Giorno VI Privacy Policy

Effective date: November 11, 2026

1. Who we are

Giorno VI LLC, a California limited liability company ("Giorno VI", "we", "us"). - Mail: 2108 N St #17959, Sacramento, CA 95816 - Phone: (707) 679-0312 - Privacy contact: privacy@giornovi.com

Registering a likeness on Giorno VI is free for talent. Giorno VI earns only its 30% share of brand deals the talent approves; talent receive 70% from the first deal.

Giorno VI helps adult talent build a digital twin (a computer-made version of their look and voice) and license finished, talent-approved content to brands.

2. Who this policy covers

• Talent: people who register to build a digital twin.
• Brands: businesses and their staff who use our service to request and license approved content.
• Visitors: anyone who uses our website or app without registering.

Talent who sign the Talent Consent Pack also get the privacy terms in that document. New talent sign-ups use only the full Talent Consent Pack; no interim consent is offered to new sign-ups. If anything here conflicts with a consent a talent has signed, the signed consent controls for that talent.

3. What we collect

3.1 Talent

We do not collect video of you, studio captures, or location data from photos. Location and EXIF data are removed from photos on upload.

3.2 Brands

Business contact details, company name, billing and payment details, briefs you submit, messages, and records of content licensed.

3.3 Visitors and waitlist

When you load a page, our website host receives technical information such as your IP address, browser type and the pages you request. We use the essential browser storage described in Section 10.

If you join the waitlist, we collect your name, email address, the role you choose (for example talent, representative or brand), your country and any note you add. We keep that waitlist information for 12 months after we send you the launch invitation, or we delete it sooner if you ask. If you write to us, we keep your message and contact details.

3.4 Notice at Collection

This section tells you, at or before the point we collect it, what personal information we collect, why, whether we sell or share it, and how long we keep it. Our full Privacy Policy is at giornovi.com/privacy, and our Biometric Data Retention and Deletion Policy is at giornovi.com/biometric-policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. No category below is sold or shared.

We do not keep any category longer than is reasonably necessary for the purpose we collected it for. When a period ends, we delete the information or make it permanently de-identified.

4. How we use information

• Talent identity, contact, account: to run your account, your consents and your deals, and to contact you.
• Date of birth: only to confirm you are 18 or older before any upload.
• Photos, voice and data made from them: only as described in Section 6 (build and run your own twin and make the specific finished pieces you approve).
• Consent and approval records: to prove what you agreed to and when, and to enforce your right of refusal.
• Payment and tax: to pay your 70% share and meet tax duties. Giorno VI does not give tax advice.
• Brand data: to set up briefs, send finished cuts to talent for approval, and invoice brands. Brands are charged only after the talent approves the final version.
• Visitor data: to run and secure the site.
• Legal and safety: to meet legal duties, prevent fraud and enforce our terms.

5. Sale, sharing and targeted advertising

We do not sell personal information, and we do not share it for cross-context behavioural (targeted) advertising. We never sell, lease, trade or otherwise profit from biometric data.

6. Biometric and Voice Data

This section summarises Giorno VI's standalone Biometric Data Retention and Deletion Policy, published at giornovi.com/biometric-policy together with this policy, as referred to in the Talent Consent Pack.

6.1 What we collect

• 16 guided-pose phone photos (11 face, 5 body), taken by the talent on their own phone per the Guided-Pose Phone Photo List v0.3.
• A phone voice sample of about 45–60 seconds reading the fixed practice paragraph shown in the app.
• Face geometry, voiceprint and twin models made from them. Some laws call these "biometric identifiers", "biometric information" or "sensitive personal information".

No studio capture and no video capture.

6.2 Purpose (the only uses)

• To build and run that talent's own digital twin; and
• To make the specific finished pieces the talent approves, one by one (right of refusal). The voice is used only to make content the talent approves, never for live calls, voice messages, or anything meant to make someone think it is really them speaking live.

Biometric data is never used to train, fine-tune or improve any third-party AI model, or any Giorno VI model other than the one that runs that talent's own twin.

6.3 Notice and written consent before collection

• Age is checked by date of birth before any upload; nothing is collected from anyone under 18.
• The talent gives a separate written biometric photo consent before photo upload, and a separate written voice consent before the voice step unlocks.
• We record who accepted which version, when (UTC), and a SHA-256 fingerprint of the exact text.
• Each consent can be withdrawn on its own.

6.4 Who can access it

• Photos and voice go only to a private, encrypted, access-logged upload area that only the talent and Giorno VI's backend systems can open.
• Brands and AI agents never receive source photos, voice samples or models. They receive only finished pieces the talent approved.
• Rendering and storage vendors process data only on our instructions, under written terms that bar them from keeping, selling or reusing it. Current processors: Supabase (database, sign-in and file storage, in its us-west-1 region in the United States; see Section 11), Netlify (website hosting), Google (account emails), Stripe (payments and payouts), HeyGen (HeyGen Technology Inc.), which turns talent photos and voice into the twin and stores this data in the United States on AWS, and ElevenLabs (Eleven Labs Inc.), the voice backup, which stores this data in the United States by default and may also process this data in other countries.
• We do not disclose biometric data to anyone else unless the talent consents or the law requires it.

6.5 Retention schedule

"Last activity" means any sign-in to the talent's Giorno VI account, any approval or refusal of a finished piece, or any new upload. The 24-month clock restarts at each of these.

6.6 Destruction guidelines

1. Trigger: account deletion, withdrawal of the photo or voice consent, the purpose ending, or reaching 24 months after last activity.
2. Scope: the source data for the withdrawn consent and everything made from it, including the twin model. Withdrawing the photo consent does not delete voice data (and vice versa) unless the talent asks.
3. Method: permanent deletion from primary storage and vendor systems; daily backups, once enabled, are kept no longer than 30 days and then expire. Crypto-shredding of per-talent keys. Deleted data is removed from our systems right away, and from backups within 30 days.
4. Vendors: instructed to delete and confirm in writing.
5. Confirmation: we confirm a withdrawal or deletion request in writing within the times in Section 8.1, and confirm deletion when it is complete.
6. Logging: each deletion is logged (what, when, who triggered it) without keeping the deleted data.
7. Already-approved finished pieces are not source data; after withdrawal they may run only to the end of their approved dates with no renewals and no longer than 12 months, and Giorno VI's own marketing is taken down within 10 calendar days.

6.7 Security

Encryption in transit and at rest, access logging, least-privilege access, and storage tied to signed consent records, using a standard of care at least as protective as we use for other confidential information.

7. How we share information

• Service providers, under contract, only on our instructions: website hosting by Netlify; database, sign-in and storage by Supabase; account emails by Google; payments such as Stripe; and rendering by HeyGen (HeyGen Technology Inc.), which turns talent photos and voice into the twin and stores this data in the United States on AWS, and by ElevenLabs (Eleven Labs Inc.), the voice backup, which stores this data in the United States by default and may also process this data in other countries.
• Brands: talent profile details the talent chose to show (if opted into the marketplace), and finished pieces the talent approved. Never source photos, voice or models.
• Talent: brand name, brief and fee details needed to decide on a cut.
• Legal: where the law requires, or to protect rights and safety.
• Business transfer: in a merger or sale, subject to this policy and the consents talent signed.

8. Your rights and choices

8.1 How to make a privacy request, and how fast we answer

How to ask. You can ask to know, see, correct or delete your personal information, or to withdraw a consent, by email to privacy@giornovi.com, by mail to Giorno VI LLC, 2108 N St #17959, Sacramento, CA 95816, or by phone at (707) 679-0312. Talent and brands can also use their signed-in account. You never need to create an account to make a request.

How fast we answer. We confirm that we received your request within 10 business days and tell you how we will handle it, including how we will verify it and when to expect our answer. We answer within 45 calendar days of receiving your request. If we need more time, we may extend that once by up to 45 more calendar days. If we do, we will tell you within the first 45 days and explain why. If a law that applies to you sets a shorter deadline, we meet the shorter deadline. Requests to opt out of sale or sharing, or to limit the use of sensitive personal information, need no verification, and we act on them within 15 business days. We do not sell or share personal information, and we use sensitive personal information only for the purposes described in this policy.

Deletion and withdrawal. When you withdraw a consent, nothing new is made with that data from the moment we receive your withdrawal. When data is deleted, it is removed from our systems right away and from backups within 30 days, and we tell our vendors to delete it and confirm in writing. We confirm in writing once deletion is complete.

How we verify you. We check that a request really comes from you before we give out, correct or delete information. We match what you tell us against information we already hold, and we ask for as little extra information as we can.

• If you have an account, we verify you through your sign-in, and we ask you to sign in again before we delete, correct or give out your information.
• If you don't have an account, we usually match two pieces of information you give us with information we hold before telling you what categories of information we have. Before giving you specific pieces of information, we match three pieces of information and ask you to sign a statement, under penalty of perjury, that you are the person the request is about.
• Because photos, voice samples and the data made from them are sensitive, we use the higher standard, three matching pieces of information or a fresh sign-in, before deleting or correcting them.
• We never send face geometry, voiceprints or twin models in response to a request. We tell you clearly that we hold that type of data instead. Talent can view and delete their own photos and voice sample in the app.
• Verification is free. We use any extra information you give us only to verify your request, for security and to prevent fraud, and we delete it as soon as practical after we handle your request.
• If we can't verify you within 45 calendar days, we may decline the request, and we will explain why.

Authorized agents. Someone you authorize can make a request for you. We may ask the agent for your signed permission, and we may ask you to verify your identity with us directly or to confirm that you gave the permission. We will not ask you to make the request again yourself. If the agent holds a power of attorney under California Probate Code sections 4121 to 4130, these extra steps don't apply.

If we say no. If we decline all or part of a request, we will tell you why. You can appeal by replying to our decision or writing to privacy@giornovi.com with "Appeal" in the subject line. We will answer your appeal in writing within 45 calendar days, explaining what we did or did not do and why. If we deny your appeal, we will tell you how to contact the attorney general or data protection authority where you live.

No discrimination. We will not treat you differently for using any of these rights.

8.2 Talent

• Withdraw the photo consent, the voice consent, or the whole consent, each on its own, in the app or through Section 1 contacts.
• Retake, view or delete any photo, or the whole set; delete the voice sample.
• Hide your marketplace listing at any time.
• Say yes or no to every finished cut; silence for 5 calendar days (ending 11:59 PM your home time zone) means no.

8.3 California residents

California residents have the right to know what personal information we collect, use and disclose; to see it; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. Section 8.1 explains how to use these rights and how fast we answer.

• Categories, sources and purposes: Section 3 lists the categories we collect and where they come from. Section 3.4 lists why we collect each one and how long we keep it. Section 4 explains how we use them, and Section 7 explains who we disclose them to.
• Sale and sharing: We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
• Sensitive personal information: We collect the sensitive personal information listed in Section 3.4: account log-in details, tax ID numbers, and photos, voice samples and the data made from them. We use it only to provide the service you asked for, to keep accounts secure, to pay you and to meet legal duties. We do not use it to infer characteristics about you.
• Notice at Collection: See Section 3.4.

8.4 Other US states

Residents of other states with privacy laws may have similar rights, and we honor them the same way, using the process and timing in Section 8.1.

• Colorado: Our Biometric Data Retention and Deletion Policy at giornovi.com/biometric-policy includes the Colorado retention and deletion rules.

8.5 Applicable regional safeguards (including EU/UK)

Giorno VI remains prelaunch and waitlist-only; talent sign-up is not open. No region is given priority, and this wording does not confirm legal clearance in any jurisdiction. Where EU/UK law applies, applicable safeguards must be reviewed and in place before relevant processing or use, including an annex prepared by EU Counsel addressing GDPR requirements (including Art. 9(2)(a) explicit consent where applicable), notices, data-subject rights and transfer safeguards, and applicable AI-generated content labelling requirements (including EU AI Act Art. 50 where applicable). These safeguards are not deferred by territory-neutral wording.

9. Children

Our service is for adults only. Talent must be 18 or older, checked by date of birth before any upload. We do not knowingly collect information from children; if we learn we have, we delete it.

10. Cookies and similar tools

We use only essential cookies and similar browser storage, needed for the site to work: your language choice and, if you sign in, your sign-in session. We use no other cookies.

11. Where data is stored

Your account, sign-in, consent records, photos and voice recording are stored in the United States with our database and storage provider, Supabase, in its us-west-1 region. Our website is hosted by Netlify. Account emails are sent through Google. Giorno VI staff and systems in the United States can access this data to run the service. Daily backups, once enabled, are kept no longer than 30 days.

12. Data security

See Section 6.7. No system is perfectly secure. We keep a written incident-response protocol. If a security incident affects your personal information, we will notify you, and regulators where required, within the time the law requires.

13. AI labels

Content using a talent's twin is labelled as AI-generated wherever the law requires (for example N.Y. General Business Law §396-b), using the label text in the approved brief.

14. Changes

We will post updates here with a new date. Material changes to how we use biometric data will require new consent from talent before they apply.

15. Contact

Giorno VI LLC, 2108 N St #17959, Sacramento, CA 95816 · (707) 679-0312 · privacy@giornovi.com