Privacy Policy

Last updated: 14 August 2026

Introduction

This Privacy Policy describes how Vaethat ("we", "our", or "us") collects, uses, and protects your personal information when you use our AI image enhancement service. We are committed to protecting your privacy and ensuring transparency about our data practices.

By using our service, you consent to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our service.

What Information We Collect

Personal Information You Provide

When you create an account or use our service, we collect:

  • Email address: Used for account creation, authentication, password recovery, and important service communications.
  • Name: Optional information you may provide for account personalization and customer support.
  • Password: Encrypted using industry-standard methods and never stored in plain text.
  • Profile information: Any additional details you choose to add to your profile.
  • Payment information: Processed securely through our payment provider (we don't store full credit card details).
  • Billing address: Required for payment processing and tax compliance.

Images and Content

Our core service involves processing your images:

  • Original images: Photos you upload for enhancement, stored securely in your account.
  • Enhanced images: AI-processed versions of your images, available for download.
  • Processing metadata: Technical information about enhancement settings and processing history.
  • Usage patterns: Which features you use most, processing preferences, and service interactions.

Automatically Collected Information

When you use our service, we automatically collect:

  • Device information: Browser type, operating system, device model, and unique device identifiers.
  • Log data: IP address, access times, pages viewed, and actions taken.
  • Cookies and tracking: Session cookies for functionality and preference cookies for settings. Our visit analytics (Vercel Analytics) are cookieless and aggregated. For advertising measurement we use the Meta Pixel, which sets cookies and collects usage data as described under Third-Party Services below; you can opt out through your browser settings or Meta's ad preferences.
  • Performance data: Service response times, error logs, and usage statistics for service improvement.

How We Use Your Information

Primary Service Functions

  • Image processing: Using AI algorithms to enhance your uploaded images. Our AI uses advanced models to process and enhance your uploaded images as requested.
  • Account management: Creating and maintaining your user account and preferences.
  • Service delivery: Providing access to enhanced images and download functionality.
  • Credit tracking: Managing your usage credits and subscription benefits.

Communication and Support

  • Service updates: Important notifications about service changes or maintenance.
  • Customer support: Responding to your inquiries and resolving technical issues.
  • Account security: Sending alerts about account activity and security-related updates.
  • Billing communications: Subscription confirmations, payment receipts, and billing updates.

Service Improvement

  • Analytics: Understanding user behavior to improve our platform and features (using anonymized data).
  • Quality assurance: Monitoring service performance and identifying areas for improvement.
  • Feature development: Analyzing usage patterns to develop new features and capabilities.

Legal Basis for Processing (GDPR)

For users in the European Union, our legal basis for processing personal data includes:

  • Contract performance: Processing necessary to provide our image enhancement service.
  • Consent: Where you've given explicit consent for specific processing activities (e.g., optional analytics).
  • Legitimate interests: For service improvement, security, business analytics, and measuring the effectiveness of our advertising.
  • Legal obligation: To comply with applicable laws and regulations.

Data Storage, Security, and Retention

Security Measures

We implement comprehensive security measures to protect your data:

  • Encryption in transit: All data transmission uses SSL/TLS encryption protocols.
  • Encryption at rest: Stored data is encrypted using industry-standard AES encryption.
  • Access controls: Multi-factor authentication and role-based access for our team.
  • Regular audits: Periodic security assessments and vulnerability testing.
  • Secure infrastructure: Hosting on SOC 2 compliant cloud platforms with robust security measures.
  • Data breach response: In the event of a breach, we will notify affected users within 72 hours as required by law (e.g., GDPR) and take immediate remedial actions.

Data Retention

  • Account data: Retained while your account is active and for 30 days after deletion.
  • Images: Original and enhanced images stored until you delete them or close your account, with automatic deletion after 30 days of inactivity upon request.
  • Usage logs: Kept for 12 months for service improvement and security purposes.
  • Backup data: Retained for up to 90 days for disaster recovery, then permanently deleted.

Image Processing

How We Process Your Images

Your image processing workflow:

  1. You upload an image through our secure interface.
  2. The image is temporarily stored in our processing queue.
  3. Our AI algorithms analyze and enhance the image.
  4. The enhanced image is generated and made available for download.
  5. Both original and enhanced images are stored in your account.

Data Privacy Commitment

We respect your privacy and maintain strict data practices:

  • No AI training: Your images are never used to train or improve our AI models without your explicit opt-in consent.
  • Processing only: Images are processed solely to provide you with enhanced versions.
  • Your control: You can delete your images at any time from your account.
  • Secure processing: All image processing happens in secure, encrypted environments.
  • AI limitations: We do not use your images for any secondary purposes, such as bias analysis or model retraining, unless anonymized and consented to.

Third-Party Services and Data Sharing

Service Providers We Use

  • Supabase: Authentication, database, and user management services.
  • Cloud storage providers: Secure image storage and content delivery (e.g., AWS S3 with encryption).
  • Payment processors: Stripe for subscription and payment processing.
  • Email services: Transactional email delivery for account notifications (e.g., SendGrid).
  • Analytics providers: Vercel Analytics for aggregated, cookieless usage statistics (page views, referrers, country-level location).
  • Advertising and conversion measurement: Meta Platforms (Meta Pixel) to measure the performance of our ads on Instagram and Facebook and to attribute signups and purchases to those ads. The pixel collects device and usage information and sets cookies; where enabled, contact details are shared in hashed form for ad measurement and audience matching. See Meta's privacy policy at facebook.com/privacy/policy; opt out via your browser settings or facebook.com/adpreferences.

When We Share Data

We only share your data in limited circumstances:

  • With your consent: When you explicitly authorize data sharing.
  • Service providers: Trusted partners who help us operate our service (under strict data protection agreements, including GDPR-compliant processors).
  • Legal requirements: When required by law, court order, or regulatory authority.
  • Business transfers: In case of merger, acquisition, or sale of assets (with advance notice and opportunity to opt out).
  • Security purposes: To protect our service, users, or public safety.

We do not sell your personal data to third parties.

Your Privacy Rights and Choices

Access and Control

You have comprehensive control over your data:

  • Access: Request a complete copy of all personal data we hold about you.
  • Correction: Update or correct any inaccurate personal information.
  • Deletion: Request deletion of your account and associated data (subject to legal retention requirements).
  • Portability: Export your data in a commonly used format.
  • Restriction: Limit how we process your data in certain circumstances.
  • Objection: Object to processing based on legitimate interests.

Communication Preferences

  • Marketing emails: Opt out of promotional communications (account-related emails will continue).
  • Notification settings: Customize which service notifications you receive.
  • Cookie preferences: Manage non-essential cookies through your browser settings; for Meta advertising cookies you can also use Meta's ad preferences at facebook.com/adpreferences.

How to Exercise Your Rights

To exercise any of these rights:

  • Contact us directly through email or our contact form.
  • Use the privacy controls in your account dashboard.
  • We'll respond to requests within 30 days (or as required by applicable law, e.g., 1 month under GDPR).
  • We may need to verify your identity before processing certain requests.
  • For complaints, EU users may contact their local data protection authority.

International Data Transfers

Our service operates globally, and your data may be processed in countries other than your own. We ensure appropriate safeguards are in place:

  • Adequacy decisions: Transfers to countries with adequate data protection as determined by regulators (e.g., EU adequacy decisions).
  • Standard contractual clauses: EU-approved contracts ensuring data protection standards.
  • Certification programs: Partners certified under recognized privacy frameworks (e.g., EU-US Data Privacy Framework).
  • Binding corporate rules: Internal policies ensuring consistent data protection.

Children's Privacy

Our service is not intended for children under 13 (or 16 in the EU). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without verifiable parental consent, we will take steps to delete such information promptly. Parents or guardians may contact us to review or delete any such data.

Contact Us About Privacy

If you have any questions about this Privacy Policy, your data, or your privacy rights:

  • Email: privacy@vaethat.com
  • Contact form: Available on our website's contact page.

API & Integration Privacy

The following terms apply specifically to customers and partners using the Vaethat API to integrate image enhancement into their own products.

  • API keys: Issued per account, stored hashed, and rotatable or revocable at any time from the account dashboard. Keys are treated as secrets and are never logged in plaintext.
  • Data transmitted via API: Images submitted through the API are processed identically to images uploaded via the web interface — passed to our GPU sub-processor, enhanced, and returned to the caller. They are not used for AI training, not resold, and not reviewed by humans.
  • Retention: Input and output images are stored only as long as needed to deliver the job and allow re-download by the API caller. Request and response metadata (job ID, status, credits used, timestamps) is retained for billing and abuse prevention; raw image bytes are purged on the standard retention window described above.
  • Sub-processors: GPU inference runs on third-party cloud compute providers (EU and US regions). Stripe handles billing. Resend handles transactional email. Supabase hosts the application database and storage. All sub-processors are bound by data protection agreements. A named list of sub-processors is available on request for customers requiring a signed DPA.
  • Deletion: API callers can delete their stored images via the API or by contacting support@vaethat.com. Account deletion purges all associated images and metadata.
  • Confidentiality: Renders submitted via API are treated as the caller's confidential material. They are not used to train models, not displayed publicly, and not shared with any third parties outside the sub-processor chain listed above.

For a signed DPA or to discuss enterprise data terms, contact support@vaethat.com.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes:

  • We'll update the "Last updated" date at the top of this policy.
  • For significant changes, we'll notify you via email or prominent notice in our service.
  • Changes become effective immediately upon posting unless otherwise specified.
  • Your continued use of our service after changes constitutes acceptance of the updated policy.