Privacy Policy

1.1 Information you give us. When you use Vixlens you provide:

• account details — your name, email address and password (stored only as a secure hash by our authentication provider);
• the prompts, images, videos, audio and other files you submit for generation, and anything you add to collections;
• the email addresses of teammates you invite to a workspace;
• what you send us through the contact form or by email.

1.2 Information created when you use the Service. We record the media you generate; your generation history (model, settings, credit cost and status); credit purchases, grants and spending; your plan and subscription status; and technical data such as IP address, browser and device type, and server logs, which we need to run and secure the Service.

1.3 Information from third parties. If you sign in with Google, we receive your name, email address and profile picture from Google. If you connect a TikTok, Instagram, YouTube or Facebook account, we receive that account's identifier, name and the access tokens needed to publish on your behalf. Stripe tells us whether a payment succeeded and gives us your invoices; your full card details go to Stripe and never reach us.

1.4 Images of people. Files you upload may show people's faces or other likenesses. We process them only to produce the generation you asked for. We don't create facial templates or use them to identify anyone.

1.5 Cookies and local storage. We use only what is essential: cookies and browser storage that keep you signed in and remember preferences such as your interface settings. We don't use advertising cookies or third-party analytics trackers. Stripe sets its own cookies on its checkout pages to prevent fraud.

We use your information to:

• run your generations and deliver the results;
• store your gallery, collections and team workspaces, and publish or schedule posts to the accounts you connect;
• manage credits, subscriptions and invoices, and enforce plan limits;
• send you service emails — email verification, password resets, team invites, billing and important account notices — and product updates only if you have opted in;
• reply to your messages and support requests;
• keep the Service secure: prevent fraud and abuse (such as multiple accounts created to collect free credits), moderate content and enforce our Terms;
• understand aggregate usage, such as which models are used most, to improve the Service;
• comply with our legal obligations.

We do not use your content to train AI models, we do not sell your personal information, and we do not use it for targeted advertising.

3.1 AI model providers. To produce a generation, your prompt and any files you attach are sent to the provider that runs the chosen model — such as kie.ai or Cloudflare Workers AI, and the model developers behind them. They process it under their own terms to return your result.

3.2 Service providers. We rely on Supabase for authentication and our database, Cloudflare for file storage, and Stripe for payments. They process information on our behalf, only to provide their services to us.

3.3 Social platforms. When you publish or schedule a post, the media and caption you choose are sent to the platform you selected, where that platform's privacy policy applies.

3.4 Other users. Content you make public is visible to anyone in the community gallery; a shared collection link shows its contents to anyone who has the link; and content created in a team workspace is visible to that workspace's members.

3.5 Legal and safety reasons. We may disclose information when the law requires it, or when we believe in good faith that it is necessary to protect the rights, property or safety of our users, the public or Vixlens — for example, to report child sexual abuse material to the authorities.

3.6 Business transfers. If Vixlens is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction, and remains protected by this policy.

Generations are private by default. Marking one public makes it viewable in the community gallery; you can revert this at any time. Sharing a collection link makes its contents viewable by anyone with that link until you disable sharing.

5.1 While your account is open. We keep your account information and content for as long as your account is open. Deleting a generation removes it from your gallery; copies held by the model provider that produced it may persist for a period under that provider's own retention policy.

5.2 After your account is closed. We delete or anonymize your personal information within 30 days of your account being closed, except for copies in backups, which are overwritten on a rolling basis, and records we must keep by law — such as invoices and payment records, which we keep for as long as tax and accounting rules require.

5.3 Logs. Technical logs are kept for a short period for security and debugging, then deleted.

You can at any time:

• update your profile and change your password from Settings;
• create and revoke API keys;
• delete individual generations and collections, or make public content private again;
• disconnect social accounts, which also cancels anything still scheduled to them;
• update your payment method and download invoices from the billing portal;
• unsubscribe from product emails using the link in each one (service emails about your account will still be sent);
• clear or block cookies in your browser — although you will then be signed out.

To close your account and have your data deleted, contact us.

We protect your information with encryption in transit, hashed passwords, access controls and short-lived signed links for private media. No system is perfectly secure, though, and we can't guarantee that information will never be accessed without authorization. If a breach affects your personal information, we will notify you and the authorities as the law requires.

Our providers operate in the United States and other countries, so your information may be processed outside the country where you live, including in countries with different data-protection laws. When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision or on safeguards such as the European Commission's Standard Contractual Clauses.

Vixlens is not intended for anyone under 18, and we don't knowingly collect personal information from them. If you believe a minor has given us personal information, contact us and we will delete it.

The Service links to and integrates with services we don't control — such as Google, Stripe and the social platforms you connect. Their privacy policies, not this one, govern the information they collect.

11.1 Controller. Vixlens is the controller of the personal information described in this policy.

11.2 Legal bases. We process your personal information on these bases:

• Contract — to create your account, run generations, publish where you ask us to and manage your plan and payments.
• Legitimate interests — to secure the Service, prevent fraud and abuse, moderate content and understand aggregate usage, in ways that don't override your rights.
• Consent — to send product updates, which you can withdraw at any time.
• Legal obligation — to keep invoices and payment records and respond to lawful requests.

11.3 Your rights. You have the right to access your personal information, correct it, have it deleted, restrict or object to its processing, receive it in a portable format and withdraw consent at any time. You also have the right to complain to your local data-protection authority.

11.4 Automated decisions. We don't make decisions that have legal or similarly significant effects on you based solely on automated processing. Automated safety filters may block a generation; if you think one was blocked by mistake, you can ask us to review it.

Depending on the state where you live — including California — you may have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and to opt out of its sale or its sharing for targeted advertising. We don't sell personal information or share it for targeted advertising. We won't treat you differently for exercising your rights. You can make a request yourself or through an authorized agent; we may need to verify your identity before acting on it.

We may update this policy as the Service changes. If a change is material, we will tell you by email or in the app before it takes effect and update the date at the top of this page.

To exercise your rights or ask a question about this policy, reach us through the contact page. We respond to privacy requests within 30 days.