Privacy Policy
Last updated: 2026-10-30
VersoLoom ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy ("Policy") explains how we collect, use, store, and share your personal information when you use the VersoLoom website and AI image-generation service at https://versoloom.com (the "Service"), and the rights available to you.
Please read this Policy carefully before using the Service. By using the Service, you agree to this Policy. We may update this Policy periodically and will notify you of material changes by updating the "Last Updated" date on this page and, where appropriate, by email or in-product notice.
1. Data Controller
The data controller for this Service is:
- Operator: VersoLoom
- Privacy Email: support@versoloom.com
- Data Protection Officer (DPO): Not applicable
2. Personal Information We Collect
2.1 Information You Provide Directly
- Account Info: email address, display name, locale — provided at sign-up (or shared by Google/GitHub when you sign in through them: basic profile information only).
- Photos You Upload: photos you add as references for image generation or editing — these may depict real people (yourself, or people who have consented). They are a core input of the Service.
- Prompts: the optional short description you may type to steer a generation.
- Payment Info: transaction amount and payment status. Full card numbers are not stored by us — card data is processed by our payment processors (see Section 5).
- Communications: emails, support tickets, and feedback you send us.
2.2 Information We Collect Automatically
- Device & Network: IP address, browser type, operating system, time zone.
- Usage Data: pages visited, feature usage, generation activity.
- Log Data: request timestamps, session logs required for security, rate limiting, and support, error logs.
- Moderation records: your prompt text is screened by automated content moderation before generation, and the screening decision plus the prompt are logged for compliance auditing.
2.3 Information We Do NOT Collect
We do not collect precise location, contacts, or your device's photo library beyond the photos you explicitly upload. We do not train AI models on your photos, and we do not sell your data.
2.4 Signing In with Google — Google API Services
If you create an account or sign in with Google, VersoLoom accesses the following Google user data: your Google account identifier, name, email address, and profile picture. We request no other Google scopes — we do not access Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google product data.
How we use it. We use this Google user data only to:
- create and authenticate your account;
- display your name and profile picture inside the Service;
- send you essential service messages (security alerts, billing notices, material policy changes).
What we do not do with it. We do not use Google user data for advertising of any kind (targeted, personalized, retargeted, or interest-based), we do not sell it, we do not provide it to data brokers or information resellers, we do not use it to determine credit-worthiness or for lending purposes, and we do not use it to create databases for resale. We do not use Google user data to develop, improve, or train generalized, personalized, or non-personalized AI or machine learning models. We do not use Google Workspace APIs, and no Google Workspace API data is used to develop, improve, or train any AI or ML model.
Google APIs and image generation. We do not use Google APIs — including the Gemini API — to generate, edit, or process images. Image generation is performed by third-party model-hosting providers, and Google user data is never sent to them.
How we share it. We do not share, transfer, or disclose Google user data to third parties except to the infrastructure providers that host and operate the Service on our behalf (database and application hosting, email delivery, error logging), which are bound by confidentiality and data-processing obligations. We may disclose it where required by law, court order, or a lawful regulatory request, or with your explicit consent. We do not transfer Google user data for any purpose other than providing or improving user-facing features of the Service.
How we protect it. Google user data is transmitted over TLS/HTTPS and stored in access-controlled databases. Access follows least privilege, is limited to staff who need it to operate the Service, and is covered by confidentiality obligations. We do not allow humans to read Google user data except where necessary for security, abuse investigation, or legal compliance.
Retention and deletion. Google user data is retained while your account is active. You can delete your account at any time in the Service or by emailing support@versoloom.com; we delete the associated Google user data within 30 days, except records we are required to keep by law. You can also revoke VersoLoom's access to your Google account at any time at https://myaccount.google.com/permissions.
VersoLoom's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3. How We Use Your Information
| Purpose | Legal Basis |
|---|---|
| Service delivery & maintenance | Contract performance |
| Billing & payment processing | Contract performance |
| Customer support | Contract / Legitimate interests |
| Service notifications (billing, security, policy) | Legitimate interests |
| Security & fraud prevention | Legitimate interests |
| Product analytics & improvement | Legitimate interests |
| Legal compliance | Legal obligation |
We may aggregate or anonymize data for statistical purposes. Such data cannot be linked to any individual.
4. Cookies & Tracking Technologies
| Type | Purpose | Disableable |
|---|---|---|
| Strictly necessary | Login sessions, core functionality | No |
| Functional | Language preferences, personalization | Yes |
| Analytics | Anonymous usage stats, product optimization | Yes |
Analytics tools in use: Google Analytics. We do not use advertising cookies. You can manage your preferences via your browser settings; clearing or blocking cookies also works, though blocking strictly necessary cookies will break sign-in.
5. Sharing & Disclosure
We do not sell your personal information, including as defined under applicable laws such as the CCPA. We share your information only in the following circumstances:
- Service Providers: cloud, payment, support, and analytics vendors, bound by confidentiality. Payment card data is processed exclusively by our PCI-DSS certified payment processor, Waffo Pancake, and is not stored on our servers.
- Legal Requirements: where required by law, court order, or a lawful regulatory request.
- Business Transactions: in a merger, acquisition, or similar event, with advance notice and continued protections.
- With Your Consent: for any other purpose, with your explicit prior consent.
6. Data Security
- Encryption in transit: TLS / HTTPS.
- Secure storage: passwords and sensitive data are encrypted or hashed.
- Access controls: least-privilege principle; staff sign confidentiality agreements.
- Regular security audits and vulnerability assessments.
- Additional measures: per-account access enforced at the private storage layer with signed, private reads; automated prompt and output screening; rate limiting and session security.
In the event of a security incident affecting your rights, we will notify you and the relevant authorities within the applicable statutory timeframe as required by law. Please keep your credentials secure and do not share them.
7. Data Retention
| Data Type | Retention Period | Upon Expiry |
|---|---|---|
| Account information | While active; deleted upon account deletion | Delete or anonymize |
| Transaction records | Per regulations, typically 3 years | Delete or archive |
| Support records | Audit purposes; no automatic expiry | Secure deletion |
| Security audit logs | Audit purposes; no automatic expiry | Secure deletion |
| Generated images | Signed-in: kept 30 days after generation (admin-configurable) or until you delete them — whichever comes first; guest (no account): automatically deleted 30 minutes after generation | Deletion from storage |
8. Your Data Rights
To exercise any right below, contact us at support@versoloom.com; you will get a first reply within 3 business days and the request completed within the statutory window (up to 30 calendar days under GDPR, 45 under CCPA).
| Right | Description |
|---|---|
| Right to be informed | Know what data we collect and how we use it |
| Right of access | Obtain a copy of your personal information |
| Right to rectification | Correct inaccurate or incomplete data |
| Right to erasure | Request deletion under certain conditions |
| Right to restrict processing | Temporarily suspend processing in certain cases |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interests |
| Right to withdraw consent | Withdraw consent for consent-based processing |
You may also lodge a complaint with your local data protection authority.
9. Marketing & Opt-Out
With your consent, we may send marketing communications about product updates and occasional offers via email. You can opt out at any time: click "Unsubscribe" in any email, turn off marketing emails in Settings → Profile, or contact us. Opting out does not affect essential service notifications (e.g., billing, security alerts).
10. International Data Transfers
Our servers and partners may be located in the United States, Singapore, and China. For international transfers, we safeguard your data through:
- Data processing agreements incorporating EU Standard Contractual Clauses (SCCs).
- Transfers only to recipients with an equivalent level of protection.
11. Children's Privacy
The Service is intended for users aged 18 and above. We do not knowingly collect information from children below that age. If you believe your child has provided information, contact us immediately and we will promptly delete it.
12. Third-Party Links & Services
The Service may include links to, or integrations with, third-party services. This Policy applies only to data we directly collect. We are not responsible for third-party privacy practices and encourage you to review their policies before use.
13. Policy Changes
For material changes, we will provide at least 14 days' advance notice via platform announcement or your registered email, and update the "Last Updated" date at the top of this page. Continued use after the effective date constitutes acceptance.
14. Contact Us
If you have any questions about this privacy policy, please contact us at support@versoloom.com, we respond within 3 business days.