Privacy Policy
in forceVersion 1.1, last updated 2026-10-30
Last updated: 30 October 2026
This policy explains what personal data vincevangen collects, why, who we share it with, how long we keep it,
and your rights. It covers vincevangen.com, api.vincevangen.com, our MCP server and the vvgen client when
it talks to our service.
1. Who we are
The controller (in Singapore terms, the organisation responsible) is Hecatronix Pte. Ltd., a Singapore company, UEN 202510010W.
- Data Protection Officer (required by Singapore's PDPA; also our privacy officer for Canada): [email protected].
- EU and UK representative (GDPR and UK GDPR Art. 27): we have not appointed one. People in the EU and UK can write to us directly at [email protected].
The laws we follow: Singapore's Personal Data Protection Act 2012 (PDPA); the EU GDPR and UK GDPR for people in the EU/EEA and UK; Canada's PIPEDA for people in Canada. Where they differ, we apply the rule that protects you more, as far as we practically can.
2. The short version
- We collect what we need to run a paid developer API: your account, your keys, your requests and the files we make, your usage and your purchases.
- Your prompts and files go to our AI inference provider to be generated. We do not use them to train AI models and we do not sell your data.
- Generated and uploaded files are deleted 30 days after creation.
- Paddle handles payment; we never see your card.
- We do not use advertising or tracking cookies.
- You can download your data, correct it, or delete your account from the dashboard at any time.
3. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | email address, name, user and account ids, sign-in provider (email code, Google, GitHub), time of sign-up and last sign-in | you, via our login provider WorkOS |
| Credentials | API keys, stored only as a one-way hash plus a short display prefix | created by you |
| Requests (Inputs) | prompts, settings, reference images, audio and masks you upload or link | you or your coding agent |
| Outputs | images, video, audio we generate; post-processed versions | the Service |
| Provenance records | for each output: model, time, settings, your prompt, file hashes, licence | the Service |
| Usage and billing | each call's tier, model, credits charged, time, key used, cache hit or not; credit balances and grants | the Service |
| Purchases | Paddle transaction ids, pack bought, amount paid, refunds and chargebacks, country for tax | Paddle |
| Safety records | for a blocked request: time, account, key, categories, and a SHA-256 fingerprint of the prompt (not the prompt itself) | the Service's moderation |
| Technical | IP address, user agent, request ids, error reports | your browser or client |
| Free credit requests | your answers to the request form: where you heard about us, what you want to make, which tool you use, a description of your project, whether you would buy a pack; time of the request and whether credits were granted | you |
| Emails | which service emails we sent you (welcome, credits added, low balance) and when | the Service |
We do not ask for sensitive personal data. Please do not put personal data in prompts or upload photos of people unless you need to and have the right to. If you do, we process it as part of your Inputs.
4. Why we use it, and our legal basis
| Purpose | Data | GDPR / UK GDPR basis | PDPA basis |
|---|---|---|---|
| Create and run your account, sign you in | account, technical | contract | consent / deemed consent by conduct |
| Generate assets for you | Inputs, Outputs, provenance | contract | consent / deemed consent |
| Charge credits, show usage, keep accounts | usage, purchases | contract; legal obligation (tax, accounting) | consent; legal obligation |
| Prevent abuse: moderation, rate limits, fraud, duplicate sign-up gifts, more than one account per inbox | Inputs (checked, not kept), safety records, technical, account (your email address in a standard form, e.g. without a +tag) | legitimate interests (keeping the service safe and lawful) | legitimate interests exception |
| Review requests for free credits and learn how people find and use the service | free credit requests, account, usage | legitimate interests (deciding grants, improving the service) | consent (you choose to send the form) |
| Fix bugs and keep the service secure | technical, error reports | legitimate interests | legitimate interests exception |
| Service emails (receipts come from Paddle) | account, emails | contract | consent / deemed consent |
| Product news (only if you opt in) | consent | consent | |
| Respond to legal requests, enforce our terms | any relevant | legal obligation; legitimate interests | legal obligation / exceptions |
We send no marketing emails today. If we start, they will be opt-in only.
Automated decisions. Moderation is automated: a safety model decides whether a request runs. A request in the child-safety category also suspends the account pending human review. You can ask for a person to review any automated block or suspension (write to [email protected]).
No training, no sale. We do not use your Inputs or Outputs to train AI models, and we do not sell or rent personal data, or share it for cross-context behavioural advertising.
5. Who we share it with
We share personal data only with the providers below, and only what each needs. They process it on our behalf under contracts that require them to protect it (data processing agreements), except Paddle, which acts as an independent controller for the purchase.
| Provider | What they do | Data they receive | Location |
|---|---|---|---|
| DeepInfra (Deep Infra Inc.) | AI inference: runs the models, and the safety model that checks requests | Inputs (prompts, input files, settings); not your name or email | United States |
| Model makers reached through DeepInfra (Google, Black Forest Labs, Bria, Alibaba) | some proprietary models are run by their makers' own services; DeepInfra forwards the request | the Inputs for that request; not your name or email | where each maker runs its service, mostly the United States |
| WorkOS | sign-in (email codes, Google/GitHub login), bot and fraud protection (Radar) | email, name, sign-in events, IP, user agent | United States |
| Paddle (Paddle.com Market Ltd and affiliates) | merchant of record: checkout, payment, tax, receipts, refunds; independent controller for your purchase (Paddle privacy notice) | what you give at checkout; your account id | UK / United States |
| Resend | sends our service emails | email address, email content | United States |
| Vultr | hosts our servers, database and files | everything stored by the Service | United States (New York) |
| Cloudflare | Turnstile: checks that a person, not a bot, is sending the free credit request form or using the try page. It runs in your browser when you open those forms | IP address, user agent and browser signals for the check; not your answers, name or email | United States and Cloudflare's global network |
| Cloudflare (R2 storage, not yet in use) | off-site encrypted backups, once we enable it; until then backups stay on our Vultr server | everything stored by the Service | we will add the location here when enabled |
| Sentry (Functional Software Inc., not yet in use) | error reports from our api and website, once we enable it | technical data, account id; not prompts or API keys | United States |
We also disclose data when the law requires it, to protect people from serious harm (for example reporting child sexual abuse material), or to a buyer of our business (you will be told).
We will update this list before we add a new provider.
6. International transfers
We are in Singapore and most of our providers are in the United States. When your data leaves your country:
- EU/EEA: we rely on the European Commission's Standard Contractual Clauses, or the EU–US Data Privacy Framework where a provider is certified.
- UK: the UK International Data Transfer Addendum, or the UK Extension to the DPF.
- Singapore: we make sure recipients give a standard of protection comparable to the PDPA (PDPA s26 and the Transfer Limitation Obligation), through contracts.
- Canada: your data may be processed outside Canada and may be accessible to authorities there under local law.
7. How long we keep it
| Data | Kept for |
|---|---|
| Generated and uploaded files | 30 days after creation, then deleted |
| Asset history and provenance records (including your prompt) | while your account is open; deleted when you delete your account. They stay after the file itself expires |
| Shared response cache (see section 8) | up to 90 days, then deleted. Not linked to any account, so not removed when you delete yours |
| Account data | while your account is open; deleted on account deletion |
| A login at WorkOS that never became an account (email never verified, or a sign-up we refused) | deleted at WorkOS: refused sign-ups right away, unverified logins after 24 hours |
| API key hashes | until revoked or the account is deleted |
| Usage and purchase records | anonymised when you delete your account, and kept for 5 years for tax and accounting, as Singapore law requires |
| Sign-up gift record: a keyed hash of your email address, not the address itself. It only lets us check whether an address has already had the gift | kept after you delete your account, so the sign-up gift can't be claimed twice |
| Sign-up IP check: keyed hashes of your IP address and its network, not the addresses themselves | 30 days after sign-up, to stop repeat sign-ups |
| Free credit requests | while your account is open; deleted when you delete your account |
| Safety records (blocked requests) | 2 years, or longer if a report to authorities needs them |
| Server logs | about 30 days; logs never contain full prompts at normal level, API keys or provider keys |
| Error reports (Sentry, once enabled) | up to 90 days |
| Backups | up to about 8 weeks (14 daily + 8 weekly copies); deleted data disappears from backups as they rotate |
| Records held by Paddle | under Paddle's own policy |
8. The shared response cache (please read)
To make results faster and cheaper, we keep a shared cache of generation results. It is keyed by a hash of the exact request (model, prompt, settings, seed) and holds the result. Cache entries do not contain your account id. If another customer sends exactly the same request later, they receive the same result from the cache, and you may receive results first generated for someone else. Your files, history and account are never visible to other customers, but an identical request returns an identical output, which shows that the same request was made before.
Cache entries are kept for up to 90 days, then deleted. Because they carry no account id, deleting your account does not remove them. Do not put secrets or personal data in prompts you would not want reproduced.
9. Files you download
Image files we deliver (PNG, JPEG, WebP) carry an embedded provenance record that includes the prompt, the model and the settings. Anyone you share the file with can read it. You may strip this metadata before publishing a file. Some model providers also embed their own invisible watermark (for example Google's SynthID), which must not be removed.
10. Cookies
We use only cookies needed to run the site: the sign-in session cookie (set by our login provider WorkOS on our domain), the cookies Paddle's checkout needs while you pay, and anything Cloudflare Turnstile needs to run its bot check on the free credit request form and the try page. No advertising, analytics or tracking cookies. If we add analytics later, we will update this section first and ask for consent where required.
11. Security
API keys are stored only as hashes. Traffic is encrypted (TLS). Each account sees only its own data (enforced on every request). Backups are encrypted. Staff access is limited to people who need it. If a breach is likely to harm you, we notify you and the regulators within the legal time limits (PDPA: the PDPC within 3 calendar days of assessing a notifiable breach; GDPR: the supervisory authority within 72 hours).
12. Your rights
Depending on where you live, you can:
- access your data and get a copy (your dashboard shows most of it; ask us for the rest);
- correct it;
- delete it: delete your account in Settings, or ask us (some billing records are kept as section 7 says);
- take it with you (portability): download your files and request an export of your account data;
- object to processing based on legitimate interests, or restrict it;
- withdraw consent (PDPA, or marketing emails) at any time; we will tell you what that means for the service;
- ask for human review of an automated decision (section 4);
- complain to a regulator: Singapore's PDPC (pdpc.gov.sg), your EU data protection authority, the UK ICO (ico.org.uk) or the Office of the Privacy Commissioner of Canada (priv.gc.ca). Please contact us first so we can try to fix it.
Write to [email protected] from your account email. We answer within 30 days (PDPA access requests: as soon as reasonably possible, and within 30 days). We may need to verify your identity.
What account deletion does: revokes your API keys; deletes your files, asset history, jobs, style anchors and free credit requests; deletes your user record; anonymises usage and credit records (amounts are kept for accounting). We keep the keyed hash of your email from section 7, so the sign-up gift can't be claimed twice. Paddle keeps its own purchase records.
13. Children
The Service is not for anyone under 18 (see the Terms). We do not knowingly collect children's data. If you think a child has an account, tell us and we will delete it.
14. Changes
We will post changes here and update the date. For material changes we email you before they take effect.
15. Contact
Hecatronix Pte. Ltd., Singapore (UEN 202510010W). Data Protection Officer: [email protected].