Privacy Policy

Version 2.8 · Last updated: 6 October 2026

This Privacy Policy (the "Policy") explains what personal data is processed by the company operating the Kiult SaaS System (the "Controller" or "Kiult"), for what purposes, on what legal basis, how long it is retained, and what rights you have as a data subject. This Policy complies with Regulation (EU) 2016/679 (GDPR), the Artificial Intelligence Act (AI Act), the Digital Services Act (DSA) and Act No. 18/2018 Coll. on the Protection of Personal Data.

1. Controller and contact

The controller of personal data within the meaning of Art. 4(7) GDPR is:

Quin.Online, s.r.o.
Registered office: Cabanova 34, 841 02 Bratislava, Slovak Republic
Company ID (IČO): 50 042 106
Tax ID (DIČ): 2120155444
VAT ID (IČ DPH): SK2120155444
Registration: Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 107399/B
(hereinafter the "Controller", "Company" or "Kiult").

For data protection matters, contact us at privacy@kiult.com. Where a Data Protection Officer (DPO) is appointed, they are reachable at the same address with the subject line "DPO".

Supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.uoou.sk. You may also lodge a complaint with the supervisory authority in the country of your habitual residence, place of work or the place of the alleged infringement.

2. What data we process

We process the following categories of personal data:

• Account data: e-mail address, name (if provided), e-mail verification status, selected plan and subscription status, password (stored only as a cryptographic hash, never in readable form).
• Age data: month and year of birth (no day — data minimisation) to verify the 16+ age threshold. We do not collect the day of birth.
• Content you upload or create: text prompts, photos, audio and video you provide as input, and AI-generated content. Processing of uploaded inputs follows the zero-retention regime described in section 5.
• Avatar voice: the System creates the avatar's voice by machine from a verbal description (tone, pace, accent). On the Pro and Max plans you can instead create your own voice by reading out loud, in the app, a sentence the System shows you; the recording serves solely as the template for that avatar's voice. The System does not allow uploading a ready-made audio file as a voice. Details in section 6.
• Payment data: payments are processed by third-party payment gateways (Stripe, GoPay). Kiult does not store payment card numbers; we receive only payment confirmations and transaction identifiers.
• Technical and operational data: IP address (and the country derived from it via the IP Geolocation by DB-IP database, CC-BY-4.0 licence, for the purpose of selecting the payment gateway and the VAT rate), device and browser type (user-agent), access logs and security records.
• Activity records (audit log): for security, abuse prevention and accounting purposes we keep an operational audit log of selected account actions — in particular login and authentication events, render consumption (minutes), credit movements (credit/debit), consents granted for sharing, and contact with support. Each record stores the time, IP address and user-agent. We do not carry out marketing profiling and we do not track your progress through the creation process for advertising purposes.
• Cryptographic origin identifier (metaseal): the link between the invisible identifier embedded in generated content and the creator's account — for the prevention and investigation of abuse (see sections 8 and 10).
• Data of eligible organisations for the Detector: for organisations to which we give access to the Detector without a daily limit (Terms of Use, Section 8B point 7), we process the organisation's name, the name and e-mail of the contact person, the login name, the password (solely as a cryptographic hash) and records of checks (time, organisation and the result for each marking layer). We do not store the files being checked.

3. Purposes and legal basis of processing (Art. 6 GDPR)

Each processing operation has a defined legal basis:

• Performance of a contract (Art. 6(1)(b)): creation and management of the account, provision of generative services, subscription and payment management, delivery of outputs.
• Consent (Art. 6(1)(a)): optional cookies/analytics and publication of content in the Shared Creations Section. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legitimate interest (Art. 6(1)(f)): security of the SaaS System, prevention of abuse and fraud, content moderation, protection of third-party rights and cooperation with authorities. You have the right to object to processing on this basis (section 9).
• Legal obligation (Art. 6(1)(c)): accounting and tax obligations, obligations under the AI Act and the DSA, and responses to lawful requests from authorities.

Your own avatar voice (Art. 9 GDPR): We treat a recording of your own voice under section 6 as biometric data and process it only on the basis of consent under Art. 6(1)(a) and explicit consent under Art. 9(2)(a) GDPR, which you give by confirming the consent and at the same time say out loud in the sentence you read. We do not compare voices and do not use them to identify a person or to verify anyone's identity. We do not process any other special categories of personal data under Art. 9 GDPR. The automated age check described in section 4 neither extracts nor stores biometric templates and does not serve to identify a person.

Detector for eligible organisations: We process the data of contact persons of eligible organisations and records of checks on the basis of legitimate interest (Art. 6(1)(f) GDPR), namely making detection of the machine-readable marking of AI-generated content available to those who examine where content comes from, and being able to show who carried out a check. The data subjects are the contact persons of these organisations.

Burden of proof of consent: In accordance with Art. 7(1) GDPR, the Controller records and retains technical evidence of the granting of consent (time stamp, IP address at the time consent was granted, and the version of the terms/consent) for the entire duration of the consent and for 3 years after its withdrawal, for the purpose of demonstrating the lawfulness of processing carried out on the basis of consent.

4. Age gate and protection of minors

The SaaS System is intended exclusively for persons aged 16 and over. We verify age by the date of birth (month + year) provided at registration. Uploaded photos and videos of real persons are, until checked, held at most in an isolated temporary storage (quarantine) and pass automated age screening (GATE 0) in memory before they reach the library or any further processing; any input assessed as depicting a minor is immediately and irreversibly rejected and deleted from the quarantine. We do not knowingly process the personal data of persons under 16 without verifiable consent of a legal guardian under Art. 8 GDPR.

The automated screening (GATE 0) takes place exclusively in random access memory (RAM) in real time. During this process no biometric data (e.g. facial vectors or biometric templates) is extracted, stored or permanently processed for the purpose of unique identification within the meaning of Art. 9 GDPR. If an input (photo or video) is assessed as depicting a minor or as impermissible NSFW content, it is immediately and irreversibly erased from the quarantine and from RAM and never reaches the library or any further processing.

5. Uploaded content and zero-retention of inputs

We process uploaded material (photos, audio, video) solely for the purpose of providing the service you request. Inputs that serve only as a basis for generation (e.g. source video for face editing, reference photos) are automatically deleted after generation completes and are not stored in your library ("My Media"). Only generated content or content shared by you is stored in the library. Inputs rejected by a safety gate are immediately deleted from the quarantine and never reach the library. You are responsible for the lawfulness and legitimacy of uploaded material (see the Terms of Use); Kiult does not verify rights or consents relating to uploaded material. Of an input read by the vision model before generation, only a machine description of the shot (composition, lighting, colours, setting) remains with the project; it does not identify persons and is deleted together with the project. Photos and video frames from which the description is created are sent to the Gemini model (Google, section 11) only after a safety check on our server.

6. Avatar voice — from a description or your own

The avatar's voice is created in one of two ways:

• From a description (default). The System creates the voice by machine from a verbal description of the voice (tone, pace, accent) that it derives from your text prompt. The generated sample is not derived from the voice of any natural person and is not biometric data; it is processed on the basis of performance of a contract (Art. 6(1)(b) GDPR) and stored as a template so that the character sounds the same across scenes.
• Your own voice (Pro and Max plans). In the app you read out loud a random sentence the System shows you and confirm your consent. The voice in the recording must be yours or belong to a person who reads the sentence themselves and agrees to this. The System does not allow uploading a ready-made audio file as a voice.
• What we do with the recording: automatic speech transcription checks that the recording contains the sentence that was read; after that it serves solely as the template for that avatar's voice when generating its lines. We do not compare voices or identify anyone, we do not use the recording for any other purpose or for training models, and we do not provide it to third parties.
• Legal basis: consent and explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR (section 3). You can withdraw your consent at any time by deleting the voice in the avatar detail; the recording is then permanently erased and the avatar receives a voice from the description.
• Watermark: every audio output the avatar speaks — with a voice from a description or with your own voice — contains an inaudible audio watermark (AudioSeal) indicating AI origin in accordance with Art. 50(2) of Regulation (EU) 2024/1689 (AI Act). The recording itself is not marked as AI output — it is your recording.
• Deletion: we delete the generated sample and the recording of your own voice when they are replaced, when the voice or the avatar is deleted, and at the latest when the account is deleted.

7. Cookies and tracking

Own cookies and local storage. Kiult does not store your login in its own cookies — the login token (JWT) is kept in your device's browser local storage (localStorage) and serves exclusively to maintain the logged-in session and for security (legal basis: performance of a contract / legitimate interest). This is technically necessary processing that does not require consent.

Third-party cookies (strictly necessary). During payments and login, technically necessary cookies may be set by our partners directly from their domains: the payment gateways Stripe and GoPay (e.g. for fraud prevention and payment processing) and the login provider Google (if you use that option). These cookies are managed by the respective providers under their own privacy policies; they are necessary for the payment or login to function.

Detector protection (Google reCAPTCHA). If you open the Detector without signing in, only then is the Google reCAPTCHA service (Google Ireland Limited) loaded; it distinguishes people from automated programs. For this purpose it processes technical data about your device and browser (e.g. IP address, browser data and your interaction with the page) and may set its own cookies. The legal basis is our legitimate interest in protecting the free Detector against automated abuse (Art. 6(1)(f) GDPR). reCAPTCHA is not loaded for signed-in users or in any other part of Kiult. Google may also process the data outside the EEA (in the USA on the basis of the adequacy decision on the EU–US Data Privacy Framework); details are set out in Google’s privacy policy and terms of service.

No analytics or marketing. Kiult does not use its own analytics or marketing cookies and does not deploy third-party tracking tools (e.g. Google Analytics, Meta Pixel and similar). Should we wish to introduce optional analytics or marketing cookies in the future, we will do so solely on the basis of your consent, which you will be able to withdraw at any time; until such a feature is introduced, we do not use such cookies. You can manage cookie settings (including third-party cookies) in your browser.

8. AI transparency and moderation (AI Act, DSA)

In accordance with the AI Act, all image, video and audio outputs are automatically marked with a machine-readable invisible watermark identifying the content as AI-generated; for audio outputs this is an inaudible audio watermark (AudioSeal, see section 6). Image and video outputs are additionally supplemented with a cryptographic origin identifier (metaseal), which allows the specific generation to be determined retrospectively; for audio outputs this role is fulfilled by the signed C2PA manifest, as the capacity of the audio watermark is sufficient only to mark the AI origin. We moderate content using a combination of automated tools and human oversight; serious decisions and appeals are assessed by a human. Automated decision-making has no legal effect on you without the possibility of human review — you may appeal a decision to remove content or to suspend creation (see the Terms of Use, Section 8A).

In addition to machine-readable marking, we give you a choice of a mark perceivable by a human. When you save an output you choose whether the SaaS System burns a visible “AI-generated” label into it in the language of your settings; without that choice the output carries no visible label. The label is never burned into the file played back inside the SaaS System — playing something back is not publishing it. Media you uploaded yourself are not marked; marking your own footage as AI-generated would be a false statement. The duty to visibly disclose content constituting a deepfake under Article 50(4) of Regulation (EU) 2024/1689 (AI Act) rests with the deployer, that is, whoever publishes the content — if you publish the output, the duty is yours, and this choice helps you meet it. Where the label is present in the file, removing, cropping or covering it is prohibited (see Terms of Use, Section 8).

For video with sound we also mark the audio track, in the segments where AI was involved (for example generated speech or music); your unaltered audio is not marked. The visible label is only in the picture — if you use the video's audio on its own, the label does not go with it.

9. Your rights as a data subject (Art. 15–22 GDPR)

You have the right to: access your data; rectification of inaccurate data; erasure ("right to be forgotten"); restriction of processing; portability of data in a structured, machine-readable format; to object to processing based on legitimate interest; and the right not to be subject to solely automated decision-making with legal effects. Where processing is based on consent, you have the right to withdraw consent at any time. You may exercise your rights via the Support section or at privacy@kiult.com; we will generally handle a request within one month. You also have the right to lodge a complaint with a supervisory authority (section 1).

10. Retention period

We retain data only for as long as necessary for the given purpose:

• Account data and content — for the lifetime of the active account; after account deletion we delete them unless the law requires longer retention.
• Uploaded inputs (source material) — zero-retention, deleted after generation (section 5); the machine description of the shot stays with the project and is deleted with it.
• Data sent to the Gemini model (section 11) — Google does not use it to train its models and we have the cache turned off; Google may retain it only if its automated checks detect suspected abuse of the service, for no more than 90 days and within the EU.
• Avatar voice — the generated sample for as long as the avatar exists (on regeneration the previous one is deleted); the recording of your own voice until the voice, the avatar or the account is deleted (section 6). We keep the record of consent to your own voice — without the recording and without its transcript — as proof of consent under section 3.
• Data of eligible organisations for the Detector — for as long as access lasts and 1 year after it ends; records of checks as security logs, as a rule no longer than 3 years.
• Accounting and tax records — for the period required by tax and accounting rules.
• Security logs (audit log) — for the period necessary to prevent and investigate abuse and to comply with legal obligations, as a rule no longer than 3 years from the creation of the record, unless a specific regulation requires otherwise.
• Cryptographic origin identifier (metaseal) and related logs — we retain the link between the invisible code identifier (metaseal) in generated content and the user account ID for the lifetime of the account and thereafter for a period of 3 years from deletion of the account or from generation of the work, for the purposes of crime prevention, protection of copyright and intellectual property rights of third parties, the exercise of legal claims and compliance with obligations under the Digital Services Act (DSA).

11. Recipients and processors (third parties)

For operations we use providers (processors) to whom we disclose only the data necessary to deliver the service: payment gateways (Stripe, GoPay), the hosting and AI/compute infrastructure provider, and the e-mail service provider. We have data processing agreements with processors under Art. 28 GDPR. We do not sell personal data.

Google — Gemini model (Vertex AI). The script and scenes of a video, the creation guide’s messages, descriptions of characters, their voices, settings and objects, song lyrics, events in the avatars’ live world (Live) and machine descriptions of source material are written by the Gemini model, which Google Cloud EMEA Limited (Ireland) operates for us as a processor under the Google Cloud data processing agreement. We send it only what it needs to write the text: your brief and your messages in the guide, descriptions of characters and settings, the language and format of the video, and photos and video frames you have added as source material or as an attachment in the creation chat — the latter only after a safety check on our server. We do not send it voice recordings or payment data. Processing takes place in data centres in the European Union, and Google does not use this data to train its models.

For the purposes of determining the VAT rate, verifying the country of residence and selecting the locally applicable payment gateway, we use the IP Geolocation by DB-IP database (provided under the CC-BY-4.0 licence). Processing of the IP address for this purpose is carried out automatically in order to determine the country of connection, whereby the IP address is compared against this geolocation database on our side; the IP address itself is not sold or transmitted to the database provider (DB-IP) and is not used for any purpose other than the geographical classification of the transaction.

12. Transfers to third countries

We process data primarily within the European Economic Area (EEA). If, in a specific case, a transfer to a third country outside the EEA occurs, we ensure it on the basis of appropriate safeguards under Art. 46 GDPR (e.g. the European Commission's Standard Contractual Clauses) or an adequacy decision. Google processes data for the Gemini model (section 11) in data centres in the European Union. If Google were to make it available to its subprocessors outside the EEA, the transfer is safeguarded by the Google Cloud data processing agreement on the basis of an adequacy decision or the Standard Contractual Clauses.

13. Profiling and automated decision-making

We use automated systems for security checks (GATE 0–3), moderation and abuse prevention. We do not carry out profiling for marketing purposes that would have legal effects on you without the possibility of human review. Decisions with significant impact (content removal, suspension of creation) are subject to human review.

14. Sharing and "Sharables"

Content you choose to share is made available according to the sharing method you select — either directly to a specific registered user via a unique access token, or in the internal Shared Creations section. Media shared via the "Sharables" feature open only within the recipient's Kiult account (an internal closed ecosystem) and are not available for direct download to the device. The licensing terms of such sharing are governed by the Terms of Use (Section 4).

15. Security

We take appropriate technical and organisational measures to protect data (password hashing, access control, storage separation). However, no transmission over the internet is entirely secure and we cannot guarantee absolute security.

16. Changes to this Policy

We may update this Policy. We will inform you of material changes by appropriate means (e.g. by e-mail or an in-app notice). The current version is always available in the SaaS System with the date of the last update.