Privacy Policy
Introduction
VividDraw ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website and AI-powered image generation services (collectively, the "Service").
By using VividDraw, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.
Scope
This Privacy Policy applies to all users of VividDraw, including:
- Registered users
- Anonymous visitors
- Users who sign in via Google OAuth
It covers data collected through our website, API, and any related services.
Definitions
- Personal Data: Any information that can identify an individual, such as username, email address, or IP address.
- User Content: Images you upload, sketches you draw, prompts you write, and images generated by the Service.
- Service Data: Technical data automatically collected when you use the Service, such as logs and device information.
- Third-Party Provider: External services we rely on, including Replicate (AI inference), Google (OAuth), and Stripe (payments).
Information We Collect
Information You Provide
- Account Information: Username and email address when you register or sign in via Google OAuth.
- Profile Data: Name and avatar provided by Google when using OAuth sign-in.
- User Content: Sketches, prompts, masks, reference images you upload, and AI-generated images.
- Communications: Messages you send to our support team or feedback you submit.
Information Collected Automatically
- Log Data: IP address, browser type, operating system, referring URL, pages visited, and timestamps.
- Usage Data: Features used, generation count, quality tier selected, and error events.
- Device Information: Device type, screen resolution, and language settings.
Payment Information
When you purchase credits, payment processing is handled by Stripe. We do not store your full credit card number, CVV, or bank account details. Stripe may share limited payment metadata (last four digits, card brand, expiration date) to help us manage your account.
How We Use Information
We use the collected information for the following purposes:
| Purpose | Data Used |
|---|---|
| Provide the Service | User Content, Account Information |
| Process AI generations | User Content (sent to Replicate) |
| Authenticate users | Email, OAuth tokens, session cookies |
| Process payments | Payment metadata (via Stripe) |
| Security & fraud prevention | IP address, login logs, request patterns |
| Debug & improve Service | Error logs, usage data |
| Communicate with you | Email for verification, password reset, security notices |
| Legal compliance | As required by applicable law |
We do not sell your personal data to third parties. We do not use your User Content to train AI models.
Data Controller
VividDraw acts as the data controller for account information, service usage data, and User Content you provide. For AI processing activities, we act as a controller in relation to the decisions about how your data is used, while third-party AI providers act as processors performing generation tasks under our instruction.
Legal Basis for Processing
We process your personal data based on the following legal grounds, depending on the context:
- Contractual Necessity: To provide the Service you have requested (e.g., account creation, AI generation).
- Consent: Where you have given explicit consent (e.g., marketing communications, where applicable).
- Legitimate Interests: For security, fraud prevention, service improvement, and debugging, where such interests are not overridden by your rights.
- Legal Obligation: To comply with applicable laws and regulations (e.g., payment record retention).
AI Processing
To generate images, we transmit your sketches, prompts, masks, and configuration parameters to third-party AI providers (currently Replicate). This transmission is necessary to provide the Service.
These providers:
- Process your input solely for the purpose of generating images
- Do not use your content to train their models (per our agreement)
- May retain data temporarily for debugging and abuse monitoring
- Operate servers that may be located in jurisdictions outside your country
Generated images are stored on our servers to allow you to access your work across sessions. You may delete generated images at any time through your project.
Third-Party Services
VividDraw integrates with the following third-party services. Each operates under its own privacy policy:
| Service | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Replicate | AI image generation | Uploaded images, prompts, masks | replicate.com/privacy |
| OAuth authentication | Email, name, avatar (with your consent) | policies.google.com/privacy | |
| Stripe | Payment processing | Payment details, email | stripe.com/privacy |
| Oracle Cloud | Server hosting | All Service data | oracle.com/legal/privacy |
We are not responsible for the privacy practices of these third parties. We encourage you to review their policies.
Cookies and Tracking
VividDraw uses cookies, localStorage, sessionStorage, and similar technologies for the following purposes:
- Essential Cookies: Session tokens to keep you signed in (httponly, secure).
- Security Cookies: CSRF tokens to prevent cross-site request forgery.
- Functional Cookies: Language preference and UI settings.
We do not use advertising or tracking cookies. Google OAuth may set its own cookies during the sign-in flow; please refer to Google's cookie policy.
Data Retention
We retain your data for the following periods:
| Data Type | Retention Period |
|---|---|
| Account information | Until account deletion |
| Generated images & sketches | Until deleted by you or account deletion |
| Deleted images | Permanently removed within 30 days |
| Server logs | Up to 90 days |
| Payment records | As required by law (typically 5-7 years) |
| Backups | Up to 30 days |
After account deletion, your personal data is removed within 30 days, except where retention is required by law.
International Data Transfers
Your data may be transferred to and processed in countries other than your country of residence. Our servers are hosted on Oracle Cloud infrastructure, and our AI provider (Replicate) operates globally. We take reasonable steps to ensure that your data receives an adequate level of protection regardless of where it is processed.
Security
We implement industry-standard security measures to protect your data:
- HTTPS encryption for all data in transit
- Password hashing (bcrypt) for stored credentials
- HttpOnly and Secure flags on session cookies
- Access controls for administrative functions
- Regular security updates to our dependencies
However, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
Data Breach Notification
In the event of a security incident involving personal information, we will take reasonable steps to investigate, contain, and remediate the incident. Where required by applicable law, we will notify affected users and relevant supervisory authorities within the legally required timeframe. Notifications will describe the nature of the incident, the data potentially affected, and the measures taken in response.
Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access: Request a copy of your personal data we hold.
- Correction: Correct inaccurate or incomplete data.
- Deletion: Request deletion of your account and associated data.
- Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to certain processing of your data.
- Withdraw Consent: Withdraw consent where processing is based on consent.
To exercise these rights, contact us at legal@vividdraw.com. We will respond within 30 days.
Complaints to Authorities
If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority. In Canada, you may contact the Office of the Privacy Commissioner of Canada or your applicable provincial privacy authority. We encourage you to contact us first so that we may address your concerns directly.
Withdrawal of Consent
Where processing is based on your consent, you may withdraw consent at any time by:
- Deleting your account through your account settings
- Contacting us at legal@vividdraw.com
- Disabling optional data processing features where available
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Children's Privacy
VividDraw is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
Account Deletion
You may delete your account at any time. Upon deletion:
- Your account is immediately deactivated
- Your personal data is removed within 30 days
- Generated images and sketches are permanently deleted
- Purchased credits are non-refundable
- Data required by law (e.g., payment records) will be retained as required
Policy Updates
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via:
- Email to your registered address
- A notice on our website
The "Last Updated" date at the top of this policy indicates when changes were last made. Continued use of the Service after changes constitutes acceptance of the updated policy.
Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights:
- Email: legal@vividdraw.com
- Support: support@vividdraw.com
For GDPR inquiries, please include "GDPR Request" in your subject line.
Governing Law
This Privacy Policy is governed by the laws of Canada. It is designed to comply with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Any disputes shall be resolved in accordance with our Terms of Service.
Effective Date and Version
Version: 1.0
Effective Date: 2026-08-03
Last Updated: 2026-08-03