Vics Privacy Policy

This is a courtesy translation. Only the Portuguese version is binding.

1. Who we are

Vics is an audio story app for children, operated by GUIO MARKETING E GROWTH LTDA, CNPJ (Brazilian company number) 35.412.106/0001-87, headquartered at Avenida Prudente de Morais, 287, sala 507, Belo Horizonte, MG, CEP 30350-093, Brazil (“we”). We are the controller of the personal data described here, under the Brazilian General Data Protection Law (Law 13,709/2018, the “LGPD”).

• Data protection officer: Rafael Motta Viberti Riedel, suporte@vics.app.
• Contact for anything about this policy: suporte@vics.app.

2. Who Vics is for

Vics is used by adults (parents or guardians), who create the account, choose what to tell and listen together with the child. The child has no account and no login, and Vics has no area where a child signs up, writes or chats. The child appears only as a profile inside the adult’s family.

At launch, Vics is offered only in Brazil, through Apple’s App Store. The app can be used in Portuguese, English and Spanish, but choosing another language does not change your country or the rules that apply to you.

3. Which data we handle and why

About the adult

• Email. Used to sign in (with a 6-digit code sent to the email), to tell you that an account deletion has finished and, if needed, for important notices about your account or about changes to these texts. We do not ask for a name or a password.
• Access data. When you sign in we keep a session with the IP address, the technical identification of the app and the device, and the sign-in method. We also keep attempt counters (by IP address and, for code sending, by a mathematical fingerprint of the email) to prevent abuse.
• PIN and short-lived permissions. The 4-digit PIN protects the adult areas. It is stored only as a mathematical fingerprint (hash), never as readable text. The permissions opened by the PIN or by a new email code last at most 5 minutes.
• Language of the app, and language and voice of the family’s stories.
• Consents. We record what you accepted, in which version of the text, in which language and when.
• Subscription. The purchase is made in the App Store. We do not receive a card number or payment method data, and we do not store the price you paid. We receive from Apple the state of the subscription (for example active, in free trial, expired or cancelled), the plan, the period and a purchase identifier, so we can unlock story creation. At purchase, we send Apple a random account code that does not identify you.
• Action log. We keep who performed which sensitive action, on what and with what result (for example, a deletion request), without the content of stories, ideas or profiles.
• Messages to support. If you write to us, we handle your email address and the content of the message in order to reply.

About the child

You decide what to enter. Only the age band is required:

• age band (3 to 4, 5 to 6 or 7 to 8 years);
• name or nickname (optional), to identify the profile in the app;
• likes and topics to avoid (optional);
• learning goals you want to see in “Learn” stories (optional).

The nickname, likes, topics to avoid and learning goals are stored encrypted in our database, with a key that stays on our servers, outside the database. The age band and the text of the stories are not encrypted in this way: they are protected by per-family access control. We do not ask for a photo, surname, school, address, location or health data.

About stories and use

• The story request (the idea you write, the mode, the length, the language and, in “Learn” mode, the learning goal) is kept encrypted while the story is created. It is deleted when creation finishes and, in any case, 24 hours after it was sent, with a technical margin of about 1 hour. Story drafts and the notes of the automatic review follow the same rule.
• The finished story (title, summary and text) and the audio stay in your family’s library until you delete the account. At launch, the app does not delete a single story on its own.
• Favorites and ratings (the three faces: loved it, liked it, did not like it) help Vics choose the next story.
• Listening. We keep when a story started playing, how long it was heard, how it ended and for which child profiles it played. This detail is kept for 90 days. Totals per story (how many times and when it was heard) stay while the account exists. Listening records do not store location or device identification.
• Creation records. For each story created we keep the state, the steps, the provider and model used, the cost and the result of the automatic review (codes from a list), without the text. We also keep the count of stories created, to apply the plan allowance and the daily limit.
• Reports about content are stored with the reason chosen from a list, the story and the point in the audio, with no free text.

On your device

The app keeps on the device what it needs to work: the session and the draft of the idea you are writing (in a protected area of the system that only opens when the device is unlocked and is not copied to another device), the library cache (titles and summaries), the audio you download, the queue and the timer, listening records not yet sent, and language preferences. When you sign out, the app deletes what belongs to the account. What is kept outside the protected area is not included in the iCloud or computer backup either: when you change devices, you sign in again and download the audio again.

Technical logs

Our servers record the minimum needed to operate and investigate failures: request method and path (without parameters), a request identifier, the result and errors reduced to a code. These logs do not contain story or idea text, emails, sign-in codes, tokens or file addresses. The hosting platform may keep its own connection records, such as IP address, time and path accessed. Technical logs are kept for up to 30 days.

4. What we do not do

• We do not show ads and we do not use behavioral advertising.
• We do not use third-party usage analytics or crash reporting in the app.
• We do not use cookies or trackers on our website.
• We do not sell data.
• We do not train artificial intelligence models with your data or the children’s data. What each provider does with what it receives is in section 7.
• At launch, the app does not use the microphone, camera, location or contacts.
• The child does not talk to Vics: stories are generated from what the adult asks for.

5. Children’s data

We handle children’s data in their best interest and only to create and play the family’s own stories (LGPD, art. 14).

• Consent. Before a child is added or a story is created, the app asks you to accept the Terms of Use and this Policy and to give specific consent for the use of the children’s data. By accepting, you declare that you are the parent or legal guardian of the children whose data you enter. We record the version of the text, the language in which it was shown and the date.
• The minimum needed. Only the age band is required. Nickname, likes, topics to avoid and learning goals are optional: the nickname is used to identify the profile in the app, and the others only to personalize the stories.
• Correction and removal. You can correct a profile whenever you want. You can also remove it as long as no story has been created for that child; after that, the profile is deleted when the account is deleted.
• Withdrawing consent. You can withdraw consent at any time by deleting the account (section 12). Without it, Vics cannot create stories.
• No advertising. We do not use children’s data for advertising and we do not share it for that purpose.

6. Artificial intelligence and the names you write

Stories are written and reviewed by third-party artificial intelligence models and narrated by a synthetic voice, also from a third party. Therefore:

• What is sent. To write the story, we send the text provider the idea you wrote and the personalization data: age band, likes, topics to avoid, mode, length, language and, when applicable, the learning goal. To narrate, we send the voice provider the approved text of the story. Details are in section 7.
• Names. The names you write in the idea (of the child, a relative, a pet, a character) go into the story and are therefore sent to these two providers. The nickname saved in the profile is not sent to them: it only appears in the story if you write it in the idea.
• What not to write. We recommend not writing an address, phone number, date of birth, documents, full name, school or health information in the idea. The story does not need them.
• Mistakes. The text may contain mistakes, and the automatic review reduces, but does not eliminate, the risk of an unsuitable story. Listen together with the child.
• Reporting. You can report any story in the app (in the player, “•••” and then “Report this story”), choosing a reason, or write to suporte@vics.app.

7. Who we share with and international transfer

We use providers to operate Vics. They handle the data to provide the service, and they are outside Brazil:

We do not send the artificial intelligence providers your email, identifiers of the family, the child or the adult, or tokens.

xAI (voice). Our xAI account has the zero data retention option turned on: under it, xAI does not keep the text sent after processing it. Vics checks this setting before sending any text and, if it is not active, does not send.

DeepSeek (text). We do not have an equivalent setting with DeepSeek. It handles what it receives under its own terms and its own privacy policy, and we do not control how long it keeps this content or the uses it makes of it within those terms. That is why we send only what is needed to write the story, with no email or identifiers, and we recommend not writing unnecessary personal data in the idea (section 6).

International transfer. Sending data to the United States and to China is an international data transfer (LGPD, art. 33). It happens because these providers are necessary to deliver the service you ask for, and on the basis of the consent you give in the app when you accept this policy and the use of the children’s data. Story creation is only unlocked after that acceptance. These countries may not offer the same level of data protection as Brazilian law. If you have questions about this transfer, contact the data protection officer using the contact in section 1.

8. Legal bases

We handle data on the following LGPD bases:

• Performance of the contract with you (art. 7, V): account, sign-in by code, creation and storage of stories, library, listening queue and subscription.
• Specific consent of a parent or legal guardian (art. 14, §1): the children’s data.
• Legitimate interest (art. 7, IX): security, prevention of abuse and fraud, action log, technical logs and handling of reports.
• Compliance with a legal obligation and regular exercise of rights (art. 7, II and VI): record of consents, of the deletion request and of purchase data.

9. How long we keep it

After the account is deleted, the following still remain, with no automatic deletion period and without your email:

• the record that deletion was requested and completed and the deleted-account and deleted-family marks, with internal identifiers, dates, the screen language and the story language only;
• the record of the purchase notices we receive from Apple, with the purchase identifier in the store, the random account code, the internal identifiers of the family and the adult, and the dates. It is used to check the subscription with the store and to prevent misuse of the same purchase.

For up to 8 days after deletion is completed, we also keep a file with the identifiers of the deleted account, to repeat the deletion if an old backup is restored.

10. Security

We protect data with access separated by family, encrypted communication (HTTPS), encryption of the most sensitive data in the child’s profile, a PIN for the adult areas, a new email code to export data and delete the account, audio addresses valid for at most 15 minutes, and logs without content. No system is completely secure: if a security incident occurs that may cause significant risk or harm, we will notify you and the Brazilian National Data Protection Authority (ANPD) as the law requires.

11. Your rights

Under the LGPD (art. 18), you can ask for confirmation that we handle your data, access, correction, anonymization, blocking or deletion, portability, information about who we share with, information about the possibility of not consenting and its consequences, and withdrawal of consent. You exercise these rights for yourself and for the children under your responsibility. In the app:

• Export my data: in Family, tap Privacy and “Export my data”. The app asks for a new email code and generates a file with your family’s data, without the audio.
• Correct: the children’s profiles and the family settings can be changed in the app.
• Delete the account: in Family, tap Privacy and “Delete the account”.
• Report a story: in the player, “•••” and then “Report this story”.

For anything the app does not solve, such as deleting a single story, write to suporte@vics.app, which is also the data protection officer’s contact. We reply within the legal deadlines. You may also file a complaint with the ANPD.

12. Deleting the account

When you delete the account, we delete the family, the stories, the audio, the children’s profiles, the favorites, the ratings, the listening history, the consents and the creation records. The goal is to finish within 72 hours. When it is done, we send a confirmation email and delete your email from our database; if sending fails for 48 hours, we delete the email even without the confirmation. Backups no longer contain this data within 7 days. What still remains is in section 9.

Deleting the account does not cancel the subscription in the App Store: cancel it in the store. The steps, including for people who no longer have the app, are on the account deletion page.

13. Changes to this policy

When we change this policy, we will publish the new version on this page. If the change is relevant, we will notify you through the account email or the app, and we will ask for new consent when the law requires. The version you accepted is recorded.