Privacy at Vivi.Kids
Short version: you can make a story without uploading any photo. If you do upload one, it draws one cartoon character and is then deleted. It is never used to train anyone's AI and never sold. Our AI provider is Google, and only Google.
What we do with AI, in one paragraph
Vivi writes and draws the story with Google's AI. A short form you fill in — the child's first name, age, communication level, interests, and the situation you are working on — is sent to Google's Gemini models, which write the story, draw the pictures, read it aloud and animate it. You read every page and can change anything before a child sees it. We use no other AI company.
If you upload a photo
- The photo is used once, to draw the child's cartoon character. Every later illustration is drawn from that cartoon, not from the photo.
- We delete the photo as soon as you approve the character. If you never finish, it is deleted within a week. The character, the profile and the stories stay. If you later want the character drawn again, you upload a photo again, because we no longer have the first one.
- The photo is sent to Google's image model for that drawing, and to Google's text model to describe hair, eyes and clothing. The child's name is never sent with the photo.
- We use Google's paid API. Google's terms for paid use state that Google does not use your prompts or images to improve its products. Google keeps a short-lived log for abuse detection only.
- While it is with us the photo is in private storage in the Netherlands, never on a public web address; the app shows it through a link that expires after 24 hours.
- We do not put photos in advertising, we do not sell them, and no child's data of any kind is used for advertising.
If you would rather not upload a photo
Choose “describe in words” when you create the child's profile. You pick hair, skin, eyes and clothing from a list, and no image ever leaves your account. The stories look the same. For many schools this is the shortest path to a yes.
What we keep, and for how long
| What | Where | How long |
|---|---|---|
| Child's first name, age, communication level, interests | Our database | While the account is active |
| Uploaded photo | Private storage, Netherlands | Until the character is approved, or one week if you never finish |
| Cartoon character and finished stories | Private storage, Netherlands | While the account is active |
| What we send Google | Google's servers | Short-lived abuse log only; not used for training |
Deleting. Deleting a photo, or a child's profile, inside the app removes the stored file too. You can delete your whole account from your profile page: that removes the children's profiles, the photos, the stories and the stored files, within 30 days and including backups as they expire. You can also email roy@vivi.kids and ask us to delete a single child.
For schools and districts
- FERPA. When a school or district uses Vivi, the child's photo and profile are education records. We act as a school official with a legitimate educational interest, under the direct control of the school. We do not own the data, we do not use it for anything except producing the stories you asked for, and we return or destroy it when the school asks.
- COPPA. Children do not create accounts and do not use Vivi directly. Adults — a parent, or a therapist or teacher who has the parent's written permission — enter everything.
- SOPIPA and the state laws modelled on it. No targeted advertising, no advertising profiles, no sale of student information, no use of student data for any non-educational purpose, reasonable security, and deletion on the school's request.
- Who else touches the data: Google (the AI, and sign-in), DigitalOcean (servers, file storage and our own session recordings, all in the Netherlands; recordings are deleted after 3 days and everything typed is masked), Resend (our emails), Polar (payments — card details never reach us), Sentry (error reports, configured without personal information).
- A data privacy agreement. We will sign a district's agreement. Email roy@vivi.kids and say which form your district uses.
What we are not
We are not a HIPAA business associate. Google does not offer a business associate agreement on the AI service we use, so we cannot offer one either, and we will not pretend otherwise. If your employer's rules say a child's photo is protected health information, use the “describe in words” path, or ask your compliance team first. ASHA's own guidance is to assume an AI tool is not HIPAA compliant until your facility has vetted it. That is the right instinct; this page exists so your facility has something to vet.
On this website
This website (vivi.kids) uses Google Analytics, through Google Tag Manager, to count visits and see which pages are useful, and the Reddit pixel to measure whether our Reddit ads bring visitors. They use cookies and receive your IP address, browser type and the pages you view here. They never receive anything you enter in the app, or anything about your child. You can block them in your browser settings or with an ad blocker.
The full policy
The detailed policy, including your rights under GDPR and US state privacy laws, is at app.vivi.kids/privacy. Questions: roy@vivi.kids, Vivikids, Inc., 1111B S Governors Ave #95776, Dover, DE 19904, United States.
Last updated: October 19, 2026