Privacy Policy

• Account data: name, email, hashed password, plan, billing status.
• Billing data: handled by our payment processor (Stripe / Paddle); we store only the last four digits of the card and the invoice history.
• Customer Content: photos and prompts you upload, and the Outputs generated on your behalf.
• Usage & device data: log data, IP address, browser, pages visited, generation counts, error diagnostics.
• Cookies: strictly necessary session cookies and, with your consent, analytics cookies.

• Provide, operate, secure and improve the Service.
• Process payments and manage subscriptions.
• Respond to support requests and legal obligations.
• Send transactional and, with consent, marketing communications.
• Detect abuse, fraud and violations of our Acceptable Use Policy.

We do not sell your personal data and we do not use your Customer Content to train foundation AI models.

We process personal data under the following legal bases: (a) performance of a contract (delivering the Service you subscribed to); (b) legitimate interests (security, fraud prevention, product improvement); (c) consent (marketing, non-essential cookies); and (d) compliance with legal obligations (tax, accounting).

We share personal data with vetted subprocessors strictly to run the Service:

• Cloud hosting & database (Supabase / Cloudflare)
• AI model providers (image generation gateway)
• Payment processing (Stripe, Paddle)
• Email delivery (transactional providers)
• Analytics (privacy-preserving, aggregate)

All subprocessors are bound by data processing agreements with appropriate technical and organizational safeguards. International transfers rely on Standard Contractual Clauses.

Account and billing records are retained for the life of your account and up to 7 years after closure to satisfy tax and accounting obligations. Customer Content is retained while your project exists and is deleted within 30 days after project deletion or account closure, whichever comes first. Backups are rotated within 90 days.

Depending on your jurisdiction (GDPR, UK GDPR, CCPA/CPRA, LGPD, etc.), you have the right to access, correct, port, delete, restrict, or object to processing of your personal data, and to withdraw consent at any time. To exercise these rights, email privacy@vyxorastudios.online. You also have the right to lodge a complaint with your local supervisory authority.

We use industry-standard measures including TLS in transit, encryption at rest, row-level security on the database, principle-of-least-privilege access, and continuous monitoring. No system is 100% secure — please report suspected issues to security@vyxorastudios.online.

The Service is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us with data, contact us and we will delete it.

We may update this Policy from time to time. Material changes will be notified by email or in-product notice at least 14 days before taking effect.