Privacy

VectorArtLab decides how the data on this page is used. For anything here — a copy of your data, a correction, a deletion, or a question — email [email protected].

When you first upload an image, generate one, add a photo in the studio or start a studio design, we create a session record and give your browser a cookie holding its random id. “Get my files” on a saved preview sets the same cookie, pointing at that preview’s session. The record carries no name or email address, and it is linked to your account only if you sign in. Alongside that id it can hold a keyed hash of your IP address and a random browser id.

The IP address is hashed with a secret key before it is written anywhere — we never store the raw address, and the hash cannot be turned back into it without that key. The browser id is a random number your browser keeps in local storage (section 9), not a fingerprint of your device. Both are used to count free previews and nothing else.

The session record is not deleted on a schedule: it is what ties an order to the work that produced it. The files it points to expire on the timetable in section 7.

You give us an email address on Stripe’s checkout page. It goes on the order and is used to send you the link to your finished files, and to tell you if we could not produce them and have refunded you.

It is also how you get your files back: sign in with that address and we email a one-time code to it. Nothing is revealed to whoever typed the address; the code only ever arrives in the inbox, and once it is entered every order paid with that address is listed.

After a few free previews the generate page may ask for an email address before you carry on. That address is used to lift the limit for that request; we do not save it on our servers.

Every email we send is recorded — the address, the subject, what kind of message it was, the order it belongs to and whether it was delivered — so that “my email never arrived” can be answered with facts. That log is deleted after 90 days.

We do not sell your email address, and we do not add you to a marketing list because you bought a file.

You never need an account to buy. Signing in with the address you paid with — which is how you get your files back — creates one for that address if it does not exist yet. We store your email address, any other addresses you add, a name if you give one, when you proved each address was yours, when you last signed in, and a list of recent sign-ins (the browser, a keyed hash of the IP address and the time, kept 90 days). The account finds your orders by matching those addresses; it is not a second copy of them.

You sign in with a code we email you, which works once and expires after ten minutes, or with a password if you choose to set one. A password is stored only as a salted scrypt hash — never the password itself — and you can remove it again from your account page.

There is no delete button yet. Email us from the account’s address and we will delete the account; your orders and the download links in your email are not affected unless you ask for those to go too (section 12).

Payment runs through Stripe Checkout, on Stripe’s own page. Your card number is entered there and never touches our servers — we cannot see it, log it or store it. Stripe may also ask for your billing address or country, so it can work out the tax that applies where you are.

What we keep against the order is the email address, the amount, the currency, the status, the print width you chose, when you paid, and Stripe’s own reference ids, so that a payment can be reconciled and a refund can be issued.

Uploads, generated images, intermediate step outputs, watermarked previews and finished files are stored in Cloudflare R2. Each one records its dimensions, its size, and which image it was made from, so a finished file can be traced back to what produced it.

Each prompt is checked against a list of brand and character names on our own server before anything is generated. The prompt text, the model used and whether it was refused are kept against your session for 90 days, then deleted. That record exists so an intellectual-property complaint or a takedown request can be answered with facts rather than a shrug.

Files are removed by storage rules that run whether or not anyone remembers to press delete. Records are swept on a schedule.

When you upload or generate, we use Cloudflare Turnstile to check for bots. The check runs in a frame served by Cloudflare, which reads your IP address and some browser signals to decide. We then send Cloudflare the resulting token, with your IP address, to confirm it; we store neither.

Behind that, counters keyed on the hashed IP address and the browser id sit in a short-lived cache and expire on their own. They hold counts, not history.

Everything below is needed for the site or the support chat to work, apart from the Google Analytics and Microsoft Clarity cookies, which only count visits and show how the site is used. There are no advertising cookies. Our own visitor stats set no cookies at all (section 10). Stripe’s checkout page and Cloudflare’s bot check are served by those companies and may set their own cookies, under their own privacy policies.

These are the services that receive your data while the site does its job. Which AI service handles a given step depends on how the site is configured at the time; the list covers every one it can use.

Several of these companies are based in the United States, so your data may be processed there. There are no advertising networks and no data brokers, and the only record of the pages you visit is the support chat's, described above.

To deliver what you bought and answer you when you write: that is our agreement with you. To keep the free previews from being abused, and to be able to answer a takedown request or a “did my email arrive” question: our legitimate interest in running a service that works and can account for itself. To count visits and see which pages help people: our legitimate interest in improving the site. Order and payment records: we are required to keep them for tax and accounting.

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we use it or ask us to limit it, and ask for it in a form you can take elsewhere. Write to [email protected] from the address on the order or the account, so we can tell the request is yours.

Deletion is real: the order record and the stored files go, which means the download link stops working. Download anything you want to keep first. Records we are required to keep for tax and accounting — the fact that a payment happened, and for how much — survive a deletion request. Your files and your prompts do not.

If you are unhappy with how we have handled your data, you have the right to complain to the data protection authority where you live or work. We would appreciate the chance to put it right first.

When what the site stores changes, this page changes with it, and the date at the top moves. It was last updated on 8 November 2026.