Privacy

The controller is BOKOR.AGENCY and AMZKR INC., at 500 7th Avenue, New York, NY 10018. Questions about your data go to [privacy contact address].

• Account details. Your email address, your display name, and which workspaces you belong to. We never store a password you can lose — sign-in is by link or by an identity provider you already use.
• Your work. Prompts, uploads, references, finished renders, projects, and the settings around them.
• Cast and consent records. If you add a real person as a cast member: their photos, the derived face data used to recognise them, the consent evidence you record, and the licence terms attached to it.
• Usage. Which rooms you open, which renders you run, what they cost, and errors the app hits. This is how the credit balance and the audit log work.
• Payment metadata. That a payment succeeded, for how much, and which plan. Card numbers never reach us; they go straight to our payment processor.

To run the service you asked for: account details, your work and payment metadata, on the basis of performing our contract with you.

To keep it working and safe: usage data, error reports and the audit log, on the basis of our legitimate interest in a product that does not fall over and is not abused.

To meet the law: billing records and moderation decisions, kept for as long as the relevant rules require.

We do not sell your data, and we do not train models on your work.

A render sends the prompt and any reference files you attached to the engine that performs it, and nothing else — not your email, not your other projects, not your workspace. Which engines exist and what they do is on the models page. In the studio we choose the engine for you; in the other rooms you choose it yourself. If you bring your own key, the work goes to that provider on your account and under their terms.

Engine providers keep what they receive under their own policies, which we do not control. That is a reason to think before uploading somebody else’s confidential material.

Finished work and uploads, by plan:

Account details are kept while the account exists. Billing records are kept for as long as tax law requires. The audit log of who did what in a workspace is kept while the workspace exists, because its whole job is to answer a question later. Error reports age out within 90 days.

Delete a render, a listing or a published page and it goes. Backups already taken age out on their own cycle, within 30 days.

Consent records are the exception in the other direction: when a person withdraws consent we delete their photos, face data and trained elements, and keep only the fact that a withdrawal happened and when — which is the record that protects them.

Only the providers that make the service work, each for one job:

• Our hosting and database provider runs the application, the database and the file storage.
• Our payment processor takes card details, which never reach us, and tells us only that a payment succeeded.
• The model providers listed on our models page receive the prompt and any reference files for the render you asked for, and nothing else.
• Our email provider sends sign-in links and receipts.
• Our error reporting provider receives crash reports, with identifying fields stripped before they are sent.

Other members of your workspace see the work in it. Anything you publish or list for sale is public because you asked for it to be.

The database and file storage are in [storage region]. Engine providers may process a render elsewhere; where that means a transfer out of the UK or EEA, it happens under the standard contractual clauses.

Files you have not published are stored privately and reached through short-lived signed links, not public URLs.

You can ask for a copy of what we hold, correct it, delete it, object to how we use it, or ask us to stop entirely. Some of it you can do yourself: every finished render can be downloaded from your library, and anything you delete in the app is deleted.

There is no self-serve button for closing an account and taking everything with you — not yet. Until there is, write to [privacy contact address] and we will do it by hand and answer within a month. If we get it wrong you can complain to your data protection regulator.

If you are a cast member rather than a customer and want your likeness removed, write to the same address. You do not need an account, and we will act on it whether or not the customer agrees.

We set a cookie to keep you signed in, and one to remember interface preferences like whether the sidebar is collapsed. That is all: no advertising cookies, no third-party trackers, nothing that follows you off this site. Product analytics are counted on our own servers against your workspace, not by an outside network.

VODOO is not for children. We do not knowingly collect data about anyone under 16, and we delete it if we find it. Making sexual or exploitative imagery of a child is illegal everywhere we operate and gets an account closed and reported.

When this policy changes we update the date at the top, and tell you in the product if the change matters. The contact address for anything in it is [privacy contact address].