitors come from and which campaigns bring them. It runs by default wherever our product analytics run by default, and only after you choose "Accept" where we ask for your consent first. It records how you reached our site, including the site that referred you and any campaign tags (such as utm_source or utm_campaign) or creator's referral code in the link you followed, and your approximate location, such as your country or city, which is worked out from your IP address when the data is collected. If you later subscribe, it links your visit to your payment record so we can see which campaigns and creators bring people to Vugola. If you do not allow it, our website analytics provider may still receive the amount, date, and a transaction reference for each payment, with no visitor or customer ID attached, so our revenue totals are complete.

An error monitoring tool loads for every visitor and receives technical details about errors in the Services, along with an internal account ID when you are signed in. Our emails, including transactional and product emails, record whether they were delivered and opened and which links were clicked. Some analytics and error-monitoring requests may be routed through our own domain before they reach the provider. Section 11 explains when analytics run and how to turn them off.

2.5 Vugola iPhone App

When you use the Vugola app for iPhone, we also collect and use the following:

Sign-in. Your email address and password, or Sign in with Apple or Google. With Apple, we ask only for your email address, and Apple may give us a private relay address instead.
Videos you add. You choose videos with Apple's photo picker, which shares only the videos you select, or you record them in the app. The app asks for camera and microphone access only to record. After you add a video, the app uploads the original file as is, including details your iPhone stores with it (such as when it was recorded, and where, if location was on for your camera), to your Vugola account so it is backed up and ready for AI editing. You can stop an upload while it runs. If you use AI Edit, your video, its audio, and its transcript are processed as described in Section 5.2.
Saving to Photos. To save an exported video, the app asks only for permission to add to your Photos library. It cannot see your library.
Purchases. Apple processes App Store payments, and we never see your card details. We and our subscription service provider receive your subscription details (plan, dates, and transaction IDs), linked to your Vugola account ID. That provider also receives basic device details, such as iPhone model, iOS version, app version, and an Apple app-specific device identifier.
Notifications. If you allow notifications, Apple gives the app a device token. We store it with your account to tell you when an AI edit finishes, and we remove it when you sign out. Apple delivers these notifications, which include your project's name.
Reports and requests. When you send a report or feature request, we receive what you pick and write, any screenshots or photos you attach (saved as new images without location data), and technical details: app version, iPhone model, iOS version, language and region setting, the screen you were on, your project and upload status, any error on screen, and the layout of the edit you had open, including its caption text. Reports are saved with your account and emailed to our support team.
Usage statistics. Starting October 27, 2026, the app may send us statistics about how features such as the welcome questions and exporting perform, for example which screens you reach, the answers you pick (such as the kind of videos you make and how you heard about Vugola), the settings used, how long it took, and whether it worked, along with basic device details and a random ID the app creates for this install. Statistics sent before you create an account are tied to that ID and linked to your account when you sign up. They never include your videos, captions, titles, or anything you type. We keep them for up to 24 months and use them to find and fix problems and improve the app. You can turn them off in Account > Share usage data. In the European Economic Area, the United Kingdom, and Switzerland, they stay off unless you turn them on.
Stored on your iPhone. Your projects, edits, settings, and sign-in session (kept in the iPhone keychain) stay on your iPhone. The name and username you enter in Account stay on your iPhone and are not sent to us. Signing out does not erase videos saved on your iPhone.

The iPhone app does not show ads, does not use advertising identifiers, crash-reporting tools, or third-party analytics, and does not track you across other companies' apps or websites. Usage statistics stay with us and are never shared with advertisers or data brokers.

3. How We Use Your Information

We process your personal data for the following purposes:

Providing, maintaining, and improving our Services
Processing videos and generating AI-powered outputs
Scheduling and publishing content to connected platforms on your behalf
Developing and enhancing our features and technology
Ensuring platform security and preventing abuse
Communicating with you about updates, support, and service-related matters
Sending you product and marketing emails, such as getting-started tips and plan offers; each one has an unsubscribe link
Complying with legal obligations and enforcing our terms

3.1 Our Legal Bases for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we only process your personal data where we have a lawful basis to do so under the GDPR (and the UK GDPR). The basis depends on the purpose:

Purpose	What this involves	Legal basis
Creating and operating your account	Registration, authentication, sign-in, account settings	Performance of a contract (Art. 6(1)(b))
Processing your videos and generating clips, captions, and transcripts	Uploading, transcribing, analyzing, reframing, and rendering the content you submit	Performance of a contract (Art. 6(1)(b))
Publishing and scheduling content to your connected platforms	Posting on your behalf to accounts you connect	Performance of a contract (Art. 6(1)(b))
Processing payments and managing subscriptions	Billing, invoicing, plan and credit management	Performance of a contract (Art. 6(1)(b))
Product analytics, session recordings, and measuring how features are used	Understanding usage patterns to improve and debug the Services	Consent (Art. 6(1)(a)) wherever we ask for it before these run, which covers analytics cookies, session recordings, and our website analytics tool in the EEA, and usage statistics in the iPhone app; otherwise our legitimate interest in understanding, improving, and securing our Services (Art. 6(1)(f)). That covers product analytics, our website analytics tool, and session recordings in the UK and Switzerland, and, in the EEA, the cookieless visit count and the server-recorded account events described in Section 2.4. You can object at any time through "Cookie settings" in our website footer or in your dashboard account menu, or by choosing "Reject" on the banner
Securing the platform and preventing fraud and abuse	Monitoring, rate limiting, detecting misuse, protecting accounts	Legitimate interest in keeping the Services and our users safe (Art. 6(1)(f))
Service and transactional communications	Account, support, security, and service-related messages	Performance of a contract (Art. 6(1)(b)); or legitimate interest in operating the Services (Art. 6(1)(f))
Product, marketing, or feedback communications	Welcome and getting-started emails, plan offers, product updates, and surveys	Our legitimate interest in telling you about Vugola (Art. 6(1)(f)), or your consent (Art. 6(1)(a)) where the law requires it; you can unsubscribe at any time
Meeting legal and regulatory obligations	Tax and accounting records, responding to lawful requests, enforcing our terms	Compliance with a legal obligation (Art. 6(1)(c)); or legitimate interest in establishing or defending legal claims (Art. 6(1)(f))

Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal. Where we rely on a legitimate interest, you have the right to object, and you can contact us at hello@vugolaai.com to do so. We do not use your personal data to make decisions that produce legal or similarly significant effects about you without human involvement.

4. Data Security

Data security is of great importance to us. We implement appropriate technical, organizational, and administrative security measures to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. Our security measures include:

Encryption of data in transit using HTTPS/TLS
Encryption of sensitive data at rest
Secure storage on industry-leading cloud infrastructure
Restricted access controls for personnel
Regular security assessments and monitoring

While we work to protect your data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining appropriate safeguards.

5. Third-Party Services and Subprocessors

We work with trusted third-party service providers (also called subprocessors) to deliver our Services. They process your data to provide their services to us, under our agreements with them and their own terms. The table below lists the categories of providers we currently rely on, what they process, and where they are primarily located.

Provider	What it processes for us	Primary location
Cloud hosting, database, and storage	Account data, your uploaded videos and generated clips, and related application data	United States
Compute and video processing	Compute used to process and render your videos	United States
Payment processing	Payment processing and subscription billing	United States
AI providers (transcription and content analysis)	Transcribing your audio and video and analyzing your content to identify, generate, and caption clips	United States
Analytics providers	Product analytics, masked session recordings of signed-in use, and website analytics (where local law requires prior consent, analytics cookies, session recordings, and website analytics run only after you accept, while the cookieless visit count and server-recorded account events described in Section 2.4 run until you reject)	United States
Error monitoring and diagnostics	Technical details about errors in the Services, with an internal account ID when you are signed in; loads for every visitor	United States
Embedded video hosting	Playing our help videos; viewing statistics wherever analytics run (by default, or after "Accept" where we ask for consent first)	United States
Font delivery	Serving the fonts our pages use; receives your IP address when they load	United States
Affiliate referral tracking	Affiliate referral tracking and commission accounting for eligible subscriptions paid through our payment processor; its script loads on our website pages for every visitor and receives your IP address, and it stores a referral only when you arrive from a creator's link	United States
In-app subscription management	App Store subscription status and purchase details for our iPhone app, linked to your account ID, plus basic device details	United States
Email delivery	Sending transactional, service-related, and marketing email, and recording whether those emails are delivered, opened, and clicked	United States

Each category above may include one or more providers, each with its own privacy policy governing their handling of your data. We update these categories when our providers change. If you would like the names of the specific providers we currently use, contact us at hello@vugolaai.com.

Apple processes App Store payments, Sign in with Apple, and notification delivery for our iPhone app under its own privacy policy.

5.1 Google API Services and YouTube

When you connect a YouTube channel, Vugola uses YouTube API Services to publish videos you create in Vugola to your own channel, to identify which channel you connected, and to show basic performance statistics for videos you published. By using Vugola's YouTube features, you agree to be bound by the YouTube Terms of Service.

Vugola's use of information received from YouTube API Services adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access your connected channel's identity and profile information, subscriber count, and recent uploads, including videos published outside Vugola. For these videos, we access metadata such as titles, thumbnails, publication dates and duration, together with available view, like and comment counts. We use this information solely to provide the publishing and analytics features you request, and we do not sell or transfer it.

You can revoke Vugola's access to your YouTube data at any time by disconnecting the account in Vugola or through your Google security settings. To delete YouTube data stored by Vugola, disconnect the account or delete your Vugola account. We process Google user data in accordance with the Google Privacy Policy.

5.2 AI Processing of Your Content

To create clips, captions, and transcripts, the videos and audio you upload (and the transcripts generated from them) are processed by the third-party AI providers we engage for transcription and content analysis (the AI category described above). This processing is necessary to provide the Services you request.

Video analysis. To edit and frame your videos, including videos from our iPhone app, we may send private copies of your videos to these providers. They describe what happens in a video, such as scene changes, where people and faces appear, and areas clear for text. We do not use this to recognize who anyone is. For visual analysis in Studio, we delete the temporary copies right after the analysis.

We send these providers only the content and information needed to perform the task, and they process it under our agreements with them and their own terms. We do not use your content to train any AI model of our own. If you do not want your content processed by these providers, please do not upload it, because this processing is core to how the Services work.

6. Data Sharing

We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws. We do not run third-party advertising on the Services.

We may disclose your information only in the following circumstances:

With service providers and subprocessors who help us operate the platform (see Section 5)
With our analytics providers, which act as our service providers to measure and improve the Services and are contractually restricted from using your data for their own purposes; where local law requires prior consent, including in the EEA, analytics cookies, session recordings, and our website analytics tool run only after you accept our cookie banner, while the cookieless visit count and server-recorded account events described in Section 2.4 run until you reject; everywhere else these run by default, and you can turn them off at any time through "Cookie settings" in our website footer or in your dashboard account menu
With our affiliate tracking provider to identify the creator who referred a new subscriber and calculate commissions on eligible subscription payments made through our payment processor, when you arrive from a creator's referral link
To the platforms you connect, when you ask us to publish or schedule content on your behalf
With your explicit consent or at your direction
To comply with applicable law, legal process, court orders, or governmental requests
To protect the rights, privacy, safety, or property of Vugola, our users, or others, and to enforce our terms
In connection with a merger, acquisition, financing, or sale of assets, with notice to you as required by law

To control analytics, use "Cookie settings" in our website footer or in your dashboard account menu, or, where it appears, our cookie banner. We honor a Global Privacy Control (GPC) signal as an opt-out of analytics in the United Kingdom and wherever we ask for your consent first. Everywhere else, including the United States, GPC does not turn off our own first-party analytics; use "Cookie settings" instead. We do not sell your personal information or share it for cross-context behavioral advertising, and if that ever changes we will honor GPC as an opt-out of that selling or sharing. We do not use Do Not Track as an opt-out signal. Affiliate referral tracking is not controlled by these choices; see Section 11. You can also contact us at hello@vugolaai.com.

7. Your Rights and How to Exercise Them

Depending on where you live, you may have some or all of the following rights regarding your personal data. We honor these rights for every user where the law requires it, and we extend the core rights below to all users as a matter of practice.

Access: Request a copy of the personal data we hold about you, and information about how we use and share it
Correction: Request correction of inaccurate or incomplete data
Deletion: Request deletion of your personal data
Portability: Request a copy of your data in a portable, machine-readable format
Withdrawal: Withdraw consent by disconnecting accounts, opting out of tracking, or contacting us
Objection: Object to or restrict certain processing of your data
Opt-out: Opt out of targeted advertising, the sale or sharing of your personal information, and certain profiling (we do not sell your personal data or use it for cross-context behavioral advertising)

How to Submit a Request

To exercise any of these rights, email us at hello@vugolaai.com with the subject line "Privacy Rights Request" and tell us which right you want to exercise. You may also use the account controls and the "Cookie settings" control described in this Policy to manage your data and opt-outs directly.

Identity Verification

To protect your privacy and security, we will take reasonable steps to verify your identity before acting on a request. Verification usually means confirming that you control the email address associated with your account, and for sensitive requests we may ask for additional information to match you to the data we hold. We will only use information you provide for verification to verify your identity and respond to your request.

Authorized Agents

You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof that you gave them signed permission to act for you, and we may still ask you to verify your own identity directly with us or to confirm that you authorized the request.

Response Times

We will respond to your request within the timeframe required by applicable law. For most US state privacy requests this is within 45 days of receipt. When reasonably necessary, we may extend this period by an additional 45 days (90 days total) and will tell you within the first 45 days if we need the extension and why. For requests under the GDPR and UK GDPR, we will respond within one month, extendable by up to two further months for complex or numerous requests, and we will notify you of any extension.

Right to Appeal

If we decline to act on your request, we will explain why. If you live in a state that grants an appeal right (including Colorado, Connecticut, Texas, and Virginia), you may appeal our decision by replying to our response or by emailing hello@vugolaai.com with the subject line "Privacy Request Appeal." We will respond to your appeal within the period required by your state's law (generally 45 to 60 days) and explain the actions we take or do not take and the reasons for our decision. If we deny your appeal, you may contact your state Attorney General to submit a complaint.

Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. We will not deny you our Services, charge you a different price, or provide you a different level of service because you exercised your rights.

8. Data Retention and Deletion

Retention Period

We retain your personal data for as long as necessary to provide our Services, fulfill the purposes described in this Privacy Policy, or as required by law. Specific retention periods are as follows:

Account data: Retained for the duration of your account and up to 30 days after deletion request
Uploaded videos and generated clips: Deleted within 30 days of account deletion or upon your request
Payment and billing records: Retained for 7 years as required by financial regulations
Usage and analytics data: Usage data that we store ourselves is retained for up to 24 months, then anonymized or deleted. Event data held by our product analytics provider is kept for up to seven years, the period set by that provider's plan, which we cannot shorten. Session recordings are kept by that provider for up to 90 days. Event data collected after July 28, 2026 is stored against a random visitor ID, an internal account ID, or, for cookieless visit counts, a one-way code that changes every day, not your name or email address; older records that included an email address or an IP address are being deleted
Support communications: Retained for up to 2 years, including reports and requests sent from the iPhone app and any images attached to them
Videos uploaded from the iPhone app: Kept in your account, even after a subscription ends, until you ask us to delete them or you delete your account

When data is no longer needed, we securely delete or anonymize it.

How to Delete Your Account

You can request account deletion in the iPhone app from Account > Delete account, including from the signed-in paywall, or on our website from Settings > Account > Security > Delete account, or the Choose your Vugola plan page if you do not have an active plan. Apple sign-in accounts must confirm with Apple in the iPhone app before deleting. If you cannot use either, email hello@vugolaai.com to request deletion.

When your request succeeds, we lock sign-in, cancel any Vugola website subscription immediately, and revoke Vugola's Sign in with Apple access if you used it. Completed website payments are not refunded except where the law requires otherwise. Deleting your Vugola account does not cancel an App Store subscription; cancel it separately in iPhone Settings > your name > Subscriptions.

We remove account data, owned workspaces, uploaded videos, and generated content within 30 days. You can check the deletion receipt after signing out. Deleting one project in the app removes it from your iPhone only; use account deletion to remove its uploaded copies. We retain billing records and other information only as described in this policy or required by law.

Upon account deletion:

Personal data is removed within 30 days
Uploaded videos and generated content are permanently deleted
Aggregated, anonymized data may be retained for analytics
Analytics event data may remain with our product analytics provider for the retention period above. Event data collected after July 28, 2026 is stored against a random visitor ID, an internal account ID, or, for cookieless visit counts, a one-way code that changes every day, not your name or email address; older records that included an email address or an IP address are being deleted
Some data may be retained as required by law

9. Children's Privacy

Our Services are intended for users who are 18 years of age or older. The Services are not directed to children, and we do not knowingly collect personal information from anyone under the age of 18. If we learn that we have collected personal information from a user under 18, we will terminate the account and delete that information promptly. If you believe a minor has provided us with personal data, please contact us at hello@vugolaai.com.

10. International Data Transfers

Vugola is based in the United States, and the providers listed in Section 5 are located primarily in the United States. If you access the Services from outside the United States, your personal data will be transferred to, stored, and processed in the United States and potentially other countries, which may have data protection laws different from those in your country.

When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards, including:

The European Commission's Standard Contractual Clauses (SCCs), together with any supplementary measures needed, for transfers from the EEA
The UK International Data Transfer Addendum to the SCCs (or the UK IDTA) for transfers from the United Kingdom
The Swiss addendum to the SCCs for transfers from Switzerland
Where a provider is certified under the EU-US Data Privacy Framework (and its UK Extension and Swiss-US Framework), reliance on that certification for transfers to that provider

You can request more information about these safeguards, including a copy of the relevant clauses, by contacting us at hello@vugolaai.com.

11. Cookies and Tracking Technologies

We use cookies and similar technologies (such as local storage and tracking pixels) to operate, secure, analyze, and improve our Services. We group these technologies as follows:

Essential cookies: Maintain your session, keep you logged in, protect the platform against abuse, and remember your analytics choice. These are strictly necessary for the Services to function and are always on.
Preference cookies: Remember interface settings, such as whether the dashboard sidebar is open and your editor theme.
Analytics and product cookies: Help us understand how visitors find and use the Services so we can improve them. We use a product analytics tool, which also makes the masked session recordings of signed-in use, and a website analytics tool. They collect what is described in Section 2.4.
Affiliate referral cookies: When you arrive from a creator's referral link, in every region, our affiliate tracking provider and Vugola each store a first-party referral ID for up to 30 days so the creator can receive commission when a new customer subscribes through our payment processor. This happens without a banner click, and the cookie banner, "Cookie settings," and GPC do not turn it off. To avoid it, do not follow a referral link, or clear or block cookies in your browser. A creator campaign code can be kept longer, as described in our Cookie Policy. We do not use this browser tracking for App Store purchases.

Our emails, including transactional and product emails, record whether they were delivered and opened and which links were clicked. Opens are detected with a small tracking pixel in the email. The cookie choices in this section apply to our website and do not change this.

iPhone app. The iPhone app does not use cookies or tracking technologies. Apart from the usage statistics described in Section 2.5, it does not send us usage analytics. The cookie choices in this section apply to our website.

Your Cookie Choices

How analytics cookies are handled depends on where you are:

Where local law requires prior consent: This includes the European Union and the rest of the European Economic Area (including Norway, Iceland, and Liechtenstein) and other European countries outside the UK and Switzerland, Turkey, Nigeria, Vietnam, China, and Quebec in Canada where we can recognize it (a visitor in Quebec whose browser uses the Toronto time zone and a language other than French is treated as elsewhere in Canada), as well as any visit where we cannot determine your location. When you first visit, we show a consent banner with "Accept" and "Reject" options, and our analytics cookies, session recordings, and website analytics tool stay off until you choose "Accept." If you choose "Reject" or leave the banner untouched, they stay off. Until you answer, the cookieless visit count and the server-recorded account events described in Section 2.4 run, because neither uses cookies or anything else stored on your device; choosing "Reject" turns both off. You can change or withdraw your consent at any time through "Cookie settings" in our site footer or in your dashboard account menu; withdrawing consent stops future analytics.
United Kingdom: We do not show a banner. On your first visit we show a one-line notice with an "OK" button, which works as described for other regions below. Our product analytics run by default to collect statistics that help us understand and improve the Services, as the Privacy and Electronic Communications Regulations 2003 (as amended by the Data (Use and Access) Act 2025) allow. Session recordings of signed-in use, our website analytics tool, including connecting your visit to a later payment, help video statistics, and the record of which onboarding steps and features you open are also on by default. You can object at any time through "Cookie settings" in our site footer or in your dashboard account menu, which turns all of these off.
Everywhere else, including the United States and Switzerland: We do not show a banner. On your first visit we show the same one-line notice. Our product analytics, including the record of which onboarding steps and features you open, our website analytics tool, including connecting your visit to a later payment, help video statistics and session recordings of signed-in use run by default. Selecting "OK" dismisses the notice and is saved as "Accept." It does not change what runs. That notice and this section are our notice to you, and you can refuse or opt out at any time through "Cookie settings" in our site footer or in your dashboard account menu.

Global Privacy Control and Do Not Track. If your browser or extension sends a Global Privacy Control (GPC) signal, we honor it as an opt-out of analytics in the United Kingdom and wherever we ask for your consent first, and keep analytics off for that browser. Everywhere else, GPC does not turn off our own first-party analytics; use "Cookie settings" instead. We do not sell your personal information or share it for cross-context behavioral advertising, and if that ever changes we will honor GPC as an opt-out of that selling or sharing. We do not use Do Not Track as an opt-out signal.

If you clicked "Reject" or turned analytics off, including before October 8, 2026, that choice stays in place until you change it. We estimate your region from your browser's time zone and, in eastern Canada, its language; we do not use your IP address for this. If we cannot determine it, we ask for your consent before any analytics cookies are set. Affiliate referral tracking, described above, applies in every region and is not affected by these choices. Existing subscription attribution remains in billing records for commission accounting.

Essential cookies cannot be disabled because the Services will not work without them. Disabling non-essential cookies may affect some features.

For full details on the specific cookies and trackers we use, their purposes, and how to manage them, please see our dedicated Cookie Policy. For information about how we handle the personal data these technologies collect, the rest of this Privacy Policy applies.

12. Security Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users and relevant authorities in accordance with applicable laws and regulations. We will provide information about the nature of the breach and steps you can take to protect yourself.

13. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR), including:

Right to be informed about how your data is processed
Right of access to your personal data
Right to rectification of inaccurate data
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object to processing
Rights related to automated decision-making

To exercise these rights or lodge a complaint, contact us at hello@vugolaai.com. You also have the right to lodge a complaint with your local data protection authority.

14. US State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Texas, or Virginia, your state's privacy law gives you specific rights over your personal information. We honor these rights for all residents of those states. To exercise any of them, follow the process in Section 7 (Your Rights and How to Exercise Them), including identity verification, the authorized-agent path, our response timelines, and your right to appeal.

Your Rights

Subject to your state's law and certain exceptions, you have the right to:

Know and access: Confirm whether we process your personal information and obtain a copy of it
Correct: Request that we correct inaccurate personal information
Delete: Request that we delete personal information we collected from you
Portability: Obtain a copy of your personal information in a portable, readily usable format
Opt out of targeted advertising: Direct us not to process your personal information for targeted advertising
Opt out of sale or sharing: Direct us not to sell or share your personal information
Opt out of certain profiling: Direct us not to use your personal information for profiling that produces legal or similarly significant effects
Non-discrimination: Not be discriminated against for exercising these rights
Appeal: Appeal our refusal to act on your request, as described in Section 7

California residents also have the right to limit the use of sensitive personal information. We do not use or disclose sensitive personal information for purposes that require us to offer a "limit" option under the CCPA/CPRA.

Do Not Sell or Share My Personal Information; Your Privacy Choices

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA and the Colorado, Connecticut, Texas, and Virginia privacy laws. We also do not use your personal information for targeted advertising.

Because we do not sell or share personal information or serve targeted advertising, there is nothing for you to opt out of in those categories. You can still turn off our analytics at any time through "Cookie settings" in our website footer or in your dashboard account menu. A Global Privacy Control (GPC) signal does not turn off these analytics in the United States, and we do not use Do Not Track as an opt-out signal, as described in Section 11 (Cookies and Tracking Technologies). If we ever sell or share personal information or use it for targeted advertising, we will honor GPC as a valid opt-out of that.

Categories of Information and How We Use It

The categories of personal information we collect, the purposes for which we use them, and the categories of recipients are described in Sections 2 (Information We Collect), 3 (How We Use Your Information), 5 (Third-Party Services), and 6 (Data Sharing) of this Privacy Policy. We collect this information from you directly, from your use of the Services, and from the social and content platforms you choose to connect.

How to Exercise Your Rights and Verification

To submit a request, email hello@vugolaai.com with the subject line "Privacy Rights Request," or use the controls described above. We will verify your identity and respond as described in Section 7. You may also designate an authorized agent to act on your behalf, subject to the verification steps in Section 7.

Appeal

If we decline to act on your request, you may appeal as described in Section 7 (Right to Appeal). If you are a Colorado, Connecticut, Texas, or Virginia resident and we deny your appeal, you may contact your state Attorney General to submit a complaint.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make material changes, we will notify you by email or through a prominent notice on our platform prior to the changes taking effect. Your continued use of our Services after such notice constitutes acceptance of the updated Privacy Policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Vugola LLC
Email: hello@vugolaai.com
Website: https://vugolaai.com

Reports and requests sent from the iPhone app go to our support team at support@vugolaai.com.

By using Vugola, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.