Privacy Policy

• Your designs are private by default and are never used to train AI models unless you explicitly opt in (you can change your mind any time in Account → Data & privacy).
• You can export all your data and delete your account yourself, any time, without asking us.
• We don't sell personal data, and we don't run advertising trackers.
• We use a short list of service providers (“subprocessors”) to run the product. They are listed below.

We built Solid Vibes to be GDPR-ready: we collect what the product needs, explain why, and give you the controls. The rest of this page is the detail.

Solid Vibes (“we”, “us”) is the controller of the personal data described here. [Legal entity name, address and registration number to be added before launch.] You can reach our privacy contact at [email protected].

The homepage “try it” box needs no account. If you use it we keep your prompt and the two generated concept images for up to 7 days so you can carry them into a new account, and we store only a salted hash of your IP address (never the address itself) to apply rate limits. After 7 days they are deleted.

We do not collect payment card numbers: payments are handled by Paddle (see subprocessors).

• To provide Solid Vibes (contract): hosting your Things, running the geometry kernel and the AI agent, exports, sharing, billing and support.
• To keep it safe (legitimate interests): abuse prevention, rate limiting, bot protection on sign-up and the try-it box, security logs.
• To meet legal duties (legal obligation): tax and accounting records, responding to lawful requests.
• To improve the product with your content (consent only): see the next section.

[Counsel to confirm the legal basis for each purpose and add any analytics we adopt. Today the product runs without third-party analytics or advertising cookies.]

When you use the agent, concept images or voice, the text, images and audio needed for that request are sent to our AI provider (OpenAI) through its API and the results are stored in your workspace. Requests are made with our keys, not yours, and are charged to your AI credits.

Your designs are never used to train models, ours or anyone's, without your explicit opt-in. The opt-in is off by default, applies only to your own account, and you can switch it off again at any time in Account → Data & privacy.

[Counsel to confirm the provider's current API data-retention and training terms before launch, and link them here.]

Everything you create is private by default. It is visible only to you and to the people you invite to a workspace or send a share link to. Share links can be limited to viewing, commenting, editing or forking, can expire, and can be password-protected.

If you publish a Thing to the community (“public”), anyone can see it, copy it and build on it. Public Things carry an open-source license. The default is Creative Commons Attribution 4.0 (CC-BY-4.0); you can choose a different license for each Thing, and the default itself is configurable on our side. Publishing is your choice and you can switch a Thing back to private (copies others already made under the license stay theirs).

Paddle is the merchant of record for paid plans and credit packs: you buy from Paddle, it collects payment and sales tax, and it is an independent controller of your payment data under its own privacy policy. We receive only the subscription status and the details needed to apply your plan.

[Hosting regions, an email-delivery provider and the full list of transfer safeguards (for example standard contractual clauses) to be confirmed with counsel and added here.] We will update this list before adding a new provider.

Under the GDPR and similar laws you can ask us to access, correct, delete, restrict or move your personal data, object to some processing, and withdraw consent. Most of this you can do yourself:

• Access and portability: download a full export of your data (profile, workspaces, projects, Things with their history, an upload list and concept images) from Account → Data & privacy.
• Erasure: delete your account from Account → Delete account. Your personal workspace and everything in it is removed.
• Correction: edit your profile in Account.
• Consent: the model-training opt-in is a switch in Account → Data & privacy.
• Anything else: write to [email protected]. If you are unhappy with our answer you can complain to your local data-protection authority.

• Your Things and history: until you delete them. Deleted Things sit in Trash for 30 days, then are purged.
• Try-it prompts and images from the homepage: up to 7 days.
• After a trial ends your account becomes read-only; designs are never deleted because of that.
• Deleted accounts: removed from the live service immediately; backups roll off within [retention period to be confirmed].
• Invoices and tax records: as long as the law requires (held by Paddle).
• Security and audit logs: [period to be confirmed].

We use only what the product needs: a sign-in session, a “remember this device” choice, your theme and interface preferences, and a short-lived cookie that links the homepage try-it box to your new account. We do not use advertising or cross-site tracking cookies. If that changes we will ask for your consent first.

We protect data with per-row access rules in the database, private file storage with short-lived links, two-step verification and passkeys, a device list with remote sign-out, rate limiting and audit logs. See Security for the details, and what is still on our roadmap.

Solid Vibes is not directed at children under 16 and we do not knowingly collect their data. [Counsel to confirm the age threshold per jurisdiction.]

We will tell you about material changes to this policy in the app or by email before they take effect. Questions: [email protected].