Privacy Policy
Last updated: September 30, 2026
We respect your privacy and only collect what we need to run the Service. This policy explains what we collect, why, who else sees it, and what rights you have.
1. What we collect
Account: your email address (required), and a name and profile details if you choose to add them. Content: the prompts you write, the reference images you upload, the images you generate, the API keys you create, and your token transactions. Technical: IP address (for rate limiting and abuse prevention), browser user-agent, and cookies for your session and language.
2. How and why we use it
To provide the Service under our contract with you: sign you in, run generations, keep your token balance, deliver your files. For our legitimate interest in keeping the Service safe: automatic checks of prompts and reference images for prohibited content, rate limiting, fraud prevention. With your consent: optional email notifications, which you can switch off in settings. To meet legal obligations. We don't sell your data and we don't use your prompts, references or images to train AI models.
3. Who else processes your data
We use these processors: AI image-generation and image-processing providers (they receive your prompts and reference images to produce your result), Cloudflare (file storage and content delivery), our own database servers (account data), ahaSend (transactional email), Google (only if you sign in with Google), and Dodo Payments (payments). Each receives only what it needs for its function. Some of them process data outside your country, including in the United States; where required, transfers are covered by standard contractual clauses. Payment cards: your card details are entered on Dodo Payments' secure checkout and are never sent to or stored by us. We receive only the billing events needed to add tokens to your balance.
4. Cookies
Only strictly necessary cookies: your session (vxl_session) and your language (vxl_locale). No analytics or advertising cookies and no tracking pixels.
5. Who can see your images
Your generations are private to your account. Full-size files are stored privately and delivered only to you; small previews are served from a public content network. Assets published under earlier versions of the Service are visible to anyone and may be indexed by search engines, together with their prompt. Don't put private information in prompts or reference images.
6. Your rights
You can ask to access, correct, export or delete your data, and to restrict or object to its processing. Email [email protected] from your registered address; we reply within 30 days. Deletion can't be undone. If you live in the EU or UK, you may also complain to your data-protection authority.
7. How long we keep it
Reference images uploaded on the site: deleted when the generation finishes. Reference images uploaded through the API: deleted after 24 hours. Account data and your images: while your account exists, plus 30 days after deletion. Technical logs: 90 days. Payment records: kept by Dodo Payments for as long as the law requires.
8. Security
HTTPS only. API keys are stored as SHA-256 hashes, so we can't see a key after it is created. Backups are encrypted at rest. Access is limited to what is needed to run the Service.
9. Children
The Service is for adults. It is not directed at anyone under 18, and we delete data we learn was collected from a minor.
10. Changes
We may update this policy. Material changes are announced at least 14 days in advance by email and in the app.
11. Contact
Privacy questions or data requests: [email protected].