Privacy Policy

1) Overview & Acceptance

At Arena, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our websites and services, including AI Avatar, its mini-page/link tools, animated headshots, and AI-generated video scenes (the “Services”). By accessing or using the Services in any manner, you acknowledge and agree to the practices described here.

Your use of the Services is at all times subject to our Terms of Use and, if you are a Creator, our Creator Terms of Service, each of which incorporates this Privacy Policy by reference. Capitalized terms not defined here have the meanings given in those terms.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (e.g., email, in-product notice, or on our site). Your continued use after the effective date constitutes acceptance.

2) What This Policy Covers

This Policy covers how we treat Personal Data we collect when you access or use the Services. “Personal Data” means information that identifies or relates to an identifiable individual (including “personal information” or “sensitive personal information” under applicable laws). This Policy does not cover the practices of third parties we do not control.

If you use the Services to interact with a Creator (e.g., you visit a mini-page or chat with a Creator Digital Avatar), the Creator may receive data about those interactions. If Arena processes data on behalf of a Creator, our Data Processing Addendum (DPA) (if applicable) governs that processing relationship.

3) Categories of Personal Data We Collect

Below are the categories of Personal Data we collect (and have collected in the last 12 months), our purposes for collection, and typical disclosure recipients.

  • Profile/Contact Data (name, email, username) Purposes: Provide & customize Services; support; communications; marketing (subject to your choices). Disclosed to: Service providers; Creators you interact with; parties you authorize.
  • Identifiers (Creators only, where required) (e.g., driver’s license or gov’t ID for verification/KYC) Purposes: Account verification; trust & safety. Disclosed to: Service providers (verification/KYC).
  • Payment Data (card type/last 4, billing address/phone/email) Purposes: Process payments/subscriptions; prevent fraud. Disclosed to: Payment processors (e.g., Stripe) and related providers.
  • Device/IP Data (IP address, device/OS/browser, domain server) Purposes: Provide, secure, debug, and improve Services; analytics; fraud prevention; marketing (subject to your choices). Disclosed to: Service providers.
  • Web Analytics (pages viewed, referring URLs, time on page, interactions) Purposes: Improve Services; measure/serve advertising (subject to opt-outs). Disclosed to: Analytics/measurement providers.
  • Social Network Data (handles, contact info you connect) Purposes: Login/connection; cross-posting; communications. Disclosed to: Service providers; parties you authorize.
  • Geolocation (coarse/IP-based) Purposes: Security; localization; analytics; legal compliance. Disclosed to: Service providers.
  • Biometric Data (Creators only, if you opt in) (e.g., voiceprints and voice/style embeddings derived from your inputs). We do not collect or store faceprints or facial recognition templates. Purposes: Create/operate your Digital Avatar voice and persona; security/abuse prevention; model quality. Disclosed to: Contracted service providers (hosting/model operations).
  • Visual & Media Data (photos, selfies, portraits, videos, audio you upload/record; for Creators only: animated headshots and AI-generated video scenes; thumbnails and preview frames) Purposes: Operate features (knowledge base, voice cloning, photo-to-animated headshot, photo/video-to-scene generation, rendering, previews), support, quality, and safety review. Disclosed to: Service providers (e.g., rendering/CDN, GPU/AI infrastructure); Creators (for their own content/operations when you engage them).
  • Derived Technical Signals (Creators only, for animations/video) (e.g., lip-sync/phoneme tracks, pose/skeleton vectors, segmentation/depth masks, motion fields, low-res keyframes, audio features). These are used for rendering and safety; we do not create or store faceprints/facial recognition templates. Purposes: Rendering and improving output quality; safety/abuse detection; rate-limiting; troubleshooting. Disclosed to: Service providers under contract.
  • Sensitive Data under state laws (e.g., government IDs for verification) Purposes: Verify identity; prevent fraud/abuse. Disclosed to: Service providers.
  • Other Information You Voluntarily Provide (free-text chats with an avatar, which may include health, opinions, or other sensitive topics you choose to share) Purposes: Provide, customize, and improve Services; support. Disclosed to: Service providers; relevant Creators you contact; parties you authorize.

We do not collect Sensitive Data for the purpose of inferring characteristics about you.

4) Sources of Personal Data

  • You or your representative (e.g., account creation, uploads, chats, forms, support)
  • Automatic collection (cookies, pixels, SDKs, server logs)
  • Social/media platforms you connect or reference
  • Creators (e.g., invitations/collaborations)
  • Service providers/partners (e.g., analytics, payments, anti-fraud, rendering/CDN, GPU cloud)

5) How We Use Personal Data (Purposes)

  • Provide, operate, and maintain the Services (accounts, payments, creator tools, mini-page features, Creators: animated headshots & AI video scenes, previews, downloads, sharing)
  • Customize and improve functionality, output quality, and safety (testing, research, QA, latency reduction, defect remediation)
  • Security, trust & safety (fraud prevention, abuse detection (e.g., deepfake misuse, CSAM scanning, prohibited content checks), rate-limit, incident response)
  • Communications (service messages, updates, responses; marketing per your choices)
  • Legal & compliance (contracts, tax, audits, dispute resolution, regulatory requests)
  • Other purposes disclosed at collection or with your consent

6) How We Disclose Personal Data

  • Service Providers. Hosting, cloud/AI infrastructure, rendering/GPU, analytics, communications, security/fraud prevention, content moderation, customer support, identity verification, and payment processing (e.g., Stripe). Providers process data only under our instructions/contracts.
  • Advertising/Measurement Partners. To help measure or serve ads (including interest-based ads) where permitted by law and your preferences.
  • Creators. If you interact with a Creator (e.g., visit a mini-page, chat, or submit media to their avatar), that Creator may receive your profile data, conversation metadata, and when relevant, media/transcripts or summaries needed to operate their avatar or deliver requested outputs.
  • Parties You Authorize. If you share/export assets (e.g., to YouTube, TikTok, Instagram) or connect third-party accounts. Those parties’ policies apply.
  • Legal/Compliance. To meet legal obligations; protect rights, safety, security; enforce terms; respond to lawful requests.
  • Business Transfers. In connection with a merger, acquisition, financing, reorganization, or asset sale.

We may create aggregated, de-identified, or anonymized data for lawful business purposes, provided it does not identify you.

7) Biometric & Likeness Processing (Creators: Voice, Animated Headshots & AI Video)

Some jurisdictions (e.g., Illinois BIPA) regulate “biometric identifiers” and “biometric information.” If you are a Creator who opts to create a voice/persona or visual avatar, Arena may derive voiceprints and voice/style embeddings from your uploads solely to provide the Services, improve accuracy/safety, and for other permitted purposes described here. Arena does not collect or store faceprints or facial recognition templates.

  • Photos & Media for Animation. When Creators generate animated headshots or AI video scenes, we process Creator-supplied photos/videos/audio and derived technical signals (e.g., lip-sync/phoneme tracks, pose/skeleton vectors, segmentation/depth masks, motion fields, low-res keyframes, audio features) that are necessary to render the animation or scene. These signals are used for rendering and safety and are not used to build facial recognition systems.
  • What we do not do. We do not use uploads to build a general-purpose face recognition system; we do not sell your photos or videos; we do not use your likeness to train models for others without your consent.
  • Disclosure/labeling. Where feasible, animated outputs may include provenance signals or disclosure that content is AI-generated.
  • Your rights & choices. You can delete stored animated headshots/scenes you created in the product. If you shared an asset externally (e.g., posted to a third-party platform), deletion on Arena will not delete copies held by others or third parties.
  • Retention. Source media you keep in your account persists until you delete it or your account is closed. Short-term render caches and previews may be retained for up to [30 days] to improve performance, troubleshoot failures, and prevent abuse, after which they are deleted or de-identified.
  • Minors/third-party likeness. You must have the legal right and consent to upload images or voices of other people. Do not upload minors’ images without verified parental consent. We may disable content and/or accounts for violations.
  • Disclosure (biometric scope). Voice-related biometric data may be processed by tightly scoped service providers under contract (e.g., hosting/model-ops).
  • Consent. Where required, we obtain explicit consent (see Creator onboarding/consent forms) before collecting or processing biometric data.
  • Retention (biometric). We retain biometric data for as long as needed to provide the Services to you or as required by law. For Illinois residents, biometric data will be retained until the earlier of: (i) the purpose of collection is satisfied; or (ii) three (3) years after your last interaction with Arena, after which it is permanently deleted.

8) Cookies, Tracking, and Interest-Based Advertising

We use cookies and similar technologies (pixels, web beacons, local storage) to recognize your browser; operate, secure, and improve the Services; and measure or personalize ads where permitted.

Types of cookies

  • Essential: required for the Services to function (authentication, security)
  • Functional: remember preferences (e.g., language)
  • Analytics/Performance: understand usage and improve Services
  • Advertising/Retargeting: deliver and measure ads based on interests

Choices. Manage cookies in your browser and via Cookie Settings at the bottom of our site: [Insert Cookie Settings Link]. Disabling certain cookies may impact features. The Services do not respond to “Do Not Track” signals at this time.

Interest-based ads. We and our partners may collect data across websites and online services over time to deliver more relevant ads. Use Cookie Settings or industry tools (e.g., NAI/DAA opt-outs) for more choices.

9) Data Security

We use administrative, technical, and organizational safeguards appropriate to the types of Personal Data we process, including encryption in transit and at rest, signed URL access for media, least-privilege access controls, and audit logging. No method is 100% secure; you are responsible for protecting your credentials and devices.

10) Data Retention

We retain Personal Data for as long as necessary to provide the Services and for legitimate business purposes (e.g., legal, accounting, security), then delete or de-identify it. Examples:

  • Account data, for the life of your account
  • Payment records, as required for transactions, audits, and law
  • Logs/Device data, for security and operations on a rolling basis
  • Biometric data (Creators), see Section 7
  • Render caches/previews, up to [30 days] (see Section 7)

11) Children’s Privacy

We do not knowingly collect Personal Data from children under 13 (or under 16 in the EU/UK). If you believe a child has provided Personal Data, contact [legal@myavatar.ai] and we will delete it promptly.

12) U.S. State Privacy Notices & Rights

Depending on your state (e.g., CA, CO, CT, MT, OR, TX, UT, VA), you may have rights to access, delete, correct, port, or opt out of certain processing (e.g., targeted advertising, sales/sharing). Some rights are subject to limitations and verification.

Sales/Sharing via cookies. We do not “sell” Personal Data for money, but certain third-party advertising cookies/pixels may constitute a “sale” or “share” under state laws. You can opt out via Cookie Settings or by emailing [legal@myavatar.ai]. We will honor opt-outs for at least 12 months.

How to exercise U.S. state rights. Email [legal@myavatar.ai] with your request (access/delete/correct/portability/opt-out). We may need to verify your identity. You may authorize an agent (proof required). If we decline, you may appeal by replying; we will explain our decision and your options.

California notices. “Shine the Light” requests: [legal@myavatar.ai]. Our Services do not respond to “Do Not Track” signals.

13) Washington (U.S.) Consumer Health Data Privacy

“Consumer Health Data” includes personal information linked or reasonably linkable to a consumer’s physical or mental health status. We do not seek such data from general users. Creators may provide biometric/voice data to create avatars. If you choose to share health information in chats, that data may be processed to operate the Services and, if you engage a Creator, may be accessible to that Creator.

Rights (WA residents): access, deletion, withdrawal of consent, and appeal. Submit requests to [legal@myavatar.ai]. We disclose Consumer Health Data only to service providers under contract and (if you choose) to Creators you interact with.

14) EU/UK GDPR Notice

Controller/Processor. Arena is a controller for most processing described here. When we process on behalf of a Creator (e.g., operating their avatar or rendering outputs for their audience), Arena is a processor under the DPA.

Legal bases. Contractual necessity; legitimate interests (e.g., security/quality/analytics balanced against your rights); consent (e.g., certain cookies/marketing; biometric/likeness features); legal obligations.

Your GDPR rights. Access; rectification; erasure; restriction; portability; objection (including to direct marketing); and withdrawal of consent (where applicable). To exercise, email [legal@myavatar.ai]. You may lodge a complaint with your supervisory authority.

International transfers. Your data may be transferred to the U.S. and other countries. Where required, we use safeguards (e.g., Standard Contractual Clauses). Contact us for details.

EU/UK contacts. • Data Protection Officer (DPO): [legal@myavatar.ai] (or [legal@myavatar.ai]) • EU Representative (Art. 27 GDPR): [Insert EU Rep details] • UK Representative: [Insert UK Rep details]

15) Brazil (LGPD) Notice

For individuals in Brazil, LGPD may grant rights including confirmation of processing, access, correction, anonymization/blocking/deletion of unnecessary or excessive data, portability, deletion of consent-based data, information about sharing and the consequences of refusing consent, and withdrawal of consent.

Controlador/Operador. Arena generally acts as Controlador for platform operations, and as Operador when processing on behalf of a Creator under the DPA.

Bases legais. Execução de contrato, interesses legítimos (ponderados), obrigações legais/regulatórias e consentimento (p.ex., certas cookies/biometria/likeness).

Como exercer seus direitos. Email [legal@myavatar.ai] (Assunto: “Direitos LGPD”). Você também pode contatar a ANPD.

Encarregado (DPO, LGPD): [legal@myavatar.ai] (ou [legal@myavatar.ai])

16) Your Choices & Controls

  • Emails/Marketing: Opt out via the link in emails or by contacting [legal@myavatar.ai]
  • Cookies/Ads: Use Cookie Settings and your browser controls; see Section 8
  • Creator Interactions: Avoid sharing sensitive information in chats unless you want the Creator to have it
  • Biometric & Likeness (Creators): You may decline or withdraw consent (where applicable) to biometric/likeness processing; doing so may disable cloning and some animation features
  • Media Deletion: Delete stored animated headshots/scenes from your library at any time; external shares are not controlled by Arena

17) International Users

The Services are hosted in the United States. By using the Services, you understand your data may be transferred, stored, and processed in the U.S. or other countries. We apply appropriate safeguards for international transfers as required by law.

18) Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

19) Contact Us

Questions or requests about this Policy or your data rights: [legal@myavatar.ai]. Data protection officer inquiries: [legal@myavatar.ai] (or [legal@myavatar.ai]). Postal: [Company Legal Name], [Street Address], [City, State ZIP], USA.

20) Print/Download

You may print or save a copy of this Privacy Policy for your records.