legal

Privacy Policy

Last updated: 11 August 2026 (draft)

1. Who we are

Liforma Ltd (“Liforma”, “we”, “us”) provides the Avatar Experience Platform, including websites at www.liforma.ai, developer portal app.liforma.ai, creator app my.liforma.ai, API at api.liforma.ai, player at player.liforma.ai, and related services.

TBD for counsel: confirm controller identity, company number, and registered address for this policy.

Contact for privacy questions: legal@liforma.ai.

2. Scope

This draft describes how we process personal data when you visit our sites, create an account, use APIs or Studio, run or join avatar sessions (including Meet), or contact us. It should be read with our Terms of Service and Subprocessors list.

3. Data we may collect

Account and authentication

Name, email address, and profile details from sign-in providers
Organisation / project membership and roles
Authentication session data

Developer and publisher data

API key metadata (name, prefix, environment, last used) — not the full secret after creation
Allowed origins and embed configuration
Experience configuration and Studio content you save

Session and interaction data

Session identifiers, timestamps, experience IDs, and technical logs
Audio, transcripts, and derived animation signals when a session uses speech features
Device / browser technical data needed to run the player (for example capabilities)

Billing (when enabled)

Billing contact and payment metadata processed by our payment provider (for example Stripe)

Communications

Messages you send to us (email, support, waitlist)

4. How we use data

We process personal data to:

Provide and secure accounts, APIs, sessions, and embeds
Run speech and language pipeline stages you configure (STT, LLM, TTS, animation)
Operate Meet demos and product experiences
Prevent abuse, enforce Acceptable Use, and debug reliability issues
Communicate about the service (for example magic links and invites)
Meet legal obligations

Legal bases (TBD for counsel): proposed mapping includes contract (performance of the Terms), legitimate interests (security, product improvement, demos), consent where required (for example certain cookies if introduced later), and legal obligation.

5. Cookies and similar technologies

Current approach: essential-only. We use cookies and similar storage that are necessary to operate the Services — for example authentication/session cookies on app.liforma.ai and my.liforma.ai, and technical storage required for the player or local preferences.

We do not currently use third-party marketing or advertising analytics pixels on www.liforma.ai. Because we are not setting non-essential tracking cookies for marketing analytics, we do not show a cookie consent banner at this time.

If we introduce non-essential analytics or advertising cookies later, we will update this policy and implement an appropriate consent mechanism before those cookies are set.

6. Processors and subprocessors

We use infrastructure and service providers to host and operate the platform. Categories and examples are listed at Subprocessors. Speech and language providers process audio/text as needed for the pipeline you use.

7. Sharing

We may share personal data with:

Subprocessors who assist in providing the Services
Publishers / project admins for data generated in experiences they control (as applicable)
Professional advisers or authorities when required by law or to protect rights and safety

We do not sell personal data.

8. International transfers

Providers may process data in the UK, EEA, United States, or other countries. TBD for counsel: transfer mechanisms (for example UK IDTA / SCCs) and wording.

9. Retention

TBD for counsel — proposed direction: keep account data while the account is active; keep logs and session telemetry for a limited operational period; delete or anonymise sooner on verified request where feasible and not required for security or legal retention.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability or complaint to a supervisory authority. TBD for counsel: UK GDPR / EU GDPR / other jurisdiction specifics.

To exercise rights, contact legal@liforma.ai.

11. Children

The Services are not directed at children under 16 without appropriate organisational controls. Education and training uses must comply with applicable child-protection and school rules. TBD for counsel: age thresholds and school/parental consent wording.

12. Security

We apply technical and organisational measures appropriate to a cloud platform (access control, encrypted transport, origin allowlists, short-lived session tokens). No method of transmission or storage is perfectly secure.

13. Changes

We may update this Privacy Policy. We will change the date above and, for material changes, provide additional notice where appropriate.