Privacy Policy

Vivati is operated by Kemja Limited, a company incorporated in England and Wales. We are the data controller for personal data collected through the Vivati platform.

We can be contacted at hello@kemja.co.uk. We will respond to all data-related enquiries within 5 business days.

Account data

Your name and email address, used to identify your account and communicate with you about the Service. Legal basis: contract performance and legitimate interests.

Vault content

Written stories and prompt answers, audio recordings, photographs, and videos. Stored in a private, access-controlled environment. Only ever shared with people you explicitly grant an access code to. Legal basis: contract performance and your explicit consent given at the time of upload.

Voice recordings

Audio files you upload are stored for playback only. Voice cloning, which would extract a biometric voice model, is currently disabled. When re-enabled, it will require separate explicit consent and will be treated as special category biometric data under UK GDPR. Legal basis (playback only): contract performance and explicit consent.

Character and belief data

Answers to the "Who You Are" section may include information about your faith, spiritual beliefs, values, health, and personal convictions. This constitutes special category data under UK GDPR (Article 9). It is used solely to improve the authenticity of your Companion. It is never shared publicly or used for any other purpose. Legal basis: explicit consent.

Companion conversation data

Messages sent to a Companion are stored to maintain conversational context. Conversation history is private to the individual family member account. Legal basis: contract performance and legitimate interests.

Usage data

Basic technical data including login timestamps, session duration, and message counts. Used to monitor the Service and inform product development. Not used for advertising. Legal basis: legitimate interests.

Payment data

Payments are processed by Stripe. Kemja Limited does not store your payment card details. We retain transaction records for legal and accounting purposes. Legal basis: legal obligation and contract performance.

Family member contact details provided by Vault owners

Vault owners may provide the name and email address of family members they wish to notify about their Vault. We use this information solely to send a single notification email informing the named person that a Vault has been created for them. The notification email will include details of their rights and how to request deletion of their contact details from our records.

We do not add these individuals to any marketing list without their separate, explicit consent. Named individuals who have not signed up to Vivati may request deletion of their contact details at any time by emailing hello@kemja.co.uk. We will act on such requests within 5 business days.

Legal basis: legitimate interests of the Vault owner in notifying their family, balanced against the rights of the named individual. Named individuals will always be informed of this processing at the point of first contact.

We do not sell your data. We do not use it for advertising. We share data only as follows:

• ·Anthropic (Claude): AI response generation. Your recorded content and conversation messages are transmitted to Anthropic to generate Companion responses under a data processing agreement. Your content is not used to train Anthropic's models.
• ·ElevenLabs: Voice playback only currently. When voice cloning is re-enabled, audio will be transmitted for voice model creation under a data processing agreement.
• ·Supabase: Database and file storage. All structured data and uploaded files are stored on Supabase infrastructure. Supabase processes this data under a data processing agreement.
• ·Vercel: Website hosting and infrastructure.
• ·Stripe: Payment processing as a separate data controller.

We may disclose your data where required to do so by law, court order, or regulatory authority.

Some of our third-party processors operate servers in the United States. Where your data is transferred outside the UK, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the ICO. Details are available on request at hello@kemja.co.uk.

• ·Vault content (recordings, stories, photos, videos): retained for the life of your account. Deleted within 30 days of account deletion. Backup copies deleted within 90 days.
• ·Companion conversation history: retained for the life of the family member account. Deleted within 30 days of account deletion.
• ·Family member contact details provided by Vault owners: deleted within 30 days of the notification email being sent, unless the named individual creates a Vivati account.
• ·Payment transaction records: retained for 7 years in accordance with HMRC requirements.
• ·Usage and technical data: retained for up to 24 months, then deleted or anonymised.

Where an account lapses due to non-payment, we retain your content for a grace period of no less than 90 days. We will notify you by email at least 30 days before any scheduled deletion.

Under UK GDPR, you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. You also have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

You can delete your account and all associated data directly from your account settings. For other requests, contact us at hello@kemja.co.uk. We will respond within one calendar month.

If you are not satisfied with how we handle your data, you may lodge a complaint with the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

We take appropriate technical and organisational measures to protect your data, including row-level security on all database tables, TLS encryption in transit, access-controlled file storage, and access codes required for all Companion access. In the event of a breach likely to result in risk to your rights, we will notify you and the ICO in accordance with UK GDPR.

Vivati uses essential cookies necessary for session authentication. We also use Google Analytics to understand how visitors use our site, and the Meta Pixel to measure the effectiveness of our advertising and to show relevant content to people who have visited our site. This involves Meta (Facebook/Instagram) setting a cookie on your device. You may opt out via your Meta ad preferences at facebook.com/ads/preferences.

Vivati is not intended for use by anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at hello@kemja.co.uk and we will delete it promptly.

If we make a material change, we will notify you by email at least 14 days before the change takes effect.

Kemja Limited, England and Wales. hello@kemja.co.uk