Privacy Policy

Last updated 25 September 2026

VAELICO STUDIO, S.L. — CIF B27669050, Calle Gregori Casasempere Juan, 10, Esc. 1, 6º, Puerta 1, 03802 Alcoy (Alicante), Spain (“Vaelico”, “we”, “us”) runs vaelico.ai and the Vaelico app and API. We are the controller of the personal data described here. This page says what we collect, why, who helps us process it, how long we keep it and what you can do about it.

What we collect

Account: your email, a hash of your password (never the password itself), your plan and account settings, and a session cookie while you’re signed in.
Billing (paid plans): order numbers, amounts, dates, payment status and a reference token from the payment gateway for renewals. Your card is entered on the payment provider’s page; we never see or store your card number.
Usage: how many tokens, requests and images you use, and when — to apply plan limits.
Chats: your conversations in the web app, synced to our servers so they’re there on any device. With training use on, we also keep a copy of chat and API conversations for training (API keys have their own setting).
Images: the images you generate and their prompts and settings (artist style, size, seed, Safe mode), stored so you can see them in your gallery.
Image training data (training use on): a copy of each image you generate with its prompt and settings, and what you do with your images — favorites, 👍/👎, downloads, opening them full size, copying the prompt or seed, deleting them, and asking for the same prompt again. This copy is linked to a pseudonym of your account (a hash of its ID), not to your email.
Safety records: when our automatic filter blocks an image prompt, we record the prompt text, the rule it triggered, your account and the time.
Technical data: your IP address and basic request data, used briefly to protect the Service (for example, to limit repeated login attempts).
Waitlist: your email, if you joined the waitlist.

Why we use it, and on what legal basis

To provide the Service — account, chats, images, gallery, plan limits and billing. Basis: our contract with you.
To keep the Service safe — preventing abuse, enforcing our Acceptable Use Policy, keeping safety records of blocked prompts. Basis: our legitimate interest in a safe service and, where applicable, our legal obligations.
To train and evaluate our AI models — using your chats, images, prompts and the signals above, while training use is on. Basis: our legitimate interest in improving our models; you can object anytime with the switch described below.
Billing and accounting records. Basis: our contract and our legal obligations (tax and accounting).
Emails: account emails (verification, password reset, billing) as part of the Service; product news only if you joined the waitlist or asked for them — every such email has an unsubscribe link. Basis: contract / your consent.

Training use and the switch

Training use is on by default. You can turn it off anytime in Settings → Data & training (or from the note under the image composer).

On: your chats and a copy of each image you generate — with its prompt, settings and your interactions — are used to train and evaluate our models. Deleting an image from your gallery removes it from your gallery but keeps its training copy, because what you didn’t want helps a model learn too.
Off: nothing new from your chats or images is collected for training. If you delete an image while training use is off, its training copy is deleted too.
What was collected before you turned it off stays in our training data unless you ask us to delete it (see “Your rights”). Because training copies are linked to a hashed account ID, we can find and delete them on request.
Tester program: training use stays on while you’re in the program.
Safety records of blocked prompts are not training data and are kept regardless of this switch.

We don’t sell your data, run ads, or share your chats or images with other users.

Who else processes it

We use these providers, under contracts that let them process data only on our instructions:

Cloudflare — hosts the website, the app and the API; stores our database (Cloudflare D1) and your images and training copies (Cloudflare R2); protects and routes traffic, including the secure connection to our own hardware; cookieless web analytics on the website. Cloudflare is a US company; data may be processed across its global network.
RunPod — cloud GPUs that run our models: text generation, and image generation when our own hardware is unavailable. RunPod is a US company.
Our own hardware — a GPU server that we own and operate in Spain generates most images. It receives the prompt and settings of each image and a pseudonymous identifier, never your email or name.
Resend — sends our emails. Resend is a US company.
Getnet / Redsys — process card payments for paid plans. Both are based in Spain.

When data leaves the EU/EEA, we rely on the safeguards the GDPR requires, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Cookies and local storage

We use one cookie, to keep you signed in; it’s strictly necessary, so there’s no cookie banner. The app also keeps a few things in your own browser: preferences (language, last panel, image format), a local copy of your chats and unsent drafts, and the images still in progress. No tracking cookies, no ads.

How long we keep it

Account and settings: while your account exists.
Chats: until you delete them or your account.
Gallery images: until you delete them. A deleted image leaves only a small record without the image or prompt, for up to 40 days, so that deleting doesn’t reset your plan’s image count.
Training data: for as long as we use it to train and evaluate our models, unless you ask us to delete it.
Safety records of blocked prompts: no automatic deletion — for as long as they’re needed to keep the Service safe and meet our legal obligations.
Billing records: as long as tax and accounting law requires.
Waitlist email: until you unsubscribe or ask us to delete it.

You can ask us to access, correct, delete, export, restrict or stop processing your data, and object to its use for training at any time (the switch does this for new data; email us for data already collected). You can also lodge a complaint with your data protection authority — in Spain, the AEPD (aepd.es). To exercise any of these, email us from your account’s address.

You must be at least 18 years old to use the Service (see our Terms of Service). We don’t knowingly collect data from minors.

Contact

Questions or requests about your data: hello@vaelico.ai.

Changes

If we update this policy, we’ll change the date at the top. We’ll announce material changes to account holders, and to active subscribers before they take effect.