1. Information We Collect
Account Information: When you register, we collect your email address, name, and password (stored in hashed form). We do not store payment card details — all payment processing is handled by our payment processor, Stripe; marketplace and partner payouts are disbursed via Stripe Connect.
Usage Data: We collect information about how you use the Service, including models used, credit consumption, timestamps, and feature interactions. This data is used to improve the Service and provide your usage dashboard.
Prompts and Generations: Your prompts and generated outputs are processed by third-party AI model providers. We temporarily store generation metadata (model used, timestamp, credit cost) for your history dashboard. Full prompt content is retained for up to 90 days and then permanently deleted.
Technical Data: We automatically collect IP addresses, browser type, device information, and referring URLs for security and analytics purposes.
2. How We Use Your Information
- To provide and maintain the Service
- To process payments and manage subscriptions
- To display your usage history and credit balance
- To communicate important updates about the Service
- To detect and prevent fraud, abuse, and security threats
- To improve and optimize the platform
3. Data Sharing
We do not sell your personal information. We share data only with:
- AI Model Providers: Your prompts are sent to third-party model providers (e.g., OpenAI, Anthropic, Google) via AI gateways (Vercel AI Gateway, OpenRouter, AIML API) to generate responses. These providers have their own privacy policies.
- Payment Processor: Stripe processes purchases, invoices and refunds under its privacy policy; Stripe Connect processes marketplace and partner payouts.
- Infrastructure and Service Providers: Our database, authentication, and storage stack is self-hosted by Vincony on dedicated servers provided by Hetzner in the European Union (Germany and Finland). A full list of sub-processors is maintained at /legal/sub-processors.
- Legal Compliance: We may disclose information if required by law or legal process.
4. Google User Data
If you sign in with Google or connect Google Search Console, Vincony accesses the following Google user data:
- Sign in with Google: Your Google account email address and basic profile information (name and profile picture), used solely to create and authenticate your Vincony account
- Google Search Console: If you choose to connect Search Console, we access the list of sites verified in your Search Console account and search performance data (queries, clicks, impressions, click-through rate, and average position) for the sites you connect, used solely to display SEO analytics to you inside Vincony. If you request it, we also submit sitemaps to Search Console on your behalf for your connected sites
Vincony's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular:
- We do not use Google user data for advertising purposes
- We do not sell Google user data
- We do not allow humans to read Google user data, except with your explicit consent, where necessary for security purposes (such as investigating abuse), or to comply with applicable law
- Google user data is used only to provide and improve the user-facing features described above
You can revoke Vincony's access to your Google account at any time from your Google Account settings at accounts.google.com (Security → Third-party access).
5. Data Retention
- Account information: retained while your account is active
- Generation metadata: retained for 90 days, then permanently deleted
- Payment records: retained as required by tax and financial regulations
- If your paid subscription expires, your content and account data are retained for 60 days after expiry (so you can export your data or resubscribe to restore access), then permanently deleted
- You may request account deletion at any time through your dashboard
6. Your Rights (UK / EU GDPR — Articles 15–22)
Under the UK GDPR and EU GDPR you have the following rights:
- Right of access (Art. 15): Obtain a copy of the personal data we hold about you
- Right to rectification (Art. 16): Request correction of inaccurate or incomplete data
- Right to erasure / "right to be forgotten" (Art. 17): Request deletion of your data where it is no longer necessary or you withdraw consent
- Right to restriction of processing (Art. 18): Ask us to pause processing in certain circumstances
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
- Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing
- Rights related to automated decision-making and profiling (Art. 22): Not be subject to solely automated decisions that produce significant legal effects, and to request human review
To exercise any of these rights, contact [email protected]. We will respond within 30 days.
Supervisory authority: You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local EU data protection authority if you are based in the EEA.
7. Security
We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, and secure authentication. However, no system is 100% secure, and we cannot guarantee absolute security.
8. Children's Privacy
Vincony is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. Users aged 13–17 may use the Service only with verifiable parental or guardian consent. If we become aware that a child under 13 has provided us with personal data without parental consent, we will take steps to delete it. Parents or guardians who believe their child has provided personal information without consent may contact us at [email protected] to request deletion.
9. International Transfers
Where your data is stored: Vincony runs a self-hosted database, authentication, and storage stack on dedicated servers operated by Vincony and located in the European Union (Hetzner data centres in Germany and Finland). Primary storage of your account data and content is therefore in the EU.
Some processing takes place outside the EU/UK: prompts sent to AI model providers (e.g., OpenAI, Anthropic, Google) and data handled by certain other sub-processors (e.g., Stripe, Resend, Cloudflare) may be processed in the United States. We ensure appropriate safeguards are in place for international data transfers, such as Standard Contractual Clauses and the UK IDTA/Addendum, in compliance with applicable data protection laws.
10. GDPR Compliance (EU and UK)
We comply with the EU General Data Protection Regulation (GDPR) and the UK GDPR as retained under the Data Protection Act 2018. The UK GDPR applies to the processing of personal data of individuals in the United Kingdom and imposes equivalent obligations to the EU GDPR.
Data Controller: VINCONY AI LTD (Company Number: 17047337), 3rd Floor, 86-90 Paul Street, London EC2A 4NE, England.
Our Data Protection Officer can be reached at [email protected].
UK Representative: As VINCONY AI LTD is established in the UK, no separate UK representative is required.
Lawful bases for processing:
- Performance of a contract (Art. 6(1)(b)): Account registration, delivering the Service, processing payments, managing your subscription, and maintaining your usage history
- Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, platform analytics and improvement, and abuse detection — where our interests are not overridden by your rights
- Consent (Art. 6(1)(a)): Analytics and non-essential cookies (you may withdraw consent at any time via Cookie Settings); marketing communications where you have opted in
Supervisory authority: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk. EU-based users may also contact their local national data protection authority.
11. CCPA / US State Privacy Rights
If you are a resident of California or another US state with consumer privacy legislation, you have the following rights:
- Right to Know: You may request details about the personal information we collect, use, and disclose.
- Right to Delete: You may request deletion of the personal information we hold about you, subject to certain exceptions.
- Right to Opt Out of Sale: Vincony does not sell or share your personal information with third parties for monetary or other valuable consideration. We have never sold user data and have no plans to do so.
- Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
To exercise any of these rights, contact [email protected] with the subject line "US Privacy Rights Request". We will respond within 45 days as required by applicable law.
Do Not Sell or Share My Personal Information: Vincony does not sell or share personal information as defined under the CCPA or other US state privacy laws.
12. Canadian Privacy Rights (PIPEDA / Quebec Law 25)
If you are a resident of Canada, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, if you reside in Quebec, Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25).
Under these laws, you have the right to:
- Access: Request access to the personal information we hold about you
- Correction: Request correction of inaccurate or incomplete personal information
- Withdraw Consent: Withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions
- File a Complaint: File a complaint with the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information du Québec
Consent: We obtain your meaningful consent before collecting, using, or disclosing your personal information. Where required by Law 25, we obtain express consent for sensitive personal information.
Cross-Border Transfers: Your personal information may be transferred to and processed in countries outside Canada, including the United States and the United Kingdom. We ensure that appropriate contractual and technical safeguards are in place to protect your data during any cross-border transfer.
Privacy Officer: Our designated privacy officer can be reached at [email protected].
To exercise any of these rights, contact [email protected] with the subject line "Canadian Privacy Rights Request". We will respond within 30 days as required by applicable law.
13. Cookie Consent Records
Your cookie consent preferences are stored locally on your device and are not transmitted to our servers. We respect both the Do Not Track (DNT) and Global Privacy Control (GPC) browser signals — when either signal is enabled, analytics cookies are disabled automatically. You can manage your cookie preferences at any time via the "Cookie Settings" link in the footer of every page.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Service.
15. Contact
For privacy-related inquiries, contact VINCONY AI LTD at [email protected].