Last updated: July 26, 2026
Welcome to VitePic ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered product photography service. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the service.
We may collect personal information that you provide directly to us, including:
We automatically collect certain information about your use of our service:
We maintain the following data categories with defined retention periods:
| Data | Purpose | Retention |
|---|---|---|
| live_visitors (IP, geo, device) | Real-time analytics | 30 days, then purged |
| chat_messages | Support history | 90 days; deletable on request |
| email_logs | CAN-SPAM compliance | 1 year active, then archived |
| AI-generated images | Your content — you own it | Until account deletion |
| points_transactions | Tax/billing audit trail | 7 years (anonymized on deletion) |
We use the collected information for the following purposes:
When you upload images to VitePic, we process them using our AI algorithms to enhance backgrounds, add shadows, and apply color grading. Your images are:
Images you upload are processed by third-party AI providers routed through OpenRouter. OpenRouter incorporates a Data Processing Addendum (DPA) into its Terms of Service for commercial use. Individual model providers (e.g. OpenAI, Anthropic, Google) may have their own data retention policies. We do not use your images to train AI models. For enterprise EU data residency, contact OpenRouter directly. See openrouter.ai/terms for their DPA and privacy controls.
We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:
We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, secure servers, and regular security audits.
You have the following rights regarding your personal information:
POST /api/user/delete-me (requires authentication)GET /api/user/export-data (JSON download)Account deletion removes gallery images, anonymizes chat messages, and soft-deletes your profile while retaining anonymized billing records as required by law.
We use a lightweight cookie consent banner (no third-party CMP). Essential cookies (Clerk authentication, Supabase session) are always active. Analytics cookies (Google Analytics, Meta Pixel) are opt-in and disabled by default. We respect your browser's Do Not Track setting. Preferences are stored in localStorage. For details, see our Cookie Policy.
Our service may integrate with third-party services for authentication, payments, and analytics. These services have their own privacy policies, and we encourage you to review them.
Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with applicable data protection laws.
Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us immediately.
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the service after any modifications constitutes acceptance of the updated policy.
If you have any questions about this Privacy Policy or our data practices, please contact us at: