What your agent sends us, and what happens to it

Only what it puts into a tool call: the prompt, the settings (tier, size, seed, preset) and any reference image, audio or mask it passes, plus your API key in the request header.

The MCP server runs on our side and can't read your disk or your repository. A local file reaches us only when your agent uploads it as an input, through a single-use upload link it asks for with vvgen_create_upload. Your code stays on your machine unless your agent pastes it into a prompt.

Don't put secrets or personal data in prompts you wouldn't want reproduced (see the shared cache below).

DeepInfra runs the models and the safety model that checks requests. It receives the inputs of each request, never your name or email. Some proprietary models behind DeepInfra are run by their makers' own APIs (for example Google, Black Forest Labs and Bria), which then receive that request's inputs.

Before any paid call, the final prompt and the input images are checked by that safety model. A blocked request is refused before anything is generated and costs nothing. A request in the child-safety category also suspends the account until a person reviews it, and you can ask for a person to review any block.

We don't use your inputs or outputs to train AI models, and we don't sell your data. Sign-in goes through WorkOS and payment through Paddle; we never see your card. The full list of providers is in the privacy policy.

The shared cache. To make repeat requests fast and free, we keep a shared cache of results keyed by a hash of the exact request (model, prompt, settings, seed). Entries carry no account id. If another customer later sends exactly the same request, they get the same file, so an identical output shows that the same request was made before. Your files, history and account are never visible to other customers.

Delete it in Settings at any time. That revokes your API keys and deletes your files, asset history, jobs and style anchors, then your user record. Usage and credit records are anonymised and keep only the amounts. Paddle keeps its own purchase records.

One thing stays: a keyed hash of your email address (never the address), so the 50-credit sign-up gift can't be claimed twice.

Server logs never contain full prompts at the normal level, API keys or provider keys. Error reports go to Sentry with technical data and your account id, never prompts or API keys: a scrubber removes request bodies, prompt fields, keys and email addresses before a report leaves the server.

The site sets no advertising, analytics or tracking cookies, only the ones sign-in and checkout need.

Your agent gets a quote in credits before every call and the credits charged after it, with the dollar value beside them. Credits are prepaid, so your balance is a hard limit: a call quoted above it is refused before it runs, and your agent is told how to top up. There is no subscription and nothing renews on its own.

Failed or empty results and cache hits cost nothing. Paid credits never expire; the 50 free credits expire after 90 days. Prices are on the pricing page.

Each tier runs one model we checked for commercial use of its output, and every result names the model and its licence. When a model's terms don't clearly allow commercial use, the result carries a warning. Today that applies to: Video.

Some model makers add their own marks: Google's models embed a SynthID watermark, which must not be removed, and Black Forest Labs asks that outputs aren't passed off as real photographs. Each tier's terms are on what powers each tier.

Every output has a record: the model and the tier asked for, the prompt, seed and settings, the inputs it was made from (by asset id and SHA-256), the licence and the SHA-256 of the file. Your agent gets it with the result, and the full record comes back from vvgen_get_file or GET /v1/assets/{id}.

Image files can carry the record embedded, and it includes your prompt, so anyone you share the file with can read it. You may strip it before publishing. Files that arrive with the model maker's own signed credentials (C2PA) keep those untouched instead.

To check a file, vvgen provenance file.png prints the embedded record (or the record the vvgen CLI saved beside a download) and says whether the file's SHA-256 still matches it.