Privacy Policy

What we collect

When you register with email and password, we verify your email address and store your email plus a salted cryptographic password hash—never plaintext passwords. When you sign in with Google, we receive your name, email address, and profile avatar. When you run AI generations, we store your text prompt, any reference image you upload, and the sanitized SVG output. Local browser Image-to-SVG conversions on /image-to-svg run on your device without uploading the image. Payment card details are handled directly by our merchant-of-record payment partner; GPTSVG Studio never sees your full card number.

How we use your data

We use your prompts and reference images solely to generate the vector graphics you request. We use your email address to authenticate your account, deliver transactional receipts and job notifications, and respond to support or takedown inquiries. We do not sell personal data, send unsolicited marketing emails, or train foundation models on your private uploads.

Storage, anti-abuse & retention

Assets are stored in private cloud storage. Uploaded reference images are deleted automatically 7 days after upload and generated cloud SVGs are kept for 30 days after generation, unless you delete them or close your account earlier. Order records are retained as required for tax and accounting law. To prevent automated abuse of free sign-up credits, we store a salted one-way hash of deleted account emails and temporary IP rate-limit counters.

Draft images chosen before signing in stay in your local browser storage for up to 24 hours. Images transferred via QR phone upload pass through encrypted temporary storage and are deleted immediately upon transfer (or within 1 hour).

Safety & SVG sanitization

Prompts and uploaded images may be screened by automated safety classifiers solely to enforce our Acceptable Use rules. Public and free-tier actions are protected by Cloudflare Turnstile human verification. Every generated SVG passes through a strict XML sanitizer before storage.

Cookies and analytics

We use strictly necessary first-party storage for your sign-in session and light/dark studio theme.

We also use a first-party attribution cookie (vt_attr, 90 days) to measure which channels lead to sign-ups and credit purchases; it is never shared with ad networks.

We do not load third-party advertising or cross-site tracking cookies.

Shared vectors

Vectors are private to your account unless you explicitly create a /v/ share link. Share pages hide your email address, carry a noindex header, and stop working as soon as you unshare or delete the asset.

Service providers

Cloudflare hosts our web application, database, queues, and storage. Google provides OAuth sign-in when selected. AI SVG and flat-illustration requests are routed via yir.ai to the GPT Image 2.6 SVG (openai/gpt-image-2.6-flare) model infrastructure. Waffo processes payments and approved refunds as merchant of record. Resend / Cloudflare Email delivers transactional emails.

Children

GPTSVG Studio is intended for users aged 18 and older and is not directed to children under 13. Email support@gptsvg.com if you believe a minor has submitted personal data.

Your rights

You can download or delete your vectors anytime, export all account data as JSON under Settings, or permanently delete your account. Contact support@gptsvg.com for privacy inquiries.