Privacy Policy

1. Scope

This Privacy Policy describes how VIXL ("we", "us") handles information when you use FORMAT, the AI-powered interior visualization and space video product available at vixl.art, and related services (together, the "Services").

This Policy does not cover third-party services that operate under their own privacy policies, such as payment providers or AI infrastructure providers, except where those providers process information on our behalf as described below.

2. Information We Collect

Account information: your email address and account credentials when you register.

User Content: the interior images and other materials you upload to the Services.

Generated content: images and videos produced for you through the Services.

Service usage information: project records, generation job records, and credit transaction records required to operate the Services.

Payment-related information: order and transaction records created when you purchase credits. Payment processing is handled by our payment provider as described in Sections 6 and 7.

Technical information: standard server logs and session technologies described in Section 8.

3. How We Use Information

To provide, operate, and maintain the Services, including processing your uploads, running AI generation, and delivering outputs to you.

To manage your account, authentication, project history, and credit balance.

To process transactions, prevent fraud and abuse, and enforce our Terms of Service.

To maintain security, diagnose failures, and improve the reliability and quality of the Services.

We do not sell your personal information.

4. Account and Authentication Data

Accounts are managed through an authentication service (Better Auth) using an email address and password, together with a session cookie that keeps you signed in.

Passwords are stored in credential-hashing form, not in plaintext. We do not display your email address to other users.

You can sign out at any time, which invalidates your session.

5. User Content and Generated Content

When you submit images and generation instructions, we process that content to provide the Services. Your uploaded images are sent to AI service providers, acting on our behalf, as needed to generate outputs.

Project records and successfully generated assets are retained while your project exists so you can access your history, as described in Section 9.

Do not upload images containing personal information of others unless you have their permission and the right to do so.

6. Payment Information

Purchases are processed by third-party payment service providers. Checkout information, such as payment details, may be handled directly by the payment provider.

We do not store complete payment card numbers. We retain order and transaction records (such as order identifiers, product purchased, status, and timestamps) as needed to grant credits, handle refunds, and meet accounting, tax, and anti-fraud obligations.

7. Service Providers

We rely on the following categories of service providers to operate the Services:

Database hosting: Neon (managed PostgreSQL) for application data.

Object storage: Cloudflare R2 in production, for storing uploaded and generated media assets. Legacy or staging environments may use other object storage providers.

AI processing: image and video generation via the Seedream / Seedance provider path, and transient video upscaling processing via fal.ai. fal.ai is used for compute and transient processing only; our target is that temporary media sent to fal.ai is retained no longer than 24 hours by fal.ai, while we retain the assets needed for successful delivery of your results.

Payments: Waffo (Pancake) for payment processing and checkout.

Email delivery: Resend for transactional account-recovery email delivery.

These providers process information on our behalf as necessary to provide the Services, under their own terms and privacy commitments.

8. Cookies and Optional Analytics

We use a session cookie to keep you signed in and to operate core features of the Services. This cookie is necessary for the Services to function.

With your consent, we also use optional analytics services to understand how the Services are used and to improve the product:

Google Analytics 4 — basic website traffic and usage measurement.

Microsoft Clarity — heatmaps, interaction analytics, and session replay.

These analytics are optional. They remain disabled until you allow analytics, and you can reject them or change your choice at any time using the "Cookie / Analytics Preferences" control below.

We do not send your email address, name, or account identifiers to these analytics services.

We do not use advertising cookies or advertising networks.

9. Data Retention

While your project is not deleted, we retain project records and successfully generated assets so that you can access your history within the Services.

When you delete a project, the data associated with that project is cleaned up in accordance with the product deletion flow, including related database records and stored media where technically feasible.

Records that are required for legal, anti-fraud, financial, accounting, or dispute-resolution purposes may be retained for the period necessary to fulfill those obligations.

10. Deletion

You can delete projects within the Services. You may also request account deletion by contacting us using the details in the Contact section.

Following a deletion request, we will delete or de-identify the personal information we hold about you, except where retention is required for legal, anti-fraud, financial, or dispute-resolution purposes, or where deletion is not technically feasible, in which case we will explain the relevant limitations.

11. International Data Processing

We and our service providers operate globally. Information may be processed and stored in countries other than your own, where data protection rules may differ.

Where required by applicable law, we implement appropriate safeguards for such transfers.

12. Security

We use industry-standard measures designed to protect information, including encrypted transport, credential hashing, and access controls.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect your information and respond to incidents.

13. Your Choices and Rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.

You can manage your projects and content directly in the Services. For other requests, contact us using the details in the Contact section. We will respond consistent with applicable law.

You may disable cookies in your browser settings, but doing so may prevent the Services from functioning correctly.

14. Children's Privacy

The Services are not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children.

If you believe a child has provided us personal information, contact us and we will take appropriate action to delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date above shows when the current version took effect.

Material changes will be indicated on the Site. Continued use of the Services after an update constitutes acknowledgment of the updated Policy.

16. Contact

Questions about this Privacy Policy or our data practices may be directed to: support@vixl.art