VANCKO Privacy Policy

Effective date: 1 September 2026 · Last updated: 21 August 2026

1. Who We Are

VANCKO is a service that turns your real photos into professionally produced video advertisements using artificial intelligence, reviewed by a human quality team before delivery. The service is provided through the VANCKO mobile application and the website vancko.com (together, the “Services”).

The data controller responsible for your personal data is:

If you have any question about this policy or about your personal data, contact us at the address above. You may write to us in English or Bulgarian.

2. Scope of This Policy

This policy applies to all personal data processed when you use the VANCKO mobile application, the vancko.com website, our API, or when you communicate with us. It applies regardless of where in the world you access the Services from. It does not apply to third-party websites or services that we link to but do not control.

3. The Data We Collect

3.1 Account data. When you create an account we collect your email address and a display name, or the identifier provided by your sign-in provider (Sign in with Apple or Google). We also store your account language, country and account settings. We do not receive your password when you use Apple or Google sign-in.

3.2 Content you upload. To produce your videos we collect the materials you deliberately upload:

• Photographs of your business, products, and — if you choose — of people (for example yourself or your staff appearing in the advertisement);
• Voice recordings, if you choose to use the voice-cloning feature;
• Text briefs, business names, slogans, spoken-word scripts and any other text you provide.

3.3 Biometric and special category data (photos of faces, voice recordings). Photographs that contain a recognisable face, and voice recordings used to create a cloned voice, can constitute biometric data under Article 9 of the EU General Data Protection Regulation (GDPR) and similar laws (for example the Illinois Biometric Information Privacy Act). We process this data only:

• with your prior, explicit, documented consent, which you give inside the Services before the material is used;
• for the sole purpose of producing the video advertisement you ordered (and, for voice clones, keeping your cloned voice available for your future orders until you delete it);
• never to identify you or anyone else, never for surveillance, categorisation, emotion recognition or advertising profiles;
• never to train, improve or refine our or anyone else’s AI models. Your content is used to render your order — nothing else.

You may withdraw this consent at any time (section 11). Withdrawal does not affect processing that happened before the withdrawal.

3.4 Payment data. Purchases inside the mobile application are processed by Apple (App Store) or Google (Google Play). Purchases on vancko.com are processed by Stripe. We never see or store your full card number. We receive and store only: the transaction identifier, the package purchased, the amount, the date, and the resulting credit balance on your account.

3.5 Usage and device data. We collect technical data needed to run and secure the Services: device model and operating system version, application version, language, IP address and the approximate country derived from it, timestamps of requests, error logs and crash reports, and the state of your orders (queued, rendering, in review, delivered).

3.6 Communications. If you contact support or request a revision of a video, we keep the correspondence and the revision notes so that we can serve you.

3.7 Data we do NOT collect. We do not collect precise location. We do not access your photo library beyond the photos you explicitly pick. We do not access your contacts, messages, calendar or microphone (the microphone is used only if and while you record a voice sample, and only with the operating-system permission prompt). We do not use third-party advertising SDKs inside the application. We do not sell personal data, and we have not sold personal data in the preceding 12 months.

4. What We Use Your Data For, and the Legal Basis

We do not use your content for AI model training. We do not carry out automated decision-making that produces legal or similarly significant effects on you. We do not use your data for third-party advertising.

5. AI Processing, Human Review, and Labelling of AI Content

• Your videos are generated by AI systems operated by us on our own infrastructure, from the materials you provide.
• Every video is checked by a human reviewer before delivery. Our reviewers see your uploaded materials and the generated video for exactly as long as the review requires.
• In accordance with Article 50 of the EU Artificial Intelligence Act (transparency obligations in force since 2 August 2026), every delivered video is marked as AI-generated: a visible “AI” label is placed on the video and machine-readable marking is embedded, so that the synthetic nature of the content is disclosed. You must not remove this marking where the law of the country in which you publish the video requires it.
• The service is designed to advertise your own real business with your own real materials. Impersonation of third parties, deepfakes of real persons without their documented consent, and deceptive synthetic media are prohibited and enforced through review (section 6).

6. Your Responsibilities for Uploaded Content

Before uploading, you must confirm — via the mandatory checkbox in the order flow — that:

• you own the photographs or hold all rights needed to use them in an advertisement;
• every recognisable person in the photographs (and every person whose voice you upload) has given you their informed, explicit consent to appear in an AI-generated advertisement, including consent to the processing of their image or voice for that purpose;
• the content does not infringe anyone’s intellectual property, privacy, or personality rights, and is not unlawful, deceptive, hateful or harmful.

We may refuse, suspend or delete content that violates these rules, and we operate a complaint procedure: any person who believes their likeness or voice is used in a VANCKO video without consent may write to privacy@vancko.com and we will investigate and, where justified, remove the content and terminate the offending account.

7. Who We Share Data With (Processors and Recipients)

We share personal data only with the following categories of recipients, only to the extent necessary, and under data-processing agreements where required:

We never sell your data, never share it with data brokers, and never allow processors to use your content for their own purposes, including AI training, except where a processor’s processing is strictly necessary to provide their service to us under our instructions.

If Vancko Systems Ltd. is ever involved in a merger, acquisition or asset sale, personal data may be transferred as part of that transaction; this policy will continue to apply and you will be notified.

8. International Transfers

We are based in the European Union and keep primary processing in the EU. Where a processor is located outside the European Economic Area (for example ElevenLabs, Apple, Google or Stripe entities in the United States), the transfer is protected by the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework certification of the recipient, together with supplementary measures. You may request a copy of the relevant safeguards at privacy@vancko.com.

9. How Long We Keep Data (Retention)

When you delete your account, all content and personal data are deleted or irreversibly anonymised within 30 days, except the minimal records we are legally required to keep (payments, consent evidence).

10. Security

Your data is processed on servers controlled by us in the EU and by the processors listed above. We apply: encryption in transit (TLS) everywhere; tokenised, per-account access to the API; secrets kept in a managed secret store with rotation; isolation of the render infrastructure from the public internet via an authenticated tunnel; access to customer content restricted to staff who need it for quality review, under confidentiality obligations; backups; and logging of administrative access. No system is perfectly secure; if a breach is likely to result in a high risk to you, we will notify you and the supervisory authority as required by GDPR Articles 33–34.

11. Your Rights

Under the GDPR (and equivalent laws) you have the right to:

• Access — obtain a copy of the personal data we hold about you;
• Rectification — correct inaccurate data;
• Erasure — have your data deleted (“right to be forgotten”);
• Restriction — limit how we process your data while a dispute is resolved;
• Portability — receive your data in a machine-readable format;
• Object — object to processing based on legitimate interest;
• Withdraw consent at any time (for photos of faces and voice data) — after withdrawal we stop the related processing and delete the related biometric content;
• Complain to a supervisory authority. Our lead authority is the Bulgarian Commission for Personal Data Protection (CPDP, www.cpdp.bg); you may also complain to the authority of your own EU country.

California residents (CCPA/CPRA): you have the rights to know, delete, correct, and opt out of “sale” or “sharing” of personal information. We do not sell or share personal information as defined by the CPRA, and we do not use sensitive personal information beyond what is necessary to provide the Services. We will not discriminate against you for exercising your rights. Requests: privacy@vancko.com.

To exercise any right, email privacy@vancko.com from the address linked to your account, or use the in-app account controls (Profile → Privacy). We answer within one month. We may ask you to verify your identity; we will never ask for your password.

12. Children

The Services are intended for business use by adults. You must be at least 18 years old to create an account. We do not knowingly collect data from children. Advertisements must not feature minors without the documented consent of a parent or legal guardian, provided by you as part of your content-rights declaration. If we learn that we hold data of a child collected without such consent, we will delete it.

13. Cookies and Website Analytics

vancko.com uses only cookies that are strictly necessary for sign-in and security, plus — with your consent via the cookie banner — minimal first-party analytics to measure site performance. We do not use third-party advertising cookies. You can manage preferences in the banner or your browser. The mobile application does not use cookies or third-party ad tracking; App Store privacy labels reflect this.

14. Push Notifications and Email

We send push notifications and/or emails about the state of your orders (queued, in review, delivered, failed) — these are service messages under the contract. Marketing messages are sent only with your consent and every one contains an unsubscribe link. You can turn off push notifications in your device settings at any time.

15. Changes to This Policy

We may update this policy as the Services or the law evolve. For material changes we will notify you in the application or by email at least 14 days before they take effect, and, where the change concerns consent-based processing, we will ask for your consent again. The “Last updated” date at the top always reflects the current version, and previous versions are available on request.

16. Contact

If you are not satisfied with our answer, you may contact the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg — or your local EU data protection authority.