VAMPALLA

Privacy Policy

DRAFT — preliminary version for legal review. Last updated: August 30, 2026

IMPORTANT NOTICE: This document is a working draft prepared as a starting point and does NOT constitute legal advice. It must be reviewed, corrected, and approved by an attorney licensed in the State of Georgia (and any other relevant jurisdiction) before publication. Sections marked [TO COMPLETE] must be filled in or confirmed with the business's exact information.

1. INTRODUCTION AND SCOPE

This Privacy Policy describes how Vampalla Technologies LLC, a limited liability company organized under the laws of the State of Georgia, with its address at 109 Coastal Ln, Statham, GA 30666, United States ("Vampalla", "we", "us", "our"), collects, uses, stores, shares, and protects the information of people who use the Vampalla application (the "Service"). This policy is part of, and should be read together with, Vampalla's Terms of Service.

[TO COMPLETE WITH ATTORNEY]: This draft assumes the Service is primarily aimed at users located in the United States. If Vampalla receives or expects to receive users from the European Union, United Kingdom, California, or other jurisdictions with specific privacy laws (GDPR, UK GDPR, CCPA/CPRA, etc.), this policy requires additional compliance sections (e.g., legal basis for processing, data subject rights, international data transfer mechanisms, designation of an EU representative) before operating in those jurisdictions.

2. INFORMATION WE COLLECT

We collect the following information when you create an account and use the Service:

• Registration information: your email address, used to create your account and send you login links ("magic links").
• Conversation content: the text messages you send and the AI-generated responses, stored to maintain your conversation history and allow the Service to remember the context of your prior interactions.
• Generated images: images created via AI based on your requests, stored so you can access them later (for example, in the Service's photo gallery).
• Session and device information: technical data such as session identifiers, device type, IP address, and browser language, used to keep your session active, prevent unauthorized use of your account, and display content in your language.
• Payment information: when you subscribe to a plan, your payment method information is collected and processed directly by Stripe, Inc., our external payment processor. Vampalla does not store full payment card numbers on its own servers.
• Communications: if you contact us by email or other support channel, we retain a record of that communication.

3. HOW WE USE YOUR INFORMATION

We use the information collected to:

• Provide, operate, and maintain the Service, including generating personalized AI responses based on your conversation history and preferences.
• Process your payments and manage your subscription through Stripe.
• Send you login links and essential communications related to your account.
• Maintain the security of your account, including detecting unauthorized access and limiting active sessions per device.
• Detect, prevent, and investigate fraudulent, abusive activity or activity that violates our Terms of Service.
• Comply with applicable legal obligations.

Vampalla does not sell its users' personal information to third parties.

4. HOW WE SHARE YOUR INFORMATION

We share information with the following external service providers ("processors"), only to the extent necessary to operate the Service:

• OpenAI (or the applicable underlying AI provider): receives your conversation content to generate the AI's text and image responses.
• Stripe, Inc.: processes the payment information necessary to manage your subscription.
• Cloudinary: hosts and serves the images generated through the Service.
• Resend: sends the Service's transactional emails, including login links.
• Railway (or another applicable cloud infrastructure provider) and its associated PostgreSQL database: host the Service's technical infrastructure and database.

[TO COMPLETE WITH ATTORNEY]: Confirm whether Data Processing Agreements (DPAs) are in place with each of these providers, and whether such providers meet the required security and privacy standards.

We may also disclose your information if required by law, a court order, or to protect the rights, property, or safety of Vampalla, our users, or the public.

5. DATA RETENTION

We retain your personal information, including conversation history and generated images, for as long as your account remains active, and for a reasonable additional period after account cancellation for backup, legal compliance, and dispute resolution purposes. [TO COMPLETE: define a specific retention period after account deletion, e.g. 30, 60, or 90 days, and document the technical process for data deletion.]

6. INFORMATION SECURITY

We implement reasonable technical and organizational measures to protect your information, including the use of secure sessions, unique per-device session tokens, and encryption of sensitive data where applicable. However, no data transmission or storage system is completely secure, and we cannot guarantee the absolute security of your information.

7. YOUR RIGHTS AND CHOICES

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated information, subject to the exceptions described in Section 5.
• Cancel your paid subscription at any time through the cancellation mechanism available in the Service.

To exercise these rights, you may contact us using the contact information in Section 10 of this policy. [TO COMPLETE WITH ATTORNEY]: If Vampalla receives users from California, the specific rights under the CCPA/CPRA (right to know, delete, correct, opt out of sale/sharing of data, and non-discrimination) must be incorporated.

8. CHILDREN'S PRIVACY

The Service is not directed at individuals under 18 years of age, and we do not knowingly collect information from minors. If we become aware that we have collected information from a minor, we will take reasonable steps to delete such information. See also Section 4 of the Terms of Service regarding eligibility and minimum age.

9. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify material changes through reasonable notice within the application or by email. The "Last updated" date at the top of this document indicates the most recent version.

10. CONTACT

For questions about this Privacy Policy or to exercise your rights over your personal information, you may contact us at: vampallatm@gmail.com.

END OF DRAFT. Reminder: this document was generated as a starting point and contains multiple sections marked [TO COMPLETE] that require specific business decisions and final drafting by an attorney licensed in Georgia before official publication or use.