Privacy Policy

1. Who is responsible

Legal operator

SUPHERO LIMITED

Registered address

Suite 10377, 5 Brayford Square, London, E1 0SG, United Kingdom

Support & privacy contact

[email protected]

Company number

16943555

Registered in

England and Wales, United Kingdom

Applicable law / jurisdiction

[APPLICABLE U.S. STATE LAW / JURISDICTION]

The service operator identified above is the controller for personal data it handles through Vavo. This notice covers Vavo’s device-related data and this website. Independent media sources, app stores and payment services have their own privacy notices for processing that they control.

2. Device information

A device identifier may be personal data when it can be associated with a person. These identifiers are not permission to inspect your personal files. The confirmed application-data inventory does not include your playlist passwords, video files, viewing history, contacts or personal-media library.

3. Cookies and browser storage

Cookies and similar browser storage can support a requested function or save a preference. This website stores the language you select in local browser storage under “vavo.preferred-language”. It remains on that browser until you replace it, clear it or your browser removes it. It is not a media-viewing history.

You can clear site data or restrict cookies in your browser settings. Clearing a language preference resets that preference; restricting storage may affect functions that rely on it. Cookie rules also apply to comparable technologies such as local storage.

Where a storage purpose requires consent, we will explain it and request the consent required by law before enabling it. Optional tracking must have a separate choice. General acceptance of terms is not consent to optional cookies, and this notice does not classify every application cookie as essential.

4. Information you choose to send

If you contact support, request a licence review or send a privacy request, we handle the message and the reply details you choose to provide. This is separate from automatic device data. An enquiry may include a purchase reference, a device identifier or a description of a problem.

Please avoid sending media files, playlist passwords, full card details or unnecessary personal information. We use the information you send to handle the request and associated records, not as permission to inspect an unrelated media library.

5. Purposes and lawful bases

We use information for the purposes set out below. Where the EU General Data Protection Regulation or UK data-protection rules apply, the table also identifies the relevant lawful basis. U.S. and other applicable privacy laws may impose different or additional requirements; the table is not a claim that every jurisdiction uses the same legal-basis framework.

Each basis applies only where its conditions are met. A MAC address needed to validate a device licence is a contractual requirement for that function; without it, activation may not be possible. Optional choices must not be presented as compulsory. This notice is information about processing, not a blanket consent request.

6. Service providers and external services

Providers carrying out necessary work for Vavo may handle the relevant information for hosting, licence validation or support, subject to suitable confidentiality and data-protection arrangements. They should receive only the information needed for the relevant task. The provider and location information for the service is recorded below.

Where a payment service or app store handles a purchase, it independently processes the billing, transaction and security information necessary for that purchase under its own notice. Hosted payment fields do not disclose a full card number or security code to Vavo’s own server. This notice does not authorise Vavo to collect additional account or transaction-data categories without updating the relevant disclosure.

Opening a media URL, casting to another device or following an external link can involve a connection to that external operator. Its processing is governed by its own practices; adding a source does not make it part of Vavo.

Information may also be disclosed where required by a valid legal obligation or where necessary and lawful to establish, exercise or defend a legal claim. Any disclosure must be limited to what the relevant purpose requires.

7. How long information is kept

We keep device information while it is needed to maintain or verify the relevant device licence, handle a related issue or meet a specific legal requirement. Support information is retained while the enquiry and any necessary follow-up or dispute remain active. We delete or anonymise information that is no longer needed for those purposes.

A legal or accounting obligation may require a particular record to be kept longer. Only the information needed for that obligation is retained. Browser language storage remains under your browser’s control; application-cookie lifetimes are listed in the cookie table. We review retention rather than treating a lifetime licence as permission to keep every record indefinitely.

8. International processing

A provider may process information outside your country, as identified in the provider information above. Where UK or EEA rules apply to an international transfer, we will use an available lawful transfer mechanism and the safeguards that the applicable rules require, such as an adequacy decision or appropriate contractual safeguards where relevant.

You may ask the privacy contact for details of the processing location and the safeguard applicable to your information. Use of Vavo is not treated as consent to an unrestricted international transfer.

9. Security

We apply proportionate technical and organisational safeguards to device information and related records, including limiting access to people and providers who need it for a legitimate purpose. No online system is risk-free. A confirmed incident will be assessed and reported to the regulator or affected individuals where the law requires it.

Use a trusted device, install relevant security updates and keep external-media credentials private. Do not publish another person’s device identifier or send unnecessary sensitive information to support.

10. Your rights and choices

Your rights depend on your location, the law that applies to the processing and any relevant conditions or exceptions. They may include the following rights.

• Ask for access to personal data about you and for a copy where applicable.
• Ask us to correct inaccurate information.
• Request deletion or restricted processing where the legal conditions apply.
• Object to processing based on legitimate interests where applicable.
• Request portability where the relevant legal basis and conditions apply.
• Withdraw consent for consent-based processing without affecting prior lawful processing.
• Raise a complaint with the relevant data-protection authority.

Contact the privacy contact shown in the operator details. We may ask for proportionate information to verify the request and identify the relevant device record. We respond within the time required by applicable law and explain any lawful limitation or extension. Do not send an identity document unless it is necessary and a suitable channel has been agreed.

Where an applicable U.S. state privacy law covers the relevant processing, we will also handle any additional requests required by that law. For example, where the California Consumer Privacy Act applies, rights may include opting out of a sale of personal information or sharing for cross-context behavioural advertising, using an authorised agent and protection from unlawful discrimination for exercising privacy rights. These rights are subject to that law’s scope and conditions.

For an unresolved concern, you may contact the regulator with authority over the matter, such as the relevant U.S. state attorney general or privacy regulator. Where UK data-protection rules apply, the Information Commissioner’s Office is a relevant complaint authority; EU residents may contact the competent supervisory authority where applicable.

11. Household use and children

A device may be used by members of a household, including children under an adult’s supervision. The confirmed device-data inventory does not require a child’s name, contact list or personal-media history. If a parent or guardian believes unnecessary personal information about a child has been supplied, they can contact the privacy contact for review and any applicable correction or deletion.

A device identifier or cookie can be personal information under children’s privacy laws even without a child’s name. Where the U.S. Children’s Online Privacy Protection Act applies, we will follow its applicable notice, parental-consent, access, deletion and retention requirements, taking account of any permitted exception for the specific use. Adult supervision is not treated as a substitute for consent required by law.

12. Changes and contact

We will update this notice when the actual data practices change, including before introducing a new category, purpose or provider where prior notice is required. Material changes will be communicated in an appropriate way. The updated date identifies the version. Please use the privacy contact in the operator details for an enquiry or request.