Privacy Policy
1. Who we are
This Privacy Policy explains how ViperLabs (“we”, “us”, “our”) processes personal data when you use our website, Studio and related services (the “Service”). We act as controller for account and billing data we collect. This draft is prepared for a UK digital SaaS / AI creative platform and is not legal advice.
2. Data we collect
- Account data — such as display name, email address, authentication identifiers and profile settings you provide.
- Billing data — subscription and purchase records, Venom ledger entries, and payment metadata. Card payment details are processed by Stripe; we do not store full card numbers on our servers.
- Usage and content — prompts, generation requests, project and asset metadata, and technical logs needed to operate and secure the Service.
- Technical data — IP address, device/browser information, cookies or similar technologies required for sessions and security.
3. Why we process data
We process personal data to:
- provide, authenticate and secure the Service (contract / legitimate interests);
- process payments and maintain billing records (contract / legal obligation);
- improve reliability and prevent abuse (legitimate interests);
- comply with law and respond to lawful requests (legal obligation).
Where we rely on consent (for example optional cookies beyond what is strictly necessary), you may withdraw consent at any time without affecting prior lawful processing.
4. AI generation and third-party providers
To fulfil generation requests we may transmit prompts and related inputs to third-party AI or infrastructure providers. Those providers process data under their own terms and privacy notices. Do not submit special-category or sensitive personal data in prompts unless you have a lawful basis and accept the residual risk of third-party processing.
5. Sharing
We share personal data only as needed with:
- payment processors (Stripe) for checkout and billing;
- authentication and infrastructure providers that host or secure the Service;
- AI model or media providers required to run a generation you request;
- professional advisers or authorities where required by law.
We do not sell personal data.
6. International transfers
Providers may process data outside the UK. Where required, we use appropriate safeguards such as UK adequacy regulations or standard contractual clauses offered by those providers.
7. Retention
We retain account and billing records for as long as your account is active and thereafter as needed for legal, tax and dispute purposes. Generation assets and logs are retained according to product settings and operational needs, then deleted or anonymised when no longer required.
8. Security
We apply technical and organisational measures appropriate to the risk, including access controls and encrypted transport. No method of transmission or storage is completely secure.
9. Your rights
Under UK GDPR you may have rights to access, rectify, erase, restrict or object to processing, and to data portability, subject to legal limits. You may also lodge a complaint with the Information Commissioner’s Office (ICO). To exercise rights, use the contact options on our Support section after signing in where possible so we can verify your identity.
10. Children
The Service is not directed at children under 18. We do not knowingly collect personal data from children.
11. Changes
We may update this Privacy Policy from time to time. The “Last updated” date will change when we do. Significant changes may also be notified in the Service.
12. Contact
Privacy questions can be raised through My Account after sign-in, or via any support email published on our Support section when configured.