Draft pending legal review. This document hasn't been reviewed by a lawyer yet and may change before it takes effect.

Privacy Policy

Draft for legal review. Not yet reviewed by a lawyer.

What we collect

• Account details. Email address, sign-in identifiers, and the age confirmation you give.
• Payments. Amounts and processor references (Stripe session or BTCPay invoice ids). Card numbers and wallets stay with the processors.
• Requests. Prompts, settings, the end-user id you send, timestamps, prices, and the generated images.
• Safety records. Screening decisions, strikes, withheld outputs and content reports.
• Technical logs. IP addresses and request metadata, kept for security and abuse prevention.

How long we keep it

• Generated images: 14 days, then deleted automatically.
• Prompts: removed from task records after 90 days, unless a screening decision or report involves that task.
• Safety and report evidence: up to one year, longer when the law requires it (for example, material reported to NCMEC).
• Account and payment records: as long as the account exists, plus what tax and accounting law requires.

Why

To run the service, bill for it, keep it safe and legal, answer support and legal requests, and improve reliability. We don’t sell personal data, and we don’t train models on your prompts or images.

Who processes it for us

• Cloudflare: hosting, storage and prompt screening.
• Supabase: database and sign-in.
• RunPod: GPU processing.
• Stripe and BTCPay Server: payments.
• Resend: email.

We share data with the National Center for Missing & Exploited Children and with law enforcement when the law requires it.

Your choices

You can download your invoices and statements, delete API keys, and ask us to delete your account and personal data at privacy@velvetapi.dev, subject to what we must keep for legal reasons. If you’re in the EU or UK, you also have the rights to access, correct, object and complain to your data protection authority.