Draft
This document is not yet in force. It will apply from Ojelio's public launch.
Privacy Policy
Version of October 6, 2026
This Privacy Policy explains how Udooku LLC handles personal data when you use Ojelio (ojelio.com). It is written for the people who use Ojelio in Brazil, the United States and elsewhere, and follows Brazil's General Data Protection Law (LGPD), the EU and UK General Data Protection Regulation (GDPR) where it applies, and the laws of California.
1. Who we are
- Controller: Udooku LLC, 453 S Spring St Ste 400, Los Angeles, CA 90013, United States.
- Contact for privacy: privacy@ojelio.com.
- Data protection officer (encarregado, under the LGPD): 5lobos Marketing e Propaganda Ltda, reachable at privacy@ojelio.com.
When a company or organization uses Ojelio for its workspace and puts other people's personal data in its content, that organization decides why the data is used, and we process it on its behalf.
2. What we collect
You give us:
- Account: your name, email address, password (stored only as a secure hash), interface language, and the version and time of the Terms you accepted.
- Workspace: its name and handle, its brand kit, its members and their roles, and the email addresses of people invited.
- Content: titles, text, links and the pages imported from them, pictures, uploaded images and music, descriptions of styles and characters, script edits, and the statements of rights you make with them.
- Messages you send us.
Ojelio creates:
- Videos and their parts: scripts, voice tracks, images and the finished videos.
- Payment records: plan, credit purchases and amounts, and the Stripe customer and subscription identifiers. Your card details are entered on Stripe's page and never reach us.
- Credit records: how credits were granted, set aside and used.
- Screening records: for each check of your content, the decision, the categories found and a short reason (see the Acceptable Use Policy).
- Audit records: who created, changed or deleted videos, styles, characters, music, workspaces, members and payments, and when, with names and titles as they were. They are kept after the items themselves are deleted.
Collected automatically:
- Access data: the IP address and browser of each session, and the date and time of access.
- Security data: counters for rate limits, keyed by a one-way hash of your IP address or email address, and the result of the Cloudflare Turnstile check, which looks at signals from your browser to tell people from bots.
- Cookies: only what Ojelio needs to work: the login session and your language. We use no advertising or analytics cookies and do not track you across other sites. Payment pages are Stripe's, under Stripe's own policy.
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Provide Ojelio: accounts, workspaces, making and storing videos | account, workspace, content, videos | performance of the contract (LGPD art. 7, V; GDPR art. 6(1)(b)) |
| Payments, credits, invoices and tax records | payment and credit records | contract and legal obligation (LGPD art. 7, II and V; GDPR art. 6(1)(b) and (c)) |
| Screen content against our policies and prevent abuse | content, screening records | legitimate interest in a safe service and legal obligation (LGPD art. 7, II and IX; GDPR art. 6(1)(c) and (f)) |
| Security: rate limits, bot checks, audit records, access records | security, audit and access data | legal obligation (Marco Civil da Internet, art. 15) and legitimate interest (LGPD art. 7, II and IX; GDPR art. 6(1)(c) and (f)) |
| Emails about your account, workspace, invitations and payments | email address | performance of the contract |
| Answer your messages and requests | messages | performance of the contract or legitimate interest |
| Defend legal claims | the records needed | exercise of rights in proceedings (LGPD art. 7, VI; GDPR art. 6(1)(f)) |
We do not sell personal data, do not share it for advertising, and do not use your content to train AI models.
4. AI processing and automated decisions
- To make a video, your content is sent to AI providers that write the script, synthesize the voice and draw the images, as listed in section 5. They process it to give us the result. Anthropic's commercial terms forbid it to train models on our content, and our voice provider's training on our content is switched off. fal.ai uses our content only to provide its service, though it may use anonymized or aggregated data derived from it to improve its services.
- Screening is automated: an AI model reads your content and may refuse it, and three refusals within 24 hours pause video creation for 24 hours. You can ask for a person to review a refusal, and for an explanation of the criteria, at privacy@ojelio.com (LGPD art. 20; GDPR art. 22).
5. Who we share it with
Service providers that process data for us, under contracts that protect it:
| Provider | What for | Where |
|---|---|---|
| Anthropic | writing scripts and screening content (AI) | United States |
| A voice synthesis provider | narration (AI) | United States |
| fal.ai | images and image tests (AI) | United States |
| Cloudflare | file storage, security, bot checks (Turnstile), network | global |
| Vercel | hosting the website | United States |
| Neon | database | United States |
| Amazon Web Services | rendering videos | United States |
| Trigger.dev | running video jobs | United Kingdom (company); United States (where jobs run) |
| Stripe | payments | United States |
| Mailgun | sending email | United States |
| fonts on the brand kit page and in rendering, which receive your IP address when loaded | United States | |
| Bunny.net | video streaming, when public video pages launch | European Union |
Others:
- Your workspace: its owner, admins and members see the workspace's videos and content; owners and admins see members' personal styles and the workspace's records.
- The public: videos made public (on the Free plan, or by your choice on a paid plan) can be seen by anyone, with the workspace's name.
- Authorities, when the law requires it, including reports of child sexual abuse material.
- A buyer or successor of Ojelio, under this Policy.
6. International transfers
Ojelio is run from the United States, and most providers process data there. People in Brazil: Ojelio collects your data directly from you, to provide its service from the United States; under the ANPD's Resolution 19/2024, collection made directly by a processing agent abroad is not an international transfer. Our providers process it under contracts that bind them to protect it. People in the EU and UK: where the GDPR applies, transfers to our providers rely on the European Commission's standard contractual clauses in their data processing terms, or on the EU-US Data Privacy Framework where the provider is certified.
7. How long we keep it
| Data | Kept |
|---|---|
| Account, workspace, content and videos | while the account or workspace exists; deleted within 30 days after it is closed or deleted |
| Access data (IP address, date and time of access) | 6 months, as the Marco Civil da Internet requires (art. 15) |
| Payment and credit records | 5 years after the payment, for tax and accounting |
| Screening records and audit records | 5 years, then deleted |
| Content refused as possible child sexual abuse material | 1 year, as US law requires (18 U.S.C. § 2258A), apart from the account, then deleted |
| Rate-limit counters | until their time window ends (at most one day) |
| Backups | overwritten within 30 days |
We may keep data longer when the law requires it or to defend a legal claim.
8. Your rights
You can ask us, at privacy@ojelio.com, to:
- confirm whether we process your data, and give you access to it;
- correct incomplete, inaccurate or outdated data;
- anonymize, block or delete data that is unnecessary, excessive or processed unlawfully;
- give you your data in a portable format;
- delete data processed on the basis of consent, and know with whom we share data;
- object to processing based on legitimate interest, or restrict it;
- review automated decisions, as in section 4.
In Brazil these are your rights under article 18 of the LGPD; in the EU and UK, under articles 15 to 22 of the GDPR. We answer within 15 days (and within one month for GDPR requests), and we may need to confirm your identity. You may also complain to the ANPD (Brazil) or to the data protection authority where you live.
California residents may ask what personal information we collect, use and disclose, and to delete or correct it, and will not be treated differently for asking. We do not sell or share personal information as California law defines those terms. Ojelio does not track you across sites, so browser "Do Not Track" signals do not change anything here.
9. Security
We use encrypted connections, store passwords only as secure hashes, keep files in private storage reached only through short-lived signed links, limit access to personal data to those who need it, and keep audit records. No system is perfectly secure; if a security incident is likely to put you at risk, we will tell you and the authorities as the law requires.
10. Children
Ojelio is not for people under 18, and we do not knowingly collect their data. If you believe a minor has given us data, write to privacy@ojelio.com and we will delete it.
11. Changes
We may update this Policy. The version and date are at the top of this page. If a change is material, we will tell you in the app or by email before it applies.
12. Contact
Udooku LLC — 453 S Spring St Ste 400, Los Angeles, CA 90013, United States — privacy@ojelio.com