Privacy
Privacy Policy
How we handle your personal information, creative content and account records.
- Effective
- Version
- 2026-11-03
- Applies to
- Website & workspace
01Who we are
Vaiyah (ABN 39 959 127 632) is an Australian creative software business providing vaiyah.com and tools for generating and editing images, video and audio.
This policy explains how we handle personal information when you browse, use Vaiyah or contact us. For privacy enquiries or an accessible copy, email support@vaiyah.com.
02Information we collect
We collect information you enter, upload or send us, technical information from your device, generation results and status from AI providers, and payment confirmations from Stripe.
- Account details: email, display name, password hash, age and region confirmations, country/state and overseas-use declarations, policy acknowledgements, preferences, verification, sessions, recovery and two-factor authentication records.
- Creative content: prompts, reference files, images, video, audio, masks, project names, timeline settings and outputs you submit or save. Brand Studio content can include business descriptions, brand guides, vector artwork, palettes, font files, imagery, uploaded PDFs and approved brand versions. Files may include metadata and information about other people.
- Transactions: purchases, balances, reservations, generation charges, conservation contributions, receipts, refunds and Stripe payment and billing-location records. We compare billing location with your declaration for tax treatment. For optional auto-top-ups, we also store your limits, consent, payment identifiers, card brand and last four digits. Stripe handles card details; Vaiyah does not collect full card numbers or security codes.
- Technical and security records: IP addresses, browser and device details, request times, job and provider identifiers, errors, sign-in activity and audit events.
- Correspondence: support enquiries, privacy requests, complaints, content reports and their attachments.
03Why we use it
We use this information to run accounts and creative features, verify eligibility, manage credits and payments, provide support, investigate faults, prevent fraud and abuse, handle safety reports and meet legal obligations.
Authorised people may review relevant content and records for support, safety, security, disputes or legal requests. Access is limited to what the task requires.
We do not sell personal information, use private creative content for targeted advertising or train our own AI models on it.
You can browse or ask general questions without identifying yourself. An account needs an email address, and creative features need the content required to perform the requested task.
04Creative content and AI
AI requests send prompts, relevant reference files, settings and request identifiers through Vercel AI Gateway or Atlas Cloud to the selected model’s serving provider, directly to Google Cloud for eligible promotional image and video generation and image editing, or directly to QuiverAI for vector illustrations, logos, revisions and image-to-vector conversion. Providers return results, usage and status information. The model developer and serving provider may be different organisations; contact us with a job reference to check a particular route.
Atlas Cloud has confirmed that prompts, reference files and results are not used for AI training across all models it serves for Vaiyah, including every available FLUX option. Vercel AI Gateway requests use its no-training provider filter, which rejects requests without a qualifying route.
Google Cloud does not use promotional generation content to train its models without permission, which Vaiyah does not grant. Even when providers don’t use your content for training, they may keep it to run their services, monitor abuse or meet legal obligations.
Direct QuiverAI requests include your illustration or logo instructions and any artwork or image references needed for the chosen operation. We disable training on our QuiverAI account and check its effective no-training policy before sending creative content. QuiverAI may still store customer content and operational records under its data controls; this is not a zero-retention service.
Brand Studio’s manual logo, font, image and PDF editing runs in your browser. Saving a brand to your account sends its document and embedded artwork, fonts and images to Vaiyah. AI setup stores your submitted brief, relevant brand content and generated result in your selected account workspace for recovery across devices. Ordinary local PDF edits do not send the PDF to an AI provider.
For safety checks, OpenAI may receive prompts, rewritten text, image inspection copies, sampled video frames and audio clips for transcription or moderation. Vaiyah’s automated checks focus on child sexual exploitation, sexualised depictions of children and grooming. Generation providers also apply their own content rules. This processing is for safety, not model training. We request no saved response history for context checks, although provider abuse-monitoring and legal retention may still apply. Automated checks can make mistakes and may need review.
Video Studio imports and device exports process media in your browser. Saving a sequence can send its document, file names and timeline settings to Vaiyah; local originals remain on your device unless you choose a cloud upload or AI feature. Editing entirely on your device is not sent for safety checks.
Only submit another person’s information, image or voice with permission or another lawful basis, and avoid unnecessary sensitive information. Accounts are for adults aged 18 or older. Contact us if a child has supplied personal information without appropriate authority.
05Team workspaces
We record team names, invitations, membership, roles, sharing preferences, spending limits and activity. Invitations must be accepted by an account with the invited verified email. Members can see each other’s display name, email and role.
The lead can see all work saved in the team workspace, including prompts, assets, folders, sequences, image edits and each member’s spending. Other members can access assets shared with them. Joining a team does not share your personal workspace or the lead’s saved card and personal payment history.
Leaving or being removed ends your team access. Team work and necessary creator and spending records remain with the team, including after personal account closure. Contact support@vaiyah.com about access, correction or deletion of retained personal information; applicable retention requirements may limit deletion.
06Service providers and disclosure
Service providers receive information relevant to the features they supply.
We may disclose relevant information to professional advisers, as required or authorised by law, or when reasonably necessary to investigate fraud, protect rights or address safety risks. A business transfer may include relevant records, subject to confidentiality and privacy protections.
- Cloudflare: website and application hosting, network security, private media storage and former launch-list records. Requests and logs may be processed across its global network.
- Neon: account and workspace database, primarily in Sydney, Australia. Administration, support and subprocessors may involve overseas processing.
- Resend: account messages and the former launch mailing list. Customer email data is stored in the United States; our sending configuration also uses Tokyo.
- Google Workspace: support email and business correspondence, including attachments.
- Google Cloud: promotional image and video generation and image editing, including prompts, selected reference files, outputs and usage records.
- Vercel AI Gateway, Atlas Cloud and AI serving providers: generation and editing requests, outputs, usage and delivery records. OpenAI also provides safety checks.
- QuiverAI: vector illustrations, logos, revisions and image-to-vector conversion, including prompts, relevant reference content, outputs and usage records.
- Stripe: checkout, payments, fraud prevention, refunds and disputes.
- Ecologi: tree purchases funded by conservation contributions. Orders contain Vaiyah’s business name, reference and quantity, without your content, name or email.
- Sentry, when configured: errors and operational context. Default personal identifiers are disabled, although diagnostics may contain request or error information.
07Information outside Australia
Information may be processed outside Australia, including the United States for Vercel and Resend, and Japan for our Resend sending region. BytePlus identifies the United States, Singapore and Malaysia. Cloudflare, Google and AI serving providers may use additional countries through their infrastructure and subprocessors.
Overseas privacy laws may differ. We use access restrictions, provider agreements and security controls, and take steps required by applicable law for overseas disclosures. The provider links explain their practices; contact us for details about a particular request.
09Retention and deletion
We keep information while needed to provide the service, resolve jobs, payments or support requests, protect security or meet legal obligations. We delete or de-identify it when no longer needed.
Archiving hides an asset and can be reversed. Deleting removes it from active use and schedules its files and derivatives for permanent deletion after 30 days. Legal holds, unresolved operations or storage errors can delay deletion; contact us to check or expedite a request.
Account closure signs you out and stops new spending while active jobs, remaining credit and retained records are reviewed. Request closure in Account settings or at support@vaiyah.com.
Personal saved brand documents and their approved versions are scheduled for deletion 30 days after account closure, once outstanding work and payments are resolved. Team brands remain with the team. Removing a completed AI setup history item removes its recoverable creative result; necessary billing evidence is retained.
Transaction, tax, security and dispute records may be kept to meet legal obligations or resolve claims, with use restricted to those purposes. Backups and provider copies follow their retention cycles and legal requirements; device exports remain with their owner.
Former launch-list emails and consent records are used for launch messages and signup preferences, not a general newsletter. Their original retention periods still apply: unconfirmed requests are removed after 30 days, and the confirmed list is reviewed within 90 days after launch. Unsubscribe preferences are retained to prevent unwanted messages. You can unsubscribe or request deletion at support@vaiyah.com.
10How we protect information
We protect information with encrypted connections, private file access, password hashing, protected sessions, restricted administrative access and audit records. Administrative access requires additional authentication.
Report suspected unauthorised access to support@vaiyah.com. We investigate suspected breaches and notify affected people and regulators where required by law.
11Access, correction and your choices
Account settings lets you change your display name and password, manage preferences, revoke sessions and export account records. Download media separately from Assets. Contact us to correct information you cannot change yourself.
To access, correct or delete personal information, or close an account, email support@vaiyah.com. We may verify your identity before disclosing or changing private records.
We aim to respond within 30 days. If we need longer or cannot fulfil a request, we will explain the reason and next steps unless legally restricted. Requests are free; any permitted charge for providing access will be explained beforehand.
Unsubscribing from launch messages does not stop essential account, transaction or security messages. You can contact us to exercise additional privacy rights that apply where you live.
12Contact and complaints
Send privacy complaints to support@vaiyah.com with the issue and outcome you seek. We will investigate and aim to respond within 30 days, keeping you informed if we need longer.
If you are not satisfied, or have no response after 30 days, ask the Office of the Australian Information Commissioner (OAIC) whether it can consider your complaint, or contact another applicable privacy regulator.
13Changes to this policy
We update this policy as our services or practices change. Material changes will be notified through the website, your account or email, with additional consent where required. Earlier versions are available on request.