Privacy Policy

Data controller and contact

ThaVibes Ltd is the data controller responsible for your personal information under applicable data protection laws, including the EU General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"), the Trinidad and Tobago Data Protection Act 2011 (as amended, "TT DPA") and equivalent or model data protection frameworks in other CARICOM member states (collectively, "Applicable Data Protection Laws").

For privacy inquiries or to exercise your rights, email support@thavibes.com or use in-app support. We may require secure identity verification before processing any request. Users in Trinidad and Tobago may also direct unresolved complaints to the Office of the Information Commissioner, but we encourage you to contact us first.

1. Information we collect

To deliver, secure and continuously improve the Services — including AI tools that empower independent creators and filmmakers — we collect the following:

• Information you provide: account, profile and identity data (name, email, phone, address, date of birth, government-issued ID where required for verification, tax, billing or regulatory compliance); payment and wallet data (including cryptocurrency wallet addresses where permitted by law); content and creative data such as films, music, scripts, AI prompts, inputs, outputs, metadata and thumbnails; and communications, preferences and transaction data such as ratings, reviews, survey responses, support interactions, tips, donation and ticket records.
• Information collected automatically: usage, interaction and behavioural data (watch history, saved titles, search queries, shares and engagement metrics); device and technical data (IP address, device identifiers, browser/app details, approximate location); AI-specific data (prompts, generated outputs, model interaction logs and derived insights); and cookies, local storage and similar technologies (see Section 9).
• Information from third parties: data from partners, service providers, payment processors (such as Stripe), video hosting providers (such as Vimeo), device manufacturers, analytics firms and public sources, obtained and processed in accordance with Applicable Data Protection Laws.

2. How we use your information

We use your information to operate, protect and grow our business, including:

• Providing, personalising and improving the Services, recommendations, rankings, streaming, events and monetisation features such as creator tips.
• Training, developing, fine-tuning and enhancing our generative AI models and algorithms, including with anonymised, aggregated or de-identified data derived from user content, prompts, outputs and interactions.
• Content moderation, safety, fraud prevention and security, including detection of deepfakes, prohibited content or platform abuse.
• Analytics, research, product development and business intelligence.
• Marketing, communications and promotional activities, subject to your opt-out rights.
• Complying with legal obligations, enforcing our Terms of Use and protecting the rights, property and safety of ThaVibes, our users and the public.

AI data practices

Our AI systems are core to the Services. We may use your data (including user content and AI outputs) in anonymised, aggregated or de-identified form for model training and improvement, even after you delete your account or request deletion, to the maximum extent permitted by law. Where Applicable Data Protection Laws require consent or an opt-out for specific AI processing, we provide those mechanisms (see Section 4).

Website translation on ThaVibes runs on your own device; the text being translated is not sent to us or to a translation provider.

We may explore forward-looking AI applications while maintaining compliance with the EU AI Act, the TT DPA and other Applicable Data Protection Laws through privacy-by-design, impact assessments and appropriate safeguards.

3. Disclosure and sharing

To the extent permitted by Applicable Data Protection Laws, we may share your information:

• Internally among ThaVibes entities and affiliates for business operations and AI development.
• With service providers, AI partners, contractors and vendors who assist us, under strict contractual protections — including our payment processor (Stripe), video host (Vimeo) and cloud hosting providers.
• With device partners, payment processors, event platforms and other third parties necessary to deliver the Services.
• In connection with mergers, acquisitions, asset sales or reorganisations.
• To comply with legal process, government requests, national security or public safety obligations, and to enforce our Terms, detect fraud or protect rights and safety.
• With your consent or through public features you choose to use — for example, your public creator profile (display name, picture and bio), your content and the social sharing links you open.

Sale and international transfers

We do not sell personal information for monetary consideration. Aggregated or de-identified data may be shared for research, analytics or commercial purposes. International transfers (including to the United States) use Standard Contractual Clauses, binding corporate rules or other lawful mechanisms recognised under the TT DPA and CARICOM frameworks.

4. Your rights and choices

Where Applicable Data Protection Laws grant you rights, you may:

• Access, correct or delete your personal information (subject to verification and exceptions). You can edit your name, picture and bio at any time in Settings.
• Opt out of certain processing, including targeted advertising, AI model training on your identifiable data, or automated decision-making with legal or similarly significant effects.
• Object to or restrict processing in certain circumstances, and withdraw consent where processing is consent-based.
• Receive a portable copy of your data where technically feasible.

How to exercise your rights

Manage preferences in your account settings or email support@thavibes.com. We will respond within the time required by law after verifying your identity. We may deny or limit requests that are unreasonable, repetitive, require disproportionate effort, risk the security of our AI models or platform, or conflict with legal obligations or legitimate business needs (including continued use of de-identified data for AI improvement). Exercising your rights will not result in discriminatory treatment.

For AI-specific "Do Not Train" requests on identifiable data, use account settings or email us. De-identified or aggregated data derived from your inputs may continue to support model improvement.

5. Children's privacy

The Services are not directed to children under the minimum age required by law (13 under COPPA and equivalent standards; the age of majority — generally 18 — in Trinidad and Tobago and most CARICOM jurisdictions). Users below the age of majority may only use the Services with verifiable parental or guardian consent and supervision. We do not knowingly collect personal information from children without such consent and will delete any such data discovered. Parents and guardians are responsible for supervising their children's use.

6. Security

We implement reasonable administrative, technical and physical safeguards appropriate to the nature of the data and the risks involved — see our Security page for details. No security system is impenetrable; we are not liable for unauthorised access, disclosure or breaches beyond what Applicable Data Protection Laws strictly require.

7. Data retention

We retain information for as long as necessary to fulfil the purposes in this Policy, comply with legal obligations (including under the TT DPA and tax and payment record rules), resolve disputes, enforce our Terms or support legitimate business needs — including ongoing improvement of our AI models using de-identified data. Deletion requests are honoured subject to these exceptions.

8. Third-party platforms and links

The Services integrate with or link to third-party services such as Stripe (payments), Vimeo (video playback), social networks you share to, smart TVs, consoles and voice assistants. Their privacy practices are governed solely by their own policies, and ThaVibes is not responsible for their data handling.

9. Cookies, tracking and advertising

We and our partners use cookies, local storage, pixels, SDKs and similar technologies for essential operations (such as keeping you signed in and remembering your language), analytics, personalisation, fraud prevention and advertising. You may manage preferences through our consent tools, browser settings or industry opt-out mechanisms (e.g. NAI, DAA or global privacy signals). Deleting cookies may impair Service functionality.

10. Changes to this Policy

We may update this Policy to reflect legal, technological or business changes. Material updates will be notified at least 30 days in advance via email, in-app notice or platform posting. Continued use of the Services after the effective date constitutes acceptance of the revised Policy. If you do not agree, you must stop using the Services.

11. Governing law and regional applicability

This Policy is governed by the laws of the State of Delaware, USA, without prejudice to any non-waivable rights you may have under the TT DPA, other CARICOM data protection laws, GDPR, CCPA/CPRA or your local law.