Virmii Privacy Policy

This Privacy Policy explains how Virmii ("Virmii," "we," "us") handles personal information when you visit virmii.com, sign in, create an avatar, use browser tracking, or contact us.

Virmii is an independently operated AI VTuber avatar studio. You can contact us at contact@virmii.com.

• Account information: profile details provided through Google sign-in, such as name, email address, profile image, and authentication identifiers.
• Creator content: avatar names, character descriptions, reference images, and the 3D, texture, rig, VRM, preview, and related files created by the service.
• Job and workspace information: generation stages, provider job identifiers, timestamps, errors, retries, live-stage settings, and asset metadata.
• Technical information: browser and device information, IP-derived request information, security events, and diagnostic logs made available by our hosting and infrastructure providers.
• Communications: information included when you contact support or submit a rights request.
• Billing information: product, customer, transaction, payment status, and related identifiers received from Creem. Payment card details are collected by Creem rather than Virmii.

Do not upload sensitive personal information that is not needed to create your avatar.

• Authenticate accounts and maintain creator workspaces.
• Upload references, generate models, standardize avatars, build VRM files, and provide downloads.
• Operate private avatar preview and OBS live-stage access.
• Secure the service, prevent abuse, investigate failures, and protect user assets.
• Provide support, respond to privacy requests, and communicate material service changes.
• Provide paid checkout and apply purchased credits.
• Understand aggregate product reliability and improve the generation workflow.

Camera access starts only after an explicit action in the Live Studio. Raw camera video is processed locally in your browser by default using MediaPipe and is not uploaded to Virmii's backend.

Movement and expression values may be sent from your controller browser to your private live stage through a WebRTC data connection. Convex is used for short-lived connection coordination; it does not relay raw camera frames or continuous tracking frames. You can stop camera access from the Live Studio or browser permissions at any time.

Virmii uses service providers to operate the product. Depending on the feature, information may be processed by:

• Google and Convex Auth for account authentication.
• Convex for application data, real-time state, and backend functions.
• Cloudflare R2 and Cloudflare infrastructure for private asset storage, delivery, and hosting.
• Tripo or another disclosed 3D generation provider to process the reference and generation request.
• Modal and controlled processing workers for model cleanup, rigging, facial processing, and VRM construction.
• Creem as merchant of record for checkout, payment processing, credit purchases, taxes, and related transaction records.

We may also disclose information when required by law, to protect rights and safety, during a business transfer, or with your direction. Virmii does not sell personal information for money.

To let the selected 3D generation provider retrieve a reference image, Virmii first places that image at a difficult-to-guess public Cloudflare R2 URL. The URL is not listed in the product, the response is marked not to be cached, and the temporary object is moved to private storage and deleted after the provider completes the first generation stage. Anyone who obtains the temporary URL while it is active may be able to view the image.

After that handoff, Virmii uses owner checks, private object storage, time-limited download links, restricted service credentials, and signed webhook validation to protect creator assets. No online service can guarantee absolute security.

Completed account and avatar data is generally retained while your account or asset remains active. Temporary uploads and failed, canceled, or abandoned jobs may be removed sooner. Some security, legal, backup, or transaction records may remain for a limited period after deletion where reasonably necessary.

Virmii and its providers may process information in countries other than your own. Where required, we use available contractual or provider safeguards for international transfers. Contact us if you need information relevant to your location.

You can stop camera access, disable or rotate live access, delete individual generation jobs where the control is available, and sign out at any time. Depending on your location, you may also have rights to access, correct, delete, export, restrict, or object to processing of personal information.

See Your Privacy Rights for request instructions. We do not discriminate against users for exercising applicable privacy rights.

Virmii is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided information without appropriate permission, contact us so we can review and remove it.

We may update this policy as Virmii's features, providers, or legal obligations change. The effective date at the top identifies the current version. Material changes will be communicated through the service or another reasonable channel.

Questions or privacy requests: contact@virmii.com.