Privacy Policy
Last Updated: August 2026
Welcome to LightVela! This Privacy Policy explains the when, how, and why when it comes to the processing of your personal information in connection with the LightVela website and service (together, the “Service”), and sets out your choices and rights in relation to that information.
For the purposes of data protection laws, the data controller of your personal information in relation to the Service is Tencent Cloud International Pte. Ltd. (“we”, “us”, “our”).
Please note that this Privacy Policy only applies to the Service. If you use any other products or services, please refer to the privacy policy for that particular product or service.
If you do not agree to the processing of your personal information in the way this Privacy Policy describes, please do not provide your information when requested and stop using the Service. By using the Service you are acknowledging how we process your personal information as described in this Privacy Policy and, to the extent performance of a contract or legitimate interest cannot be relied upon in your jurisdiction to process the personal information, you consent to the processing of your personal information as described in this Privacy Policy.
If you have any questions about anything in this Privacy Policy, or want to exercise any rights you may have, our contact information can be found in Section 7 (Contact) below.
1. Children
Those under 18 years old are not permitted to use the Service for any purpose.
We do not seek or knowingly collect personal information from children under 18 for any purpose. If you believe that we have personal information of anyone under the age of 18, or if you are the parent or guardian of the user and wish to notify us that a user is under 18 years old, please contact us as set out in Section 7 (Contact) below.
2. How We Process Your Personal Information
This section provides more detail on the types of personal information we collect from you, and why.
It also identifies the legal basis under which we process your data to the extent required by the data protection laws in your jurisdiction. To the extent the laws in your jurisdiction do not recognise the legal basis of performance of a contract or legitimate interest, you consent to the processing of your personal information for that purpose by consenting to the processing in this Privacy Policy.
| Personal Information | Use | Legal Basis (where applicable) |
|---|---|---|
| Information you provide to us (either directly or through a third party) | ||
| Login and account information, and security credential information such as your email address, username/nickname, third-party login identifiers, IP address, oAuth token, session token, account status, and user IDs. | We use this information to create, authenticate, and manage your account for the Service, and operate and provide the Service to you. | Necessary to perform our contract with you to provide the Service. |
Inputs and Outputs: User prompts and instructions provided in your chat, coding, memory, and agentic sessions, and the responses and actions generated. When using Messaging Channels and AgentChat, we also process message relay data, such as timestamps, channel identifiers, and sender identifiers. If you choose to integrate third-party applications, or upload any files and information, including personal information, as part of your Inputs, we will collect this information and this information may be reproduced in Outputs. | We use this information to process your Inputs and provide you with Outputs in accordance with your instructions. We use this information to relay your messages between Messaging Channels and AgentChat and the Service to provide you with the Service. We also use this information to investigate and resolve any security issues and to perform security checks to ensure there are no security risks. | Necessary to perform our contract with you to provide the Service. It is also in our legitimate interests to safeguard your data and our systems. |
Payment information: If you choose to purchase access to the Service, we will process payment information such as payment order number, payment transaction serial number, payment amount, payment timestamp, payment channel, payment status returned by the payment processor, payment method metadata, and the last four digits of the credit card provided by the payment processor. Our third-party payment providers (e.g. credit card issuing banks) process related data on our behalf. | We use this information to manage billing and payments for the Service. | Necessary to perform our contract with you to provide the Service. |
| Communication information: If you communicate with us or we provide announcements, we process information such as your name, contact information and the content of the communication that you send. | We use this information to communicate with you regarding issues you raise. We may from time to time send you announcements when we consider it necessary to do so (for example, when we temporarily suspend access to the Service for maintenance, or security, privacy, or administrative-related communications). These are essential system and service-related announcements and you are not able to opt out of these notifications, which are not promotional in nature. | Necessary to perform our contract with you to provide the Service. |
| Feedback information: If you choose to provide feedback and suggestions for improvement, or ratings on an Output, through the application or on our Discord server, we will store the related conversation as part of your feedback. | We use this information to resolve any issues you may face, debug and repair any problems, and to improve the Services and conduct research. | We process this information with your consent. It is also in our legitimate interests to maintain the functioning of our Services, diagnose errors, and to further improve and develop the Services. |
| Information generated as part of the Service | ||
| Device information such as device identifiers, types, models, operating system information, IP addresses, network and connection information, remote control session information, and plugin information. | We use this information to:
| Necessary to perform our contract with you. It is also in our legitimate interests to maintain the functioning of our Services and diagnose errors. |
| Configuration information: We process information about how hardware, software and network components operate and interact, such as system and infrastructure configuration information, and Messaging Channel authorisation and configuration data and metadata. | We use this information to maintain your configuration settings of the Service and to provide you with the Service. | Necessary to perform our contract with you to provide the Service. |
| Diagnostic and usage information, and log information: We process information about your use of the Services, such as your dates and times of login, access, and search, IP address, runtime environment information, network and security information, deployment and error logs, application and performance metrics and codes, and integrations, and other information on how you use the Services. | We use this information to:
| It is in our legitimate interest to monitor system performance, diagnose errors, and improve the product. |
| Billing and consumption information: We process information relating to billing, such as cardholder name and contact information, transaction amounts and timestamps, order numbers, and purchased services and features. | We use this information to manage billing and payments for the Service. | Necessary to perform our contract with you to provide the Service. |
| Compliance records: Consent and withdrawal records, data deletion and export request records, and any other personal information required to be retained or disclosed pursuant to applicable laws, regulations, court orders, or government requests. | We use this information to comply with applicable legal obligations, respond to regulatory requests, and fulfil data subject rights. | We process this information to fulfil our legal obligations. |
| Other information we have about you: such as device identifiers, device information, IP address, information about use of the Service, Inputs and Outputs and plugin data. | We use this information to ensure the security of our services, including aggregating and anonymising the information for that purpose. | It is in our legitimate interest to ensure the security of our Service or our services. |
| We use this information to improve our services, including aggregating and anonymising the information for that purpose. | It is in our legitimate interest to improve the Service or our services. | |
3. How We Store and Share Your Personal Information
Your personal information will be stored in servers in Singapore. We also have global support, engineering, and other teams who support the Service, including from Singapore and the People’s Republic of China.
We will transfer data outside of the jurisdiction in which you are based for the purposes described in this Privacy Policy. When we do so, we will take steps to ensure that your personal information is protected and we implement safeguards where required. Safeguards include standard contractual clauses, adequacy decisions where available, data processing agreements with all third-party data processors, and other contractual safeguards. You may contact us via the details in Section 7 (Contact) to see a copy of these safeguards.
We will share your personal information with third parties in the following situations:
- Third parties that provide services in support of the Service, including providers of services that process personal information identified in this policy in our legitimate interests of efficiently providing the Service. For example, we will transfer your personal information to:
- payment processors that process payment instruction data for payment of the Service.
- Third party websites and services: You may choose to integrate the Service with various third-party websites, apps and services (e.g. through API keys), such as LLM providers, third party service providers for Skills, and Messaging Channels. If you choose to do so, we will share your personal information with these third-party websites, apps and services in accordance with your instruction. Processing once transferred to such third party websites and services shall be subject to the third party’s privacy policy. Any link to such services and sites does not mean that we endorse such third party.
- Companies within our corporate group who process your personal information in our legitimate interests to help efficiently provide the Service. All such group companies may only use your personal information in accordance with this Privacy Policy.
- Regulators, judicial authorities, and law enforcement agencies. There are circumstances in which we may be legally required to disclose personal information about you, such as to comply with legal obligations or processes. We may also disclose personal information to regulators, judicial authorities, and law enforcement agencies to ensure safety, security, or compliance with laws.
- Third parties to ensure safety, security, or compliance with laws. We may disclose your personal information to: (a) enforce our terms and conditions and other agreements, including investigation of any potential violation thereof; (b) detect, prevent, or otherwise address security, fraud, or technical issues; or (c) protect the rights, property, or safety of us, our users, a third party, or the public as required or permitted by law.
- Professional advisors. We may disclose your personal information to auditors, law firms, or accounting firms, as a matter of our legitimate interests to assess, protect, enforce and defend our rights and to comply with our legal and regulatory obligations.
- A third party that acquires all or substantially all of us or our business. We may also disclose your personal information to third parties if we either: (a) sell, transfer, merge, consolidate, or reorganize any part(s) of our business, or merge with, acquire, or form a joint venture with any other business, in which case we may disclose your data to any prospective buyer, new owner, or other third party involved in such change to our business; or (b) sell or transfer any of our assets, in which case the personal information we hold about you may be sold as part of those assets and may be transferred to any prospective buyer, new owner, or other third party involved in such sale or transfer.
4. The Security of Your Personal Information
We have information security and access policies regarding access to our systems and technology, and we protect personal information using appropriate technological protection measures such as encryption, hashing, role-based access controls, and audit logs of data access.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will implement and maintain reasonable measures to protect your personal information, we cannot guarantee the security of information transmitted via the internet; any transmission is at your own risk.
5. Data Retention
To execute your instructions and provide you with the Service, we will store relevant personal information on our own servers, as set out in the table below.
Please note that we do not keep your data for longer than is necessary to fulfil the relevant purpose described above unless we are required or permitted to do so under law. If we retain your personal information beyond the retention periods set out below, for example to comply with applicable laws, we will store it separately from other types of personal information.
| Personal Information | Retention Policy |
|---|---|
Login and account information, and security credential information Inputs and Outputs | Stored for as long as you maintain an account with us and deleted within 30 days after, or within 30 days if you request for deletion, whichever is earlier. |
| Device information | Stored for as long as you maintain an account with us and deleted within 30 days after account termination, or within 30 days if you request for deletion, whichever is earlier. Device information for troubleshooting is retained for as long as necessary for support and no longer than 30 days after you stop maintaining an account with us. |
| Configuration information | Stored for as long as you maintain an account with us and deleted within 30 days upon your request for deletion. |
| Diagnostic and usage data, and log information | Stored for up to 6 months. |
Payment information Billing and consumption information | Stored for up to 24 months after the termination of your account for financial/tax compliance. |
| Compliance records | As required by applicable law. |
| Communication information | Until resolution of the issue that you are communicating with us about. |
| Feedback information | Stored for up to 24 months after submission or account termination. |
6. Your Rights
We offer our users the following rights in respect of your personal information, which you may have a legal right to exercise depending on where you are. Some of these only apply in certain circumstances, and we will let you know if that is the case when you request the exercise of the right. You can exercise some of these rights directly by accessing and updating the personal information in your account. Otherwise, please contact us using the details in Section 7 (Contact) below.
- Access. You may have the right to access personal information we hold about you, how we use it, and who we share it with.
- Portability. You may have the right to receive a copy of certain personal information we process about you.
- Correction. You may have the right to correct personal information we hold that is inaccurate.
- Erasure. You may be able to delete your account or remove certain personal information by logging into your account or requesting erasure from us.
- Restriction of Processing to Storage Only. You may have a right to require that we stop processing your personal information other than for storage purposes in certain circumstances.
- Objection. You may have the right to object to our processing of your personal information in certain situations.
- Consent Withdrawal. To the extent provided by applicable laws and regulations, you may withdraw consent you previously provided to us for certain processing activities by contacting us. Where consent is required to process your personal information, if you do not consent to the processing or if you withdraw your consent we may not be able to deliver the expected service. Please note that the right to withdraw consent is only available if the legal basis for processing information is consent.
- You also have the right to lodge a complaint directly with us, as well as with the relevant data protection authority in the country you live or work.
7. Contact
Please get in touch with us if you have any questions. You can reach us in the first instance at:
Email: lightvela@tencent.com
We will endeavour to deal with your request as soon as possible. This is without prejudice to any right you may have to launch a claim with a data protection authority in the jurisdiction in which you live or work where you think we have infringed data protection laws.
8. Third-Party Websites and Links
We may provide links or access to third-party websites, services and features as part of the Service. You may elect to connect to your chosen LLM through BYOK, connect to your preferred Messaging Channels, and/or download and install Skills.
If you follow links to sites or platforms or enable features that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Our inclusion of such links or access to such features does not, by itself, imply any endorsement of the content on such platforms, the operation of such features, or of their owners or operators.
9. Changes
If we make any changes to this Privacy Policy we will post the updated Privacy Policy here and notify you in accordance with relevant legal requirements.
10. Language
Except as otherwise prescribed by law, in the event of any discrepancy or inconsistency between the English version and local language version of this Privacy Policy, the English version shall prevail.