Privacy Policy
Last updated: October 16, 2026
This Privacy Policy explains how Vetiver Labs ("we", "us", or "our") collects, uses, and protects information when you use our website and services (the "Service"). By using the Service, you consent to the practices described here.
1. Information We Collect
- Account information: When you sign in with a third-party provider (Google or Fanvue), we receive basic profile information such as your email address, display name, avatar, and a unique account identifier. For Fanvue, we also store your Fanvue handle and identifier to enable subscriber features and content delivery.
- Prompts & generation data: The text prompts you submit and metadata about your generations (such as settings used and timestamps).
- Generated images: We store the images you generate on our servers so they reappear in your account and gallery. They are private to your account and are not shown to other users unless you choose to share one to the community feed. You can delete any image from your library at any time. Images you mark as liked are flagged so you can filter your gallery by them; this is visible only to you.
- Community feed: If you share an image, it is shown to other signed-in users without your name or email, along with the prompt and settings if you allow remixing. We store likes and reports, including who made them, to run the feed and keep it safe. Unsharing a post takes it off the feed. Deleting the image from your library does not.
- Prompts used for feed images: To keep the feed full, we generate new images from prompts and settings previously entered on the Service and publish them on the feed, where other Pro users can see and remix those prompts. These images are never linked to you: they show no name, email or other account details, and are made with a new random seed rather than copied from your images. Prompts are screened for real people and prohibited content before use. If you do not want your prompts used this way, contact us and we will exclude your account.
- Feedback: Feature requests, bug reports and complaints you send from the feedback page, stored with the email you give us (and your account, if you are signed in) so we can follow up. Only our team sees them.
- Usage data: Your token balance, generation counts and similar information used to run the token system and enforce limits. We also keep first-party counts of pages visited, sign-ups, and clicks on Pro and payment buttons, so we can see how the Service is used. These stay on our servers and are not sold or shared with advertisers.
- Referral data: If you use the share program, we store your referral code, who signed up from your link, Reddit post URLs you claim, and tokens we credited. If you arrived from someone else's link, we store that so we can credit them.
- Payment records: For token packs and Pro passes, the order number, product, amount, currency, payment status and dates, and your Pro end date and how it was granted. We never receive your card details or wallet keys.
- Technical data: IP address, browser type, and similar log data, used for security, rate limiting, and abuse prevention.
Cookies and browser storage
We only use cookies and storage needed to run the Service. We do not use advertising or third-party tracking cookies, and we do not run analytics that follow you across other sites.
- Sign-in cookie keeps you signed in to your account.
- Site access cookie remembers that you have passed the site's access check, so you are not asked on every page.
- Sign-in security cookies are set briefly while you sign in with Google or Fanvue to protect against forged sign-in requests, and are removed afterwards.
- Visitor cookie stores a random identifier for up to a year so we can count unique visitors and button clicks on our own site. It is not shared with other companies and does not follow you elsewhere.
- Referral cookie remembers a sharing code from a link you followed, for up to 60 days, so we can credit the person who invited you if you create an account.
- Browser storage remembers, until you close your browser, that you confirmed you are 18 or older. It also keeps your generator settings and preferences such as your chosen payment method. This stays on your device and is not sent to us.
You can clear cookies and site data in your browser at any time. If you do, you will be signed out and your saved preferences will be reset.
2. How We Use Information
- To provide, operate, and maintain the Service.
- To authenticate you and manage your account and subscription status.
- To deliver generated images to your connected Fanvue messages when you enable that feature.
- To enforce free-tier limits, rate limits, and our Content Policy.
- To understand how the Service is used (pages visited, sign-ups, and whether people start checkout), using first-party stats only.
- To run the referral program, including checking a public Reddit post you ask us to credit.
- To detect, prevent, and investigate fraud, abuse, and prohibited content (including logging blocked prompt attempts for safety and legal compliance).
- To comply with legal obligations.
3. Legal Bases for Using Your Data
Where data protection laws such as the GDPR apply, we rely on these grounds:
- To provide the Service you asked for (performance of our contract with you): your account, prompts, images, tokens, payments and Pro status.
- Our legitimate interests in keeping the Service secure and working: rate limiting, fraud and abuse prevention, preventing multiple accounts, first-party usage stats on our own site, and fixing problems you report. We weigh these against your rights and keep the data involved to a minimum.
- Legal obligations: keeping payment records for tax and accounting, and preserving and reporting evidence of child sexual abuse material.
- Your consent for optional features, such as sending images to your Fanvue messages or sharing images to the feed. You can withdraw consent at any time by turning the feature off or unsharing a post; this does not affect anything done before.
4. Sensitive Information
Because Vetiver Labs is an adult service, your prompts, images and likes may reveal things about your sexual interests. We treat this as sensitive information. We use it only to generate and store your images, run the features you choose, and enforce our Content Policy. We never use it for advertising, never sell it or share it with marketers, and never build profiles of you from it. Our team looks at individual prompts or images only when needed to investigate abuse, a report, a support request you made, or a technical problem.
5. Safety Logging
To protect against illegal content, we automatically screen prompts and log attempts to generate prohibited material involving minors, including the prompt text, associated account, IP address, and timestamp. This information may be retained and disclosed to authorities where required or permitted by law.
6. Third-Party Services
We rely on third parties to provide parts of the Service, including:
- Authentication providers — Google and Fanvue (for sign-in).
- Fanvue — for subscription/payment processing and message delivery. Payments are handled entirely by Fanvue under its own privacy policy; we do not receive or store payment-card details.
- Telegram and NOWPayments — for token purchases. Telegram processes Stars payments; NOWPayments processes cryptocurrency payments on its hosted checkout page. We receive only the order and payment status needed to credit your tokens, never your card details or wallet keys.
- Google (Gmail) — feedback you send is delivered to our team's email inbox.
- Hosting/infrastructure — providers that store data and serve the Service.
These providers process data under their own privacy policies. We also disclose information where the law requires it, or where it is necessary to protect someone's safety or to deal with illegal content.
If Vetiver Labs is sold, merged or reorganized, your information may pass to the new owner as part of that transaction. It will remain protected by this Policy, and we will tell you before it becomes subject to a different one.
7. Data Retention
- Account, prompts, images and likes: kept while your account exists. You can delete your account yourself from your account page, or ask us to. Either way, your account, images, prompts, feed posts and likes are removed from the live Service straight away, and they drop out of our backups within 14 days, which is how long we keep daily backups.
- Payment records: kept for as long as tax and accounting laws require, even after your account is deleted.
- After you delete your account: for 90 days we keep a one-way scrambled fingerprint (a hash) of your email address and sign-in IDs. It can't be turned back into your email, and it is used only to stop free tokens being claimed again by deleting and re-creating an account. If you tell us why you left, we keep that answer without anything that identifies you.
- Feedback and complaints: kept for up to two years so we can follow up and spot recurring problems, then deleted. If you delete your account, past feedback is no longer linked to it.
- Server and security logs: kept for a limited period for security and abuse prevention, then deleted.
- Safety logs of attempts to generate prohibited content: kept for as long as needed to protect people and meet legal obligations.
Images you generate are retained on every plan, including the free tier, so that your library is available whenever you sign in. This does not depend on having a subscription, and your images remain available to you if a subscription later lapses. Deleting an image from your library removes it from our servers, as does the "Delete all" control, and neither can be undone. Images you have chosen to send to Fanvue are also held by Fanvue under its own policies, and deleting an image here does not remove the copy delivered there.
8. Data Security
We use reasonable technical and organizational measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach exposes your personal data in a way likely to put you at risk, we will tell you and the relevant authorities without undue delay, as the law requires.
9. Your Rights
Depending on your jurisdiction (e.g., under GDPR or CCPA), you may have rights to access, correct, delete, or restrict processing of your personal data, to receive a copy of it, and to object to or withdraw consent. We do not sell your personal data or share it for advertising. You can delete your account and everything in it at any time from your account page. To exercise any other right, email vetiverlabs@gmail.com from the address on your account. We respond within one month, and will tell you if a complex request needs longer. If you are unhappy with our answer, you can complain to the data protection authority where you live.
10. Children
The Service is strictly for adults. We do not knowingly collect information from anyone under 18. If we learn that we have collected such information, we will delete it.
11. International Users
Your information may be processed in countries other than your own. By using the Service, you consent to such transfers where permitted by law.
12. Changes to This Policy
We may update this Policy from time to time. Material changes will be indicated by updating the "Last updated" date above.
13. Contact
For privacy questions or requests, email vetiverlabs@gmail.com or see our Contact page. To report content or ask for something to be removed, see our Complaints & Content Removal policy.