Privacy Policy

1. Who We Are

Velpora Studio, located at —, is the controller of the personal information described in this policy (the entity that decides why and how it is processed). If you have any questions, contact privacy@velpora.shop.

2. Information We Collect

• Account information: email address, name or display name, login credentials (passwords are stored as salted hashes), and team member details if you use the Studio plan.
• Billing information: payments are handled directly by Stripe (and PayPal where offered). We do not receive or store your full card number; we receive only the last four digits, card brand, issuing country, billing history and subscription status.
• Content: the text you enter, the images and product materials you upload, and the titles, body copy, hashtags, images and videos the Service generates for you.
• Usage information: feature usage, credit consumption, generation request logs and error logs.
• Device and network information: IP address, browser type, operating system, language settings, access times and referring pages.
• Cookies and similar technologies: see our Cookie Policy.
• Communications: emails and attachments you send to our support team.

We do not knowingly collect sensitive data such as government ID numbers or health information. Please avoid including other people’s sensitive information in your inputs.

3. How We Use Information

• To create and manage your account, verify your identity and keep sign-in secure;
• To process your generation requests and store and display results in your workspace;
• To process payments, issue receipts, manage subscriptions and credits, and handle refunds;
• To send service messages such as receipts, cancellation confirmations, annual renewal reminders, security alerts and policy updates;
• To provide customer support and handle complaints and abuse reports;
• To detect and prevent fraud, abuse, security incidents and violations of our Acceptable Use Policy;
• With your consent, to run analytics that help us improve the product;
• To meet legal obligations, such as tax and accounting record-keeping.

We do not use your private content for public showcases or to train models unless you opt in.

4. Legal Bases for Processing

If you are in the European Economic Area, the UK or another region with similar requirements, we rely on the following legal bases:

• Contract: to provide the service you signed up for or purchased, and to process payments and subscriptions;
• Legitimate interests: to keep the Service secure, prevent fraud and abuse, and improve core functionality, where these interests are not overridden by your rights;
• Consent: for non-essential analytics cookies, marketing emails, and any use of your content for showcases or model training; you can withdraw consent at any time;
• Legal obligation: to keep billing and tax records and respond to lawful requests from authorities.

5. Sharing and Sub-processors

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only in these cases:

• Hosting and infrastructure: Vercel, for hosting the website and application;
• Payment processing: Stripe and PayPal, for payments, subscriptions and fraud prevention;
• AI model providers: to fulfil your generation requests, we send the necessary inputs to third-party AI model providers solely to return the generated results;
• Email delivery providers: to send account verification, receipts and notifications;
• Analytics providers: enabled only after you consent to analytics cookies;
• Legal requirements: to comply with the law or court orders, or to protect the rights and safety of us, our users and the public;
• Business transfers: in a merger, acquisition or asset sale, information may be transferred as part of the transaction, and we will require the recipient to honor this policy.

We sign data processing agreements with our service providers requiring them to process information only on our instructions, for the purposes above, and with appropriate security measures.

6. International Transfers

We and our service providers may process your information outside your country or region. When we transfer data internationally, we use the safeguards required by applicable law, such as the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or adequacy decisions.

7. How Long We Keep Information

• Account data and content: kept while your account is active, and deleted or anonymized within 30 days after you delete your account.
• Billing records: kept as required by law, typically 7 years.
• Logs: typically kept for 90 days for security and troubleshooting.
• Support correspondence: kept as needed after resolution for follow-up and dispute handling.

We may keep certain information longer where the law requires it or where it is needed to resolve a pending dispute.

8. Your Rights

Depending on the laws that apply where you live, you may have the right to:

• Access: find out what personal information we hold about you;
• Correction: correct inaccurate or incomplete information;
• Deletion: ask us to delete your personal information, or delete your account yourself in Account Settings;
• Export: receive your information in a commonly used, machine-readable format;
• Objection and restriction: object to or ask us to restrict certain processing;
• Withdraw consent: withdraw any consent you have given, without affecting the lawfulness of processing before withdrawal.

Send requests to privacy@velpora.shop. To protect your account, we may need to verify your identity. We respond within 30 days. You also have the right to complain to your local data protection authority.

9. California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) gives you the right to know, delete, correct and opt out of the sale or sharing of your personal information. We do not sell or share your personal information (as those terms are defined in the CCPA), and we will not discriminate against you for exercising your rights. Sections 2 to 7 above describe the categories of information we collect, their sources, purposes and recipients.

10. Security

We use reasonable technical and organizational measures to protect your information, including HTTPS encryption across the site, access controls and least-privilege principles, hashed password storage, and audit logging on key systems.

No method of transmission or storage over the internet is completely secure. If a security incident affects your data, we will notify you and the relevant authorities as required by law.

11. Children

The Service is not intended for anyone under 16, and we do not knowingly collect their personal information. If you believe someone under 16 has provided us with personal information, contact privacy@velpora.shop and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. For material changes, we will notify you in advance by email or in-app notice and update the “last updated” date on this page.

13. Contact Us

Privacy questions and rights requests: privacy@velpora.shop. Postal address: Velpora Studio, —.