Privacy Policy

1. Introduction

ORBWEVA ("we", "us", "our") operates the LoLA platform ("the Platform"). This Privacy Policy explains what data we collect, how we use it, and your rights regarding your personal information. By using the Platform, you consent to the practices described in this policy.

2. Data We Collect

Account data: Email address, display name, and profile picture provided through Google OAuth or email magic link sign-in.

Session data: Voice conversation transcripts, session duration, credit usage, and feedback ratings you provide after sessions.

Payment data: Payment method and transaction details are processed and stored by Stripe. We do not store your full credit card number on our servers.

Creator data: Avatar configurations including name, personality, domain, images, voice settings, and social media handles. If you connect a Stripe account for payouts via Stripe Connect, Stripe processes your banking and identity information directly — we only store your Stripe Connect account ID.

Usage data: Browser type, device information, IP address, pages visited, and interaction patterns collected automatically through server logs and analytics.

3. How We Use Your Data

We use your data to: (a) provide and maintain the Platform; (b) process credit purchases and track usage; (c) generate AI voice responses during sessions; (d) improve session quality through cross-session continuity (recent session notes are used to personalize subsequent conversations); (e) provide creators with analytics about their avatar performance; (f) send essential service communications; and (g) detect and prevent fraud or abuse.

4. Third-Party Services

The Platform integrates with the following third-party services that may process your data according to their own privacy policies:

• Supabase — Authentication, database, and file storage. Stores account data, session records, and avatar images.
• OpenAI — Real-time voice AI. Processes audio input during voice sessions to generate responses. Audio data is sent to OpenAI's Realtime API for processing.
• Stripe — Payment processing. Handles credit card information and transaction records.
• Vercel — Hosting and deployment. Processes HTTP requests and may collect server logs including IP addresses.
• Together AI — Image generation. Processes text prompts to generate avatar images via FLUX Kontext Pro.

5. Cookies and Local Storage

The Platform uses minimal cookies and local storage: (a) NEXT_LOCALE cookie to remember your preferred language (English, Japanese, or Korean); (b) Supabase authentication tokens to maintain your login session; (c) essential cookies required for the Platform to function. We do not use third-party advertising or tracking cookies.

6. Data Retention

Account data is retained for as long as your account is active. Session transcripts and feedback are retained to provide cross-session continuity and creator analytics. Payment records are retained as required by applicable financial regulations. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law. Anonymized, aggregated data may be retained indefinitely for analytics purposes.

7. Your Rights

Depending on your jurisdiction, you may have the right to: (a) access the personal data we hold about you; (b) request correction of inaccurate data; (c) request deletion of your data; (d) object to or restrict processing of your data; (e) request data portability; and (f) withdraw consent at any time. To exercise any of these rights, contact us at the email address below.

8. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/HTTPS), secure authentication via Supabase, and row-level security policies on our database. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Children's Privacy

The Platform is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Continued use of the Platform after changes constitutes acceptance of the updated policy.

11. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at hello@orbweva.com.