Privacy Policy

1. Who is responsible

The operator of Velart is the controller of personal data handled for Velart's own purposes. Providers may act as processors or independent controllers for their services. Privacy requests can be submitted through the Contact page. Before public launch, Velart will publish the operator's full legal identity and business contact details; until then, do not submit sensitive or confidential information.

2. Data we collect

Depending on how you use Velart, we collect:

• account data, such as email address, authentication identifiers, profile details, workspace membership, and security settings;
• Inputs and Outputs, including prompts, reference images, generated images and videos, model settings, project structure, and related metadata;
• usage and technical data, such as IP address, device and browser information, timestamps, logs, error details, cookie identifiers, and security events;
• transaction data, such as credit pack, amount, currency, payment status, transaction or invoice identifiers, and blockchain payment information supplied by NOWPayments; we do not receive your private keys;
• support, report, copyright, and dispute information you choose to send;
• referral data, such as a referral code, attribution cookie, qualifying activity, and reward history.

3. How we use data

We use personal data to:

• create and secure accounts, authenticate users, and maintain workspaces;
• submit generation requests, deliver results, store projects, and restore failed-generation credits;
• process purchases, confirm payments, prevent fraud, keep accounting records, and resolve disputes;
• provide support, respond to privacy and copyright requests, and communicate service notices;
• detect abuse, enforce policies, protect users and infrastructure, and comply with legal obligations;
• debug, maintain, and improve reliability, usability, model routing, and pricing without using your content to train Velart's own models unless we clearly disclose that use and obtain any consent required by law;
• establish, exercise, or defend legal claims and preserve evidence of serious abuse.

4. AI and media processing

Inputs and generation settings are sent to the configured generation provider, currently MinuitAPI when production generation is enabled. Media may be transferred to Bunny storage and delivered through a CDN; a file may be accessible to anyone who obtains its exact public delivery URL. Account and project records are stored with Supabase. Do not upload confidential information, biometric identifiers, private documents, or images you lack permission to process. Provider handling may be governed by its own terms and retention practices.

5. When data is shared

We disclose data only as reasonably needed to operate Velart, including to:

• Supabase for authentication, database, and related infrastructure;
• Bunny for storage and content delivery;
• MinuitAPI and underlying model providers for image and video generation;
• NOWPayments and blockchain networks for payment processing and confirmation;
• professional advisers, authorities, acquirers, or other parties when required by law, necessary to protect rights and safety, or involved in a legitimate business transfer subject to appropriate safeguards.

6. Legal bases

Where a legal basis is required, we process data to perform our contract with you, comply with law, protect legitimate interests such as security and service reliability, and, where applicable, based on consent. You may withdraw consent, but withdrawal does not affect earlier lawful processing. We balance legitimate interests against your rights and do not rely on them where your rights override those interests.

7. Retention and deletion

We keep account, project, Input, and Output data while your account or project remains active and delete or de-identify it after a valid deletion request, subject to technical backup cycles and legal exceptions. Deleted media may remain briefly in caches or backups. Transaction, credit-ledger, fraud, security, support, report, and legal records may be retained longer when needed for accounting, dispute resolution, safety, or legal duties. Reports may be preserved even if the reported generation is deleted.

8. International transfers

Velart and its providers may process data in countries other than yours. Where required, we use recognized transfer mechanisms and contractual or technical safeguards. Laws in a destination country may differ from those where you live.

9. Your choices and rights

Depending on your location, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent; appeal certain decisions; or complain to a regulator. You can delete individual assets and request account deletion through available account controls. We may verify identity, protect other people's rights, retain legally required records, and deny or limit a request where law permits. Authorized agents may submit requests where applicable.

10. No sale or behavioral advertising

Velart does not sell personal data and does not currently use personal data for cross-context behavioral advertising. We do not currently place advertising or third-party analytics cookies. If these practices change, we will update this Policy and provide consent or opt-out controls where required.

11. Security

We use reasonable administrative, technical, and organizational safeguards, including access controls and tenant-level database protections. No online system or public delivery URL is perfectly secure. You are responsible for securing your account and safely storing downloaded Outputs. Notify us promptly if you suspect compromise.

12. Children

Velart is an adults-only service. Anyone under 18 may not create an account or use the service. We do not knowingly collect personal data from anyone under 18. If we learn that we have done so, we will take reasonable steps to suspend access and delete the data, subject to legal preservation duties. A parent or guardian may contact us about a minor's data.

13. Policy changes

We may update this Policy as the service, providers, or law changes. We will update the date above and give additional notice of material changes where required.