Privacy Policy
Effective date: September 29, 2026
This Privacy Policy explains how vivid ("we", "us") collects, uses and shares personal information when you use VIVID(the "Service"), and the rights you have. We are the controllerof your personal data for the purposes of the EU and UK General Data Protection Regulation ("GDPR") and the "business" for the purposes of the California Consumer Privacy Act as amended ("CCPA").
1. Information we collect
| Category | What | Source |
|---|---|---|
| Account data | Email address, optional display name, password (stored only as a salted scrypt hash), email-verification status, the date and version of the Terms and Privacy Policy you accepted. | You |
| Content | Prompts you write, reference images you upload, generated images and videos, and generation settings. Reference images may contain images of people. | You / generated by the Service |
| Purchase data | Package purchased, amount, currency, date, the payment processor's transaction reference, and your consent to immediate delivery. We never receive or store your full card or PayPal account details — these are collected directly by our payment providers. | You / payment processors |
| Credit history | Credits purchased, spent, refunded or adjusted. | Generated by the Service |
| Referral data | If you join through someone's invite link: which account invited you, and whether you made a first purchase (so we can credit the referral reward). Your own invite code if you open your Account page. | You / generated by the Service |
| Support and reports | Feedback, issue reports, content/copyright reports you send us, and your email address for follow-up. | You |
| Technical data | IP address, browser/device type, request logs, and error logs; on the mobile app, a sign-in token stored on your device. | Automatically |
| Usage statistics | Pages visited, referring site and campaign tags (UTM), approximate location (country, region and city), browser/device type, and key actions such as signing up, starting a generation or completing a purchase — collected without cookies and not linked to your account (see section 7). | Automatically |
Biometric data. We do not use images to identify people, and we do not create or keep biometric identifiers or templates (such as faceprints). Reference images are processed only to generate the Output you request.
Sensitive data.Please do not include sensitive personal information (for example health data, or information about someone's sex life or sexual orientation) in your prompts or images.
2. How and why we use it (legal bases)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account, authenticating you, generating content you request, processing purchases and credits, customer support | Performance of our contract with you (6(1)(b)) |
| Automated screening of prompts, abuse and fraud prevention, handling content and copyright reports, security, debugging | Legitimate interests in keeping the Service safe and lawful (6(1)(f)); legal obligation where applicable (6(1)(c)) |
| Keeping purchase and tax records; responding to lawful requests from authorities; complying with takedown obligations | Legal obligation (6(1)(c)) |
| Service emails such as verification codes and important changes to our terms | Performance of contract (6(1)(b)) |
| Running the referral program (invite codes, sign-up bonuses and rewards) and hosting creations you choose to share via a public link | Performance of our contract with you (6(1)(b)) |
| Aggregate usage statistics to understand how visitors find and use the Service and to improve it | Legitimate interests in measuring and improving the Service (6(1)(f)) |
We do notsell your personal information, "share" it for cross-context behavioral advertising, or use it for targeted advertising, and we do not make decisions with legal or similarly significant effects about you based solely on automated processing. (Automated prompt moderation may block an individual generation request; you can contact us if you believe a request was blocked in error.)
Sharing and referrals. Your creations are private unless you turn on a public link for one: anyone with that link can then see the creation and its prompt (not your input images or account details) until you stop sharing it or it is deleted after 7 days. If you invited someone, you can see how many people signed up and purchased through your link and the credits you earned, but not who they are; the person you invited is not shown your identity either.
3. Automated prompt screening and AI processing
Before a generation runs, your prompt is sent to a large-language-model provider to check it against our Acceptable Use Policy. If you use the optional "Optimize Prompt" feature, your prompt and reference images are sent to that provider to produce an improved prompt. Your prompt and reference images are then sent to our AI generation infrastructure to create the Output. If you use a free tool such as the UGC Ad Script Generator (no account needed), the product details you type are screened the same way and sent to that provider to write the script; we keep them only in our moderation log, and use your IP address only briefly, in memory, to enforce usage limits. Generated Outputs are labelled with machine-readable metadata identifying them as AI-generated (see AI Content Disclosure).
4. Who we share it with
We share personal data only with service providers (processors) that act on our instructions, under contracts that protect your data:
- Hosting and cloud infrastructure — application servers, database, and object storage for uploads and generated media;
- AI generation infrastructure — GPU compute that runs the image/video models;
- Large-language-model provider — prompt moderation and prompt optimization;
- Email delivery provider — verification codes and service emails;
- Payment processors — Creem (creem.io) and Waffo (waffo.ai), which act as reseller and Merchant of Record for card payments, and where offered Stripe, Inc. and PayPal; they act as independent controllers for the payment data they collect (see Creem's, Waffo's, Stripe's and PayPal's privacy notices).
We may also disclose information if required by law or valid legal process, to report child sexual abuse material to NCMEC or other authorities, to protect the rights, safety or property of users or others, or as part of a merger or acquisition (in which case this Policy continues to apply to your data). A current list of our sub-processors is available on request at billykinggym@126.com.
5. International transfers
We and our service providers may process your data in the United States and other countries outside the European Economic Area and the UK. Where we do, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework, where the recipient is certified) or on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where needed. You can request a copy of the relevant safeguards by contacting us.
6. How long we keep it
- Account data — for as long as your account exists.
- Uploaded images and generated media — kept for 7 days. After 7 days the files are automatically and permanently deleted from our storage, they disappear from your history, and their links stop working, so please download anything you want to keep. If you delete your account earlier, they are erased immediately.
- Purchase and credit records — retained after account deletion, in de-identified form linked only to an internal ID, for as long as required by tax, accounting and anti-fraud laws (generally up to 10 years).
- Email verification codes — stored hashed and expire within minutes.
- Support messages and content reports — for as long as needed to handle them and defend legal claims; reports about illegal content may be retained as required by law.
- Logs — for a limited period for security and debugging.
7. Cookies and similar technologies
We use only strictly necessary cookies: a session cookie that keeps you signed in, security cookies that protect sign-in forms against cross-site request forgery, and a short-lived CAPTCHA cookie on registration and report forms. These are required to provide the Service you request and do not need consent under the EU ePrivacy Directive. We do not use analytics, advertising or tracking cookies. If this changes, we will ask for your consent first.
Usage statistics. We measure site usage with Umami, an open-source analytics tool that we host ourselves on our own servers — no data is sent to a third-party analytics company. It sets no cookies and stores nothing on your device. Your IP address is used only momentarily to derive an approximate location (country, region and city) and a rotating pseudonymous visit identifier, and is not stored. Statistics are not linked to your account and are not used for advertising or profiling.
8. Your rights
EEA, UK and Switzerland. Under the GDPR you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate data;
- erase your data — you can delete your account yourself at any time from the Account page, which erases your profile, uploads and generated media;
- restrict or object to processing based on legitimate interests;
- data portability for data you provided to us;
- lodge a complaint with your local data protection supervisory authority.
California and other US states. Residents of California and of other states with comprehensive privacy laws have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to obtain a portable copy; and not to be discriminated against for exercising these rights. We do not sell or share personal information and do not process sensitive personal information for purposes that would give rise to a right to limit. You may use an authorized agent to make a request; we may verify the request by confirming control of the account email. In the preceding 12 months we collected the categories listed in Section 1 for the purposes in Section 2 and disclosed them only to the service providers in Section 4.
To exercise any right, email billykinggym@126.com from the address associated with your account. We respond within one month (GDPR) or 45 days (CCPA), which may be extended where the law allows.
9. Security
We protect data with encryption in transit (HTTPS), hashed passwords, hashed sign-in tokens, access controls, and least-privilege access for staff. No system is completely secure; if we become aware of a breach affecting your data we will notify you and regulators as required by law.
10. Children
The Service is for adults only. We do not knowingly collect personal information from anyone under 18 (or under 13 for purposes of the US Children's Online Privacy Protection Act). If you believe a minor has provided us with personal data, contact us and we will delete it.
11. Changes
We will post any changes on this page and update the effective date. If changes are material we will notify you and ask you to review and accept the updated Policy before continuing to use the Service.
12. Contact
vivid
Email: billykinggym@126.com