Privacy Policy
Last updated: 2026-10-12
VersoLoom ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy ("Policy") explains how we collect, use, store, and share your personal information when you use the VersoLoom website and AI image-generation service at https://versoloom.com (the "Service"), and the rights available to you.
Please read this Policy carefully before using the Service. By using the Service, you agree to this Policy. We may update this Policy periodically and will notify you of material changes by updating the "Last Updated" date on this page and, where appropriate, by email or in-product notice.
1. Data Controller
The data controller for this Service is:
- Operator: VersoLoom
- Privacy Email: support@versoloom.com
- Data Protection Officer (DPO): Not applicable
2. Personal Information We Collect
2.1 Information You Provide Directly
- Account Info: email address, display name, locale — provided at sign-up (or shared by Google/GitHub when you sign in through them: basic profile information only).
- Photos You Upload: photos you add as references for image generation or editing — these may depict real people (yourself, or people who have consented). They are a core input of the Service.
- Prompts: the optional short description you may type to steer a generation.
- Payment Info: transaction amount and payment status. Full card numbers are not stored by us — card data is processed by our payment processors (see Section 5).
- Communications: emails, support tickets, and feedback you send us.
2.2 Information We Collect Automatically
- Device & Network: IP address, browser type, operating system, time zone.
- Usage Data: pages visited, feature usage, generation activity.
- Log Data: request timestamps, session logs required for security, rate limiting, and support, error logs.
- Moderation records: your prompt text is screened by automated content moderation before generation, and the screening decision plus the prompt are logged for compliance auditing.
2.3 Information We Do NOT Collect
We do not collect precise location, contacts, or your device's photo library beyond the photos you explicitly upload. We do not train AI models on your photos, and we do not sell your data.
3. How We Use Your Information
| Purpose | Legal Basis |
|---|---|
| Service delivery & maintenance | Contract performance |
| Billing & payment processing | Contract performance |
| Customer support | Contract / Legitimate interests |
| Service notifications (billing, security, policy) | Legitimate interests |
| Security & fraud prevention | Legitimate interests |
| Product analytics & improvement | Legitimate interests |
| Legal compliance | Legal obligation |
We do not send marketing communications. Email from us is limited to transactional and security notices (receipts, completion notices, password and billing messages).
We may aggregate or anonymize data for statistical purposes. Such data cannot be linked to any individual.
4. Cookies & Tracking Technologies
| Type | Purpose | Disableable |
|---|---|---|
| Strictly necessary | Login sessions, core functionality | No |
| Functional | Language preferences, personalization | Yes |
| Analytics | Anonymous usage stats, product optimization | Yes |
We do not currently use third-party analytics or advertising cookies. If we ever enable analytics, it will be disclosed here first. You can clear or block cookies via your browser settings; blocking strictly necessary cookies will break sign-in.
5. Sharing & Disclosure
We do not sell your personal information, including as defined under applicable laws such as the CCPA. We share your information only in the following circumstances:
- Service Providers: cloud, payment, support, and analytics vendors, bound by confidentiality. Payment card data is processed exclusively by our PCI-DSS certified payment processor, Waffo.com Limited (Waffo Pancake), and is not stored on our servers. Where "Waffo" appears on your card statement, it refers to them.
- Legal Requirements: where required by law, court order, or a lawful regulatory request.
- Business Transactions: in a merger, acquisition, or similar event, with advance notice and continued protections.
- With Your Consent: for any other purpose, with your explicit prior consent.
6. Data Security
- Encryption in transit: TLS / HTTPS.
- Secure storage: passwords and sensitive data are encrypted or hashed.
- Access controls: least-privilege principle; staff sign confidentiality agreements.
- Regular security audits and vulnerability assessments.
- Additional measures: per-account access enforced at the private storage layer with signed, private reads; automated prompt and output screening; rate limiting and session security.
In the event of a security incident affecting your rights, we will notify you and the relevant authorities within the applicable statutory timeframe as required by law. Please keep your credentials secure and do not share them.
7. Data Retention
| Data Type | Retention Period | Upon Expiry |
|---|---|---|
| Account information | While active; deleted upon account deletion | Delete or anonymize |
| Transaction records | Per regulations, typically 3 years | Delete or archive |
| Support records | Audit purposes; no automatic expiry | Secure deletion |
| Security audit logs | Audit purposes; no automatic expiry | Secure deletion |
| Generated images | Signed-in: kept 30 days after generation (admin-configurable) or until you delete them — whichever comes first; guest (no account): automatically deleted 30 minutes after generation | Deletion from storage |
8. Your Data Rights
To exercise any right below, contact us at support@versoloom.com; you will get a first reply within 3 business days and the request completed within the statutory window (up to 30 calendar days under GDPR, 45 under CCPA).
| Right | Description |
|---|---|
| Right to be informed | Know what data we collect and how we use it |
| Right of access | Obtain a copy of your personal information |
| Right to rectification | Correct inaccurate or incomplete data |
| Right to erasure | Request deletion under certain conditions |
| Right to restrict processing | Temporarily suspend processing in certain cases |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interests |
| Right to withdraw consent | Withdraw consent for consent-based processing |
You may also lodge a complaint with your local data protection authority.
9. Marketing & Opt-Out
With your consent, we may send marketing communications about product updates and occasional offers via email. You can opt out at any time: click "Unsubscribe" in any email, disable marketing in your account settings, or contact us. Opting out does not affect essential service notifications (e.g., billing, security alerts).
10. International Data Transfers
Our servers and partners may be located in the United States, Singapore, and China. For international transfers, we safeguard your data through:
- Data processing agreements incorporating EU Standard Contractual Clauses (SCCs).
- Transfers only to recipients with an equivalent level of protection.
11. Children's Privacy
The Service is intended for users aged 18 and above. We do not knowingly collect information from children below that age. If you believe your child has provided information, contact us immediately and we will promptly delete it.
12. Third-Party Links & Services
The Service may include links to, or integrations with, third-party services. This Policy applies only to data we directly collect. We are not responsible for third-party privacy practices and encourage you to review their policies before use.
13. Policy Changes
For material changes, we will provide at least 14 days' advance notice via platform announcement or your registered email, and update the "Last Updated" date at the top of this page. Continued use after the effective date constitutes acceptance.
14. Contact Us
If you have any questions about this privacy policy, please contact us at support@versoloom.com, we respond within 3 business days.